00000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:16 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:16 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:16 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:16 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 390.682472] binder: 10487:10491 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 390.682482] binder: 10487:10491 Release 1 refcount change on invalid ref 0 ret -22 [ 390.694222] binder: BINDER_SET_CONTEXT_MGR already set [ 390.694231] binder: 10488:10497 ioctl 40046207 0 returned -16 [ 390.694337] binder_alloc: 7943: binder_alloc_buf, no vma [ 390.694356] binder: 10488:10497 transaction failed 29189/-3, size 72-24 line 3136 03:53:16 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:16 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:16 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 390.717781] binder: 10499:10505 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 390.717790] binder: 10499:10505 BC_INCREFS_DONE u0000000000000003 no match ** 2 printk messages dropped ** [ 390.717815] binder: 10499:10505 Release 1 refcount change on invalid ref 0 ret -22 [ 390.733487] binder: BINDER_SET_CONTEXT_MGR already set [ 390.733494] binder: 10507:10508 ioctl 40046207 0 returned -16 [ 390.733573] binder_alloc: 7943: binder_alloc_buf, no vma [ 390.733588] binder: 10507:10508 transaction failed 29189/-3, size 72-24 line 3136 [ 390.794040] binder: 10515:10519 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 390.794051] binder: 10515:10519 BC_INCREFS_DONE u0000000000000003 no match [ 390.794057] binder: 10515:10519 ERROR: BC_REGISTER_LOOPER called without request [ 390.794066] binder: 10515:10519 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:16 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:16 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:16 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 390.794075] binder: 10515:10519 Release 1 refcount change on invalid ref 0 ret -22 [ 390.927202] binder: BINDER_SET_CONTEXT_MGR already set [ 390.927209] binder: 10532:10534 ioctl 40046207 0 returned -16 [ 390.927385] binder_alloc: 7943: binder_alloc_buf, no vma [ 390.927402] binder: 10532:10534 transaction failed 29189/-3, size 72-24 line 3136 [ 390.966445] binder: BINDER_SET_CONTEXT_MGR already set [ 390.966453] binder: 10546:10549 ioctl 40046207 0 returned -16 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 390.966549] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 390.966625] binder: 10546:10549 transaction failed 29189/-3, size 72-24 line 3136 [ 390.983507] binder: 10535:10541 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 390.983516] binder: 10535:10541 BC_INCREFS_DONE u0000000000000003 no match [ 390.983523] binder: 10535:10541 ERROR: BC_REGISTER_LOOPER called without request [ 390.983530] binder: 10535:10541 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 390.983540] binder: 10535:10541 Release 1 refcount change on invalid ref 0 ret -22 03:53:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 391.032306] binder: BINDER_SET_CONTEXT_MGR already set [ 391.032315] binder: 10564:10565 ioctl 40046207 0 returned -16 [ 391.032411] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.032430] binder: 10564:10565 transaction failed 29189/-3, size 72-24 line 3136 [ 391.182580] binder: BINDER_SET_CONTEXT_MGR already set [ 391.182589] binder: 10576:10581 ioctl 40046207 0 returned -16 [ 391.182777] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.182963] binder: 10576:10581 transaction failed 29189/-3, size 72-24 line 3136 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 391.187340] binder: 10574:10582 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.187350] binder: 10574:10582 BC_INCREFS_DONE u0000000000000003 no match [ 391.187355] binder: 10574:10582 ERROR: BC_REGISTER_LOOPER called without request 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 391.187363] binder: 10574:10582 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 391.187372] binder: 10574:10582 Release 1 refcount change on invalid ref 0 ret -22 [ 391.253634] binder: BINDER_SET_CONTEXT_MGR already set [ 391.253643] binder: 10593:10595 ioctl 40046207 0 returned -16 [ 391.256117] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.256135] binder: 10593:10595 transaction failed 29189/-3, size 72-24 line 3136 [ 391.262353] binder: 10596:10604 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.262369] binder: 10596:10604 BC_INCREFS_DONE u0000000000000003 no match [ 391.262374] binder: 10596:10604 ERROR: BC_REGISTER_LOOPER called without request [ 391.262383] binder: 10596:10604 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 391.262393] binder: 10596:10604 Release 1 refcount change on invalid ref 0 ret -22 [ 391.441136] binder: 10622:10625 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.441146] binder: 10622:10625 BC_INCREFS_DONE u0000000000000003 no match [ 391.441152] binder: 10622:10625 ERROR: BC_REGISTER_LOOPER called without request [ 391.441161] binder: 10622:10625 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 391.441170] binder: 10622:10625 Release 1 refcount change on invalid ref 0 ret -22 [ 391.442924] binder: BINDER_SET_CONTEXT_MGR already set [ 391.442935] binder: 10621:10624 ioctl 40046207 0 returned -16 [ 391.443341] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 391.443362] binder: 10621:10624 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 391.487037] binder: 10633:10638 Release 1 refcount change on invalid ref 0 ret -22 [ 391.492436] binder: BINDER_SET_CONTEXT_MGR already set [ 391.492444] binder: 10635:10639 ioctl 40046207 0 returned -16 [ 391.492534] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.492552] binder: 10635:10639 transaction failed 29189/-3, size 72-24 line 3136 [ 391.687836] binder: BINDER_SET_CONTEXT_MGR already set [ 391.687845] binder: 10659:10665 ioctl 40046207 0 returned -16 [ 391.687937] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.687957] binder: 10659:10665 transaction failed 29189/-3, size 72-24 line 3136 03:53:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 391.696741] binder: 10662:10667 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.696750] binder: 10662:10667 BC_INCREFS_DONE u0000000000000003 no match [ 391.696755] binder: 10662:10667 ERROR: BC_REGISTER_LOOPER called without request [ 391.696763] binder: 10662:10667 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 391.696774] binder: 10662:10667 Release 1 refcount change on invalid ref 0 ret -22 [ 391.732295] binder: BINDER_SET_CONTEXT_MGR already set [ 391.732304] binder: 10671:10677 ioctl 40046207 0 returned -16 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 391.732408] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.732426] binder: 10671:10677 transaction failed 29189/-3, size 72-24 line 3136 ** 1 printk messages dropped ** [ 391.737068] binder: 10674:10678 BC_INCREFS_DONE u0000000000000003 no match [ 391.737074] binder: 10674:10678 ERROR: BC_REGISTER_LOOPER called without request 03:53:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 391.737082] binder: 10674:10678 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 391.737091] binder: 10674:10678 Release 1 refcount change on invalid ref 0 ret -22 [ 391.753262] binder: BINDER_SET_CONTEXT_MGR already set [ 391.753271] binder: 10683:10686 ioctl 40046207 0 returned -16 [ 391.753361] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 391.753380] binder: 10683:10686 transaction failed 29189/-3, size 72-24 line 3136 [ 391.929382] binder: 10700:10707 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.929392] binder: 10700:10707 BC_INCREFS_DONE u0000000000000003 no match 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 391.929398] binder: 10700:10707 ERROR: BC_REGISTER_LOOPER called without request ** 7 printk messages dropped ** [ 391.962309] binder: 10715:10716 BC_INCREFS_DONE u0000000000000003 no match [ 391.962315] binder: 10715:10716 ERROR: BC_REGISTER_LOOPER called without request [ 391.962323] binder: 10715:10716 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 391.962335] binder: 10715:10716 Release 1 refcount change on invalid ref 0 ret -22 [ 392.008691] binder: 10721:10725 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.008701] binder: 10721:10725 BC_INCREFS_DONE u0000000000000003 no match [ 392.008706] binder: 10721:10725 ERROR: BC_REGISTER_LOOPER called without request [ 392.008715] binder: 10721:10725 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.008726] binder: 10721:10725 Release 1 refcount change on invalid ref 0 ret -22 [ 392.014297] binder: BINDER_SET_CONTEXT_MGR already set [ 392.014306] binder: 10726:10729 ioctl 40046207 0 returned -16 03:53:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 392.014401] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.014417] binder: 10726:10729 transaction failed 29189/-3, size 72-24 line 3136 [ 392.173303] binder: 10742:10744 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.173312] binder: 10742:10744 BC_INCREFS_DONE u0000000000000003 no match 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 392.173318] binder: 10742:10744 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 392.186142] binder: 10743:10748 transaction failed 29189/-3, size 72-24 line 3136 [ 392.238118] binder: BINDER_SET_CONTEXT_MGR already set [ 392.238127] binder: 10752:10756 ioctl 40046207 0 returned -16 [ 392.238242] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.238259] binder: 10752:10756 transaction failed 29189/-3, size 72-24 line 3136 [ 392.242779] binder: 10753:10758 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.242789] binder: 10753:10758 BC_INCREFS_DONE u0000000000000003 no match [ 392.242794] binder: 10753:10758 ERROR: BC_REGISTER_LOOPER called without request 03:53:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 392.242802] binder: 10753:10758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.242811] binder: 10753:10758 Release 1 refcount change on invalid ref 0 ret -22 [ 392.269381] binder: BINDER_SET_CONTEXT_MGR already set [ 392.269391] binder: 10763:10767 ioctl 40046207 0 returned -16 [ 392.269712] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.269731] binder: 10763:10767 transaction failed 29189/-3, size 72-24 line 3136 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 392.273658] binder: 10765:10768 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.273668] binder: 10765:10768 BC_INCREFS_DONE u0000000000000003 no match [ 392.273674] binder: 10765:10768 ERROR: BC_REGISTER_LOOPER called without request [ 392.273681] binder: 10765:10768 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.273694] binder: 10765:10768 Release 1 refcount change on invalid ref 0 ret -22 [ 392.426572] binder: 10781:10784 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.426581] binder: 10781:10784 BC_INCREFS_DONE u0000000000000003 no match [ 392.426588] binder: 10781:10784 ERROR: BC_REGISTER_LOOPER called without request [ 392.426601] binder: 10781:10784 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.426882] binder: 10781:10784 Release 1 refcount change on invalid ref 0 ret -22 [ 392.458742] binder: BINDER_SET_CONTEXT_MGR already set [ 392.458753] binder: 10778:10786 ioctl 40046207 0 returned -16 [ 392.459457] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.459475] binder: 10778:10786 transaction failed 29189/-3, size 72-24 line 3136 [ 392.492108] binder: BINDER_SET_CONTEXT_MGR already set 03:53:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 392.492116] binder: 10798:10801 ioctl 40046207 0 returned -16 [ 392.498509] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.498534] binder: 10798:10801 transaction failed 29189/-3, size 72-24 line 3136 [ 392.524747] binder: BINDER_SET_CONTEXT_MGR already set 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 392.524756] binder: 10803:10805 ioctl 40046207 0 returned -16 ** 3 printk messages dropped ** [ 392.547032] binder: 10797:10809 BC_INCREFS_DONE u0000000000000003 no match ** 4 printk messages dropped ** [ 392.705791] binder: 10818:10822 ioctl 40046207 0 returned -16 [ 392.705886] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.705905] binder: 10818:10822 transaction failed 29189/-3, size 72-24 line 3136 [ 392.724248] binder: 10820:10824 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.724258] binder: 10820:10824 BC_INCREFS_DONE u0000000000000003 no match 03:53:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 392.724263] binder: 10820:10824 ERROR: BC_REGISTER_LOOPER called without request [ 392.724271] binder: 10820:10824 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.724281] binder: 10820:10824 Release 1 refcount change on invalid ref 0 ret -22 [ 392.739375] binder: BINDER_SET_CONTEXT_MGR already set [ 392.739383] binder: 10828:10832 ioctl 40046207 0 returned -16 [ 392.739489] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 392.739508] binder: 10828:10832 transaction failed 29189/-3, size 72-24 line 3136 [ 392.801974] binder: 10844:10846 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) ** 2 printk messages dropped ** [ 392.802000] binder: 10844:10846 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 2 printk messages dropped ** [ 392.810442] binder: 10841:10843 ioctl 40046207 0 returned -16 [ 392.810528] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.810547] binder: 10841:10843 transaction failed 29189/-3, size 72-24 line 3136 [ 392.969891] binder: BINDER_SET_CONTEXT_MGR already set [ 392.969900] binder: 10865:10869 ioctl 40046207 0 returned -16 [ 392.969994] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.970013] binder: 10865:10869 transaction failed 29189/-3, size 72-24 line 3136 [ 392.989329] binder: 10867:10870 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.989338] binder: 10867:10870 BC_INCREFS_DONE u0000000000000003 no match [ 392.989344] binder: 10867:10870 ERROR: BC_REGISTER_LOOPER called without request [ 392.989352] binder: 10867:10870 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 392.989362] binder: 10867:10870 Release 1 refcount change on invalid ref 0 ret -22 [ 393.020536] binder: BINDER_SET_CONTEXT_MGR already set [ 393.020546] binder: 10876:10880 ioctl 40046207 0 returned -16 [ 393.020636] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.020656] binder: 10876:10880 transaction failed 29189/-3, size 72-24 line 3136 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 393.048666] binder: 10882:10892 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.048675] binder: 10882:10892 BC_INCREFS_DONE u0000000000000003 no match ** 1 printk messages dropped ** [ 393.048697] binder: 10882:10892 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.048706] binder: 10882:10892 Release 1 refcount change on invalid ref 0 ret -22 [ 393.061527] binder: BINDER_SET_CONTEXT_MGR already set [ 393.061537] binder: 10886:10893 ioctl 40046207 0 returned -16 [ 393.061644] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.061663] binder: 10886:10893 transaction failed 29189/-3, size 72-24 line 3136 [ 393.215610] binder: BINDER_SET_CONTEXT_MGR already set [ 393.215618] binder: 10911:10916 ioctl 40046207 0 returned -16 [ 393.218593] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 393.218610] binder: 10911:10916 transaction failed 29189/-3, size 72-24 line 3136 [ 393.222791] binder: 10909:10912 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.222800] binder: 10909:10912 BC_INCREFS_DONE u0000000000000003 no match [ 393.222806] binder: 10909:10912 ERROR: BC_REGISTER_LOOPER called without request [ 393.222813] binder: 10909:10912 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.222821] binder: 10909:10912 Release 1 refcount change on invalid ref 0 ret -22 [ 393.265618] binder: 10922:10926 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.265628] binder: 10922:10926 BC_INCREFS_DONE u0000000000000003 no match ** 1 printk messages dropped ** [ 393.265642] binder: 10922:10926 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.265651] binder: 10922:10926 Release 1 refcount change on invalid ref 0 ret -22 [ 393.269960] binder: BINDER_SET_CONTEXT_MGR already set 03:53:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.269968] binder: 10923:10927 ioctl 40046207 0 returned -16 [ 393.270070] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.270089] binder: 10923:10927 transaction failed 29189/-3, size 72-24 line 3136 [ 393.304709] binder: 10929:10938 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.304719] binder: 10929:10938 BC_INCREFS_DONE u0000000000000003 no match [ 393.304724] binder: 10929:10938 ERROR: BC_REGISTER_LOOPER called without request 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.304732] binder: 10929:10938 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.304743] binder: 10929:10938 Release 1 refcount change on invalid ref 0 ret -22 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) ** 1 printk messages dropped ** [ 393.456984] binder: 10948:10952 BC_INCREFS_DONE u0000000000000003 no match ** 4 printk messages dropped ** [ 393.458331] binder: 10946:10954 ioctl 40046207 0 returned -16 [ 393.458437] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.458457] binder: 10946:10954 transaction failed 29189/-3, size 72-24 line 3136 [ 393.505214] binder: 10964:10966 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.505224] binder: 10964:10966 BC_INCREFS_DONE u0000000000000003 no match [ 393.505229] binder: 10964:10966 ERROR: BC_REGISTER_LOOPER called without request [ 393.505237] binder: 10964:10966 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.505246] binder: 10964:10966 Release 1 refcount change on invalid ref 0 ret -22 [ 393.520435] binder: BINDER_SET_CONTEXT_MGR already set [ 393.520442] binder: 10970:10971 ioctl 40046207 0 returned -16 [ 393.520529] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.520543] binder: 10970:10971 transaction failed 29189/-3, size 72-24 line 3136 03:53:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.562238] binder: 10973:10980 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.562247] binder: 10973:10980 BC_INCREFS_DONE u0000000000000003 no match [ 393.562253] binder: 10973:10980 ERROR: BC_REGISTER_LOOPER called without request [ 393.562261] binder: 10973:10980 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 393.562272] binder: 10973:10980 Release 1 refcount change on invalid ref 0 ret -22 [ 393.720902] binder: BINDER_SET_CONTEXT_MGR already set [ 393.720911] binder: 10991:10993 ioctl 40046207 0 returned -16 [ 393.721003] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.721021] binder: 10991:10993 transaction failed 29189/-3, size 72-24 line 3136 [ 393.738592] binder: 10994:11000 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.738602] binder: 10994:11000 BC_INCREFS_DONE u0000000000000003 no match [ 393.738607] binder: 10994:11000 ERROR: BC_REGISTER_LOOPER called without request [ 393.738615] binder: 10994:11000 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.738626] binder: 10994:11000 Release 1 refcount change on invalid ref 0 ret -22 [ 393.767940] binder: BINDER_SET_CONTEXT_MGR already set [ 393.767947] binder: 11003:11005 ioctl 40046207 0 returned -16 [ 393.768060] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.768074] binder: 11003:11005 transaction failed 29189/-3, size 72-24 line 3136 [ 393.813317] binder: 11013:11016 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.813326] binder: 11013:11016 BC_INCREFS_DONE u0000000000000003 no match [ 393.813346] binder: 11013:11016 ERROR: BC_REGISTER_LOOPER called without request 03:53:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 393.813354] binder: 11013:11016 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.813364] binder: 11013:11016 Release 1 refcount change on invalid ref 0 ret -22 [ 393.836536] binder: BINDER_SET_CONTEXT_MGR already set [ 393.836544] binder: 11019:11022 ioctl 40046207 0 returned -16 [ 393.836710] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 393.836728] binder: 11019:11022 transaction failed 29189/-3, size 72-24 line 3136 [ 393.975675] binder: BINDER_SET_CONTEXT_MGR already set [ 393.975683] binder: 11036:11040 ioctl 40046207 0 returned -16 [ 393.975781] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.975800] binder: 11036:11040 transaction failed 29189/-3, size 72-24 line 3136 [ 393.995152] binder: 11034:11042 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.995161] binder: 11034:11042 BC_INCREFS_DONE u0000000000000003 no match [ 393.995167] binder: 11034:11042 ERROR: BC_REGISTER_LOOPER called without request [ 393.995175] binder: 11034:11042 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.995197] binder: 11034:11042 Release 1 refcount change on invalid ref 0 ret -22 [ 394.015913] binder: BINDER_SET_CONTEXT_MGR already set [ 394.015924] binder: 11045:11048 ioctl 40046207 0 returned -16 [ 394.016019] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 394.016038] binder: 11045:11048 transaction failed 29189/-3, size 72-24 line 3136 [ 394.028035] binder: 11050:11054 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.028044] binder: 11050:11054 BC_INCREFS_DONE u0000000000000003 no match [ 394.028050] binder: 11050:11054 ERROR: BC_REGISTER_LOOPER called without request [ 394.028058] binder: 11050:11054 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.028068] binder: 11050:11054 Release 1 refcount change on invalid ref 0 ret -22 [ 394.047049] binder: BINDER_SET_CONTEXT_MGR already set 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 394.047058] binder: 11055:11057 ioctl 40046207 0 returned -16 [ 394.047148] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.047164] binder: 11055:11057 transaction failed 29189/-3, size 72-24 line 3136 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 394.059485] binder: 11059:11061 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.059494] binder: 11059:11061 BC_INCREFS_DONE u0000000000000003 no match ** 1 printk messages dropped ** [ 394.059507] binder: 11059:11061 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.059517] binder: 11059:11061 Release 1 refcount change on invalid ref 0 ret -22 [ 394.202451] binder: BINDER_SET_CONTEXT_MGR already set [ 394.202460] binder: 11072:11074 ioctl 40046207 0 returned -16 [ 394.202550] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.202568] binder: 11072:11074 transaction failed 29189/-3, size 72-24 line 3136 [ 394.217633] binder: 11075:11080 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.217642] binder: 11075:11080 BC_INCREFS_DONE u0000000000000003 no match [ 394.217647] binder: 11075:11080 ERROR: BC_REGISTER_LOOPER called without request [ 394.217654] binder: 11075:11080 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 394.217680] binder: 11075:11080 Release 1 refcount change on invalid ref 0 ret -22 [ 394.280836] binder: BINDER_SET_CONTEXT_MGR already set [ 394.280844] binder: 11084:11092 ioctl 40046207 0 returned -16 [ 394.280951] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.280970] binder: 11084:11092 transaction failed 29189/-3, size 72-24 line 3136 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 394.313133] binder: 11088:11103 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 2 printk messages dropped ** [ 394.313157] binder: 11088:11103 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 4 printk messages dropped ** [ 394.342808] binder: 11102:11106 transaction failed 29189/-3, size 72-24 line 3136 [ 394.490515] binder: 11121:11123 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.490525] binder: 11121:11123 BC_INCREFS_DONE u0000000000000003 no match [ 394.490530] binder: 11121:11123 ERROR: BC_REGISTER_LOOPER called without request 03:53:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 394.490538] binder: 11121:11123 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.490547] binder: 11121:11123 Release 1 refcount change on invalid ref 0 ret -22 [ 394.501435] binder: BINDER_SET_CONTEXT_MGR already set [ 394.501445] binder: 11122:11124 ioctl 40046207 0 returned -16 [ 394.501537] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.501556] binder: 11122:11124 transaction failed 29189/-3, size 72-24 line 3136 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 394.568285] binder: 11134:11144 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.568296] binder: 11134:11144 BC_INCREFS_DONE u0000000000000003 no match [ 394.568301] binder: 11134:11144 ERROR: BC_REGISTER_LOOPER called without request 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 394.568310] binder: 11134:11144 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.568320] binder: 11134:11144 Release 1 refcount change on invalid ref 0 ret -22 [ 394.590169] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 394.590340] binder: 11142:11146 transaction failed 29189/-3, size 72-24 line 3136 [ 394.728963] binder: 11162:11168 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.728972] binder: 11162:11168 BC_INCREFS_DONE u0000000000000003 no match [ 394.728978] binder: 11162:11168 ERROR: BC_REGISTER_LOOPER called without request [ 394.728986] binder: 11162:11168 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.728997] binder: 11162:11168 Release 1 refcount change on invalid ref 0 ret -22 [ 394.733670] binder: BINDER_SET_CONTEXT_MGR already set [ 394.733679] binder: 11165:11172 ioctl 40046207 0 returned -16 [ 394.733775] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.733794] binder: 11165:11172 transaction failed 29189/-3, size 72-24 line 3136 [ 394.801325] binder: BINDER_SET_CONTEXT_MGR already set [ 394.801334] binder: 11180:11187 ioctl 40046207 0 returned -16 03:53:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 394.801444] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.801461] binder: 11180:11187 transaction failed 29189/-3, size 72-24 line 3136 [ 394.811249] binder: 11181:11185 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 394.811258] binder: 11181:11185 BC_INCREFS_DONE u0000000000000003 no match [ 394.811264] binder: 11181:11185 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 394.865319] binder: 11200:11202 transaction failed 29189/-3, size 72-24 line 3136 [ 394.974172] binder: BINDER_SET_CONTEXT_MGR already set [ 394.974191] binder: 11208:11212 ioctl 40046207 0 returned -16 [ 394.974289] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.974308] binder: 11208:11212 transaction failed 29189/-3, size 72-24 line 3136 [ 395.014018] binder: BINDER_SET_CONTEXT_MGR already set [ 395.014026] binder: 11223:11224 ioctl 40046207 0 returned -16 [ 395.014118] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.014137] binder: 11223:11224 transaction failed 29189/-3, size 72-24 line 3136 [ 395.017972] binder: 11209:11218 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 395.017981] binder: 11209:11218 BC_INCREFS_DONE u0000000000000003 no match [ 395.017986] binder: 11209:11218 ERROR: BC_REGISTER_LOOPER called without request [ 395.017994] binder: 11209:11218 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.018004] binder: 11209:11218 Release 1 refcount change on invalid ref 0 ret -22 [ 395.068889] binder: BINDER_SET_CONTEXT_MGR already set [ 395.068897] binder: 11231:11232 ioctl 40046207 0 returned -16 [ 395.071641] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 395.071658] binder: 11231:11232 transaction failed 29189/-3, size 72-24 line 3136 [ 395.089065] binder: 11238:11244 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.089075] binder: 11238:11244 BC_INCREFS_DONE u0000000000000003 no match 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 395.089081] binder: 11238:11244 ERROR: BC_REGISTER_LOOPER called without request 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.089089] binder: 11238:11244 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 2 printk messages dropped ** [ 395.207234] binder: 11256:11259 BC_INCREFS_DONE u0000000000000003 no match [ 395.207240] binder: 11256:11259 ERROR: BC_REGISTER_LOOPER called without request [ 395.207249] binder: 11256:11259 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.207258] binder: 11256:11259 Release 1 refcount change on invalid ref 0 ret -22 [ 395.221062] binder: BINDER_SET_CONTEXT_MGR already set [ 395.221070] binder: 11254:11258 ioctl 40046207 0 returned -16 [ 395.221163] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.221182] binder: 11254:11258 transaction failed 29189/-3, size 72-24 line 3136 [ 395.265472] binder: BINDER_SET_CONTEXT_MGR already set [ 395.265480] binder: 11270:11273 ioctl 40046207 0 returned -16 03:53:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.265568] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.265586] binder: 11270:11273 transaction failed 29189/-3, size 72-24 line 3136 [ 395.268576] binder: 11263:11271 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.268586] binder: 11263:11271 BC_INCREFS_DONE u0000000000000003 no match [ 395.268592] binder: 11263:11271 ERROR: BC_REGISTER_LOOPER called without request [ 395.268601] binder: 11263:11271 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.268612] binder: 11263:11271 Release 1 refcount change on invalid ref 0 ret -22 [ 395.474360] binder: BINDER_SET_CONTEXT_MGR already set 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 395.474368] binder: 11296:11305 ioctl 40046207 0 returned -16 [ 395.474512] binder_alloc: 7943: binder_alloc_buf, no vma ** 2 printk messages dropped ** [ 395.494288] binder: 11297:11302 BC_INCREFS_DONE u0000000000000003 no match [ 395.494294] binder: 11297:11302 ERROR: BC_REGISTER_LOOPER called without request [ 395.494303] binder: 11297:11302 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.494314] binder: 11297:11302 Release 1 refcount change on invalid ref 0 ret -22 [ 395.521050] binder: BINDER_SET_CONTEXT_MGR already set [ 395.521058] binder: 11312:11315 ioctl 40046207 0 returned -16 [ 395.521158] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.521175] binder: 11312:11315 transaction failed 29189/-3, size 72-24 line 3136 03:53:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 395.552519] binder: 11322:11325 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.552529] binder: 11322:11325 BC_INCREFS_DONE u0000000000000003 no match [ 395.552535] binder: 11322:11325 ERROR: BC_REGISTER_LOOPER called without request [ 395.552543] binder: 11322:11325 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.552553] binder: 11322:11325 Release 1 refcount change on invalid ref 0 ret -22 [ 395.586461] binder: BINDER_SET_CONTEXT_MGR already set 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 395.586469] binder: 11326:11330 ioctl 40046207 0 returned -16 [ 395.586572] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.586590] binder: 11326:11330 transaction failed 29189/-3, size 72-24 line 3136 [ 395.716699] binder: 11338:11345 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.716708] binder: 11338:11345 BC_INCREFS_DONE u0000000000000003 no match ** 4 printk messages dropped ** [ 395.728530] binder: 11342:11349 ioctl 40046207 0 returned -16 [ 395.728824] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.728843] binder: 11342:11349 transaction failed 29189/-3, size 72-24 line 3136 [ 395.744299] binder: 11352:11354 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.744309] binder: 11352:11354 BC_INCREFS_DONE u0000000000000003 no match [ 395.744315] binder: 11352:11354 ERROR: BC_REGISTER_LOOPER called without request [ 395.744323] binder: 11352:11354 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.744333] binder: 11352:11354 Release 1 refcount change on invalid ref 0 ret -22 03:53:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.766360] binder: 11357:11358 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.766369] binder: 11357:11358 BC_INCREFS_DONE u0000000000000003 no match [ 395.766374] binder: 11357:11358 ERROR: BC_REGISTER_LOOPER called without request [ 395.766383] binder: 11357:11358 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.766392] binder: 11357:11358 Release 1 refcount change on invalid ref 0 ret -22 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.012660] binder: 11380:11381 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.012670] binder: 11380:11381 BC_INCREFS_DONE u0000000000000003 no match 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 396.012676] binder: 11380:11381 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 396.022845] binder: 11383:11389 transaction failed 29189/-3, size 72-24 line 3136 [ 396.050042] binder: 11393:11395 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.050052] binder: 11393:11395 BC_INCREFS_DONE u0000000000000003 no match [ 396.050058] binder: 11393:11395 ERROR: BC_REGISTER_LOOPER called without request [ 396.050066] binder: 11393:11395 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.050077] binder: 11393:11395 Release 1 refcount change on invalid ref 0 ret -22 [ 396.056695] binder: BINDER_SET_CONTEXT_MGR already set [ 396.056703] binder: 11394:11398 ioctl 40046207 0 returned -16 [ 396.056809] binder_alloc: 7943: binder_alloc_buf, no vma [ 396.056830] binder: 11394:11398 transaction failed 29189/-3, size 72-24 line 3136 03:53:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 396.114286] binder: 11402:11409 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.114295] binder: 11402:11409 BC_INCREFS_DONE u0000000000000003 no match [ 396.114301] binder: 11402:11409 ERROR: BC_REGISTER_LOOPER called without request [ 396.114310] binder: 11402:11409 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.114319] binder: 11402:11409 Release 1 refcount change on invalid ref 0 ret -22 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 396.131292] binder: BINDER_SET_CONTEXT_MGR already set [ 396.131301] binder: 11407:11412 ioctl 40046207 0 returned -16 [ 396.131402] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 396.131419] binder: 11407:11412 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 396.260919] binder: 11425:11426 Release 1 refcount change on invalid ref 0 ret -22 [ 396.311778] binder: BINDER_SET_CONTEXT_MGR already set [ 396.311788] binder: 11423:11432 ioctl 40046207 0 returned -16 [ 396.312040] binder_alloc: 7943: binder_alloc_buf, no vma [ 396.312059] binder: 11423:11432 transaction failed 29189/-3, size 72-24 line 3136 03:53:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.318721] binder: 11440:11444 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.318730] binder: 11440:11444 BC_INCREFS_DONE u0000000000000003 no match [ 396.318736] binder: 11440:11444 ERROR: BC_REGISTER_LOOPER called without request [ 396.318744] binder: 11440:11444 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.318754] binder: 11440:11444 Release 1 refcount change on invalid ref 0 ret -22 [ 396.363600] binder: 11448:11451 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.363609] binder: 11448:11451 BC_INCREFS_DONE u0000000000000003 no match [ 396.363615] binder: 11448:11451 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 396.511529] binder: 11465:11469 transaction failed 29189/-3, size 72-24 line 3136 [ 396.546538] binder: 11474:11477 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.546549] binder: 11474:11477 BC_INCREFS_DONE u0000000000000003 no match [ 396.546555] binder: 11474:11477 ERROR: BC_REGISTER_LOOPER called without request [ 396.546563] binder: 11474:11477 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.546575] binder: 11474:11477 Release 1 refcount change on invalid ref 0 ret -22 [ 396.592919] binder: BINDER_SET_CONTEXT_MGR already set [ 396.592928] binder: 11480:11485 ioctl 40046207 0 returned -16 [ 396.593917] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.593935] binder: 11480:11485 transaction failed 29189/-3, size 72-24 line 3136 [ 396.625632] binder: 11487:11490 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.625642] binder: 11487:11490 BC_INCREFS_DONE u0000000000000003 no match [ 396.625648] binder: 11487:11490 ERROR: BC_REGISTER_LOOPER called without request 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.625656] binder: 11487:11490 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.625666] binder: 11487:11490 Release 1 refcount change on invalid ref 0 ret -22 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) ** 3 printk messages dropped ** [ 396.784001] binder: 11509:11515 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 4 printk messages dropped ** [ 396.803388] binder: 11508:11514 transaction failed 29189/-3, size 72-24 line 3136 [ 396.871048] binder: 11521:11532 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 396.871059] binder: 11521:11532 BC_INCREFS_DONE u0000000000000003 no match [ 396.871064] binder: 11521:11532 ERROR: BC_REGISTER_LOOPER called without request [ 396.871073] binder: 11521:11532 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.871084] binder: 11521:11532 Release 1 refcount change on invalid ref 0 ret -22 [ 396.871409] binder: BINDER_SET_CONTEXT_MGR already set 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 396.871417] binder: 11525:11530 ioctl 40046207 0 returned -16 [ 396.871532] binder_alloc: 7943: binder_alloc_buf, no vma [ 396.871550] binder: 11525:11530 transaction failed 29189/-3, size 72-24 line 3136 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) ** 3 printk messages dropped ** [ 396.913055] binder: 11538:11543 transaction failed 29189/-3, size 72-24 line 3136 ** 8 printk messages dropped ** [ 397.071230] binder: 11553:11563 Release 1 refcount change on invalid ref 0 ret -22 [ 397.120140] binder: 11574:11579 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.120150] binder: 11574:11579 BC_INCREFS_DONE u0000000000000003 no match [ 397.120156] binder: 11574:11579 ERROR: BC_REGISTER_LOOPER called without request [ 397.120164] binder: 11574:11579 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 397.120176] binder: 11574:11579 Release 1 refcount change on invalid ref 0 ret -22 [ 397.145247] binder: BINDER_SET_CONTEXT_MGR already set [ 397.145256] binder: 11569:11573 ioctl 40046207 0 returned -16 [ 397.145365] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 397.145382] binder: 11569:11573 transaction failed 29189/-3, size 72-24 line 3136 [ 397.308770] binder: 11597:11606 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.308780] binder: 11597:11606 BC_INCREFS_DONE u0000000000000003 no match [ 397.308785] binder: 11597:11606 ERROR: BC_REGISTER_LOOPER called without request [ 397.308793] binder: 11597:11606 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 397.308803] binder: 11597:11606 Release 1 refcount change on invalid ref 0 ret -22 [ 397.315004] binder: BINDER_SET_CONTEXT_MGR already set [ 397.315013] binder: 11602:11605 ioctl 40046207 0 returned -16 [ 397.315114] binder_alloc: 7943: binder_alloc_buf, no vma [ 397.315132] binder: 11602:11605 transaction failed 29189/-3, size 72-24 line 3136 ** 3 printk messages dropped ** [ 397.376904] binder: 11618:11624 transaction failed 29189/-3, size 72-24 line 3136 [ 397.407269] binder: 11625:11628 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.407279] binder: 11625:11628 BC_INCREFS_DONE u0000000000000003 no match [ 397.407284] binder: 11625:11628 ERROR: BC_REGISTER_LOOPER called without request [ 397.407292] binder: 11625:11628 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 397.407304] binder: 11625:11628 Release 1 refcount change on invalid ref 0 ret -22 [ 397.558905] binder: BINDER_SET_CONTEXT_MGR already set [ 397.558914] binder: 11644:11649 ioctl 40046207 0 returned -16 [ 397.559020] binder_alloc: 7943: binder_alloc_buf, no vma [ 397.559039] binder: 11644:11649 transaction failed 29189/-3, size 72-24 line 3136 [ 397.560669] binder: 11645:11651 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.560686] binder: 11645:11651 BC_INCREFS_DONE u0000000000000003 no match 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 397.560692] binder: 11645:11651 ERROR: BC_REGISTER_LOOPER called without request [ 397.560700] binder: 11645:11651 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 397.560710] binder: 11645:11651 Release 1 refcount change on invalid ref 0 ret -22 [ 397.588247] binder: BINDER_SET_CONTEXT_MGR already set 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 397.588255] binder: 11657:11660 ioctl 40046207 0 returned -16 [ 397.588348] binder_alloc: 7943: binder_alloc_buf, no vma [ 397.588367] binder: 11657:11660 transaction failed 29189/-3, size 72-24 line 3136 [ 397.643741] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 397.646002] binder: 11668:11675 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 397.687037] binder: 11665:11672 Release 1 refcount change on invalid ref 0 ret -22 [ 397.791152] binder: BINDER_SET_CONTEXT_MGR already set [ 397.791161] binder: 11690:11691 ioctl 40046207 0 returned -16 [ 397.791263] binder_alloc: 7943: binder_alloc_buf, no vma [ 397.791284] binder: 11690:11691 transaction failed 29189/-3, size 72-24 line 3136 [ 397.798498] binder: 11694:11697 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.798506] binder: 11694:11697 BC_INCREFS_DONE u0000000000000003 no match [ 397.798510] binder: 11694:11697 ERROR: BC_REGISTER_LOOPER called without request [ 397.798517] binder: 11694:11697 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 397.798525] binder: 11694:11697 Release 1 refcount change on invalid ref 0 ret -22 [ 397.864092] binder: 11706:11712 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.864101] binder: 11706:11712 BC_INCREFS_DONE u0000000000000003 no match 03:53:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 397.864107] binder: 11706:11712 ERROR: BC_REGISTER_LOOPER called without request [ 397.864115] binder: 11706:11712 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 397.864124] binder: 11706:11712 Release 1 refcount change on invalid ref 0 ret -22 [ 397.864524] binder: BINDER_SET_CONTEXT_MGR already set [ 397.864533] binder: 11702:11711 ioctl 40046207 0 returned -16 [ 397.867344] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 397.867364] binder: 11702:11711 transaction failed 29189/-3, size 72-24 line 3136 [ 398.037252] binder: 11735:11737 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 398.037261] binder: 11735:11737 BC_INCREFS_DONE u0000000000000003 no match [ 398.037267] binder: 11735:11737 ERROR: BC_REGISTER_LOOPER called without request [ 398.037276] binder: 11735:11737 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.037285] binder: 11735:11737 Release 1 refcount change on invalid ref 0 ret -22 [ 398.054637] binder: BINDER_SET_CONTEXT_MGR already set [ 398.054648] binder: 11736:11740 ioctl 40046207 0 returned -16 [ 398.054843] binder_alloc: 7943: binder_alloc_buf, no vma [ 398.054864] binder: 11736:11740 transaction failed 29189/-3, size 72-24 line 3136 [ 398.102651] binder: 11749:11758 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 398.102660] binder: 11749:11758 BC_INCREFS_DONE u0000000000000003 no match [ 398.102665] binder: 11749:11758 ERROR: BC_REGISTER_LOOPER called without request [ 398.102673] binder: 11749:11758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.102693] binder: 11749:11758 Release 1 refcount change on invalid ref 0 ret -22 [ 398.128093] binder: BINDER_SET_CONTEXT_MGR already set 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 398.128102] binder: 11753:11760 ioctl 40046207 0 returned -16 [ 398.128207] binder_alloc: 7943: binder_alloc_buf, no vma ** 2 printk messages dropped ** [ 398.294701] binder: 11781:11782 BC_INCREFS_DONE u0000000000000003 no match ** 8 printk messages dropped ** [ 398.321737] binder: 11790:11792 BC_INCREFS_DONE u0000000000000003 no match [ 398.321743] binder: 11790:11792 ERROR: BC_REGISTER_LOOPER called without request [ 398.321752] binder: 11790:11792 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.321762] binder: 11790:11792 Release 1 refcount change on invalid ref 0 ret -22 [ 398.364296] binder: BINDER_SET_CONTEXT_MGR already set [ 398.364305] binder: 11795:11801 ioctl 40046207 0 returned -16 03:53:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 398.364405] binder_alloc: 7943: binder_alloc_buf, no vma [ 398.364424] binder: 11795:11801 transaction failed 29189/-3, size 72-24 line 3136 [ 398.379735] binder: 11799:11806 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 398.379745] binder: 11799:11806 BC_INCREFS_DONE u0000000000000003 no match [ 398.379751] binder: 11799:11806 ERROR: BC_REGISTER_LOOPER called without request [ 398.379759] binder: 11799:11806 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.379770] binder: 11799:11806 Release 1 refcount change on invalid ref 0 ret -22 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 398.539553] binder: BINDER_SET_CONTEXT_MGR already set [ 398.539561] binder: 11814:11823 ioctl 40046207 0 returned -16 [ 398.539654] binder_alloc: 7943: binder_alloc_buf, no vma [ 398.539673] binder: 11814:11823 transaction failed 29189/-3, size 72-24 line 3136 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 398.557192] binder: 11817:11824 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 398.557232] binder: 11817:11824 Release 1 refcount change on invalid ref 0 ret -22 ** 9 printk messages dropped ** [ 398.649628] binder: 11839:11844 BC_INCREFS_DONE u0000000000000003 no match [ 398.649634] binder: 11839:11844 ERROR: BC_REGISTER_LOOPER called without request [ 398.649643] binder: 11839:11844 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.649653] binder: 11839:11844 Release 1 refcount change on invalid ref 0 ret -22 [ 398.764093] binder: 11853:11863 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 398.764103] binder: 11853:11863 BC_INCREFS_DONE u0000000000000003 no match 03:53:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 398.764109] binder: 11853:11863 ERROR: BC_REGISTER_LOOPER called without request [ 398.764117] binder: 11853:11863 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.764127] binder: 11853:11863 Release 1 refcount change on invalid ref 0 ret -22 [ 398.781636] binder: BINDER_SET_CONTEXT_MGR already set [ 398.781643] binder: 11858:11862 ioctl 40046207 0 returned -16 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 398.781753] binder_alloc: 7943: binder_alloc_buf, no vma [ 398.781769] binder: 11858:11862 transaction failed 29189/-3, size 72-24 line 3136 ** 3 printk messages dropped ** [ 398.835546] binder: 11878:11880 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 398.836946] binder: 11870:11872 Release 1 refcount change on invalid ref 0 ret -22 [ 399.003631] binder: BINDER_SET_CONTEXT_MGR already set [ 399.003639] binder: 11902:11906 ioctl 40046207 0 returned -16 [ 399.003748] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.003768] binder: 11902:11906 transaction failed 29189/-3, size 72-24 line 3136 [ 399.004965] binder: 11901:11905 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.004976] binder: 11901:11905 BC_INCREFS_DONE u0000000000000003 no match [ 399.004982] binder: 11901:11905 ERROR: BC_REGISTER_LOOPER called without request [ 399.004991] binder: 11901:11905 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.005000] binder: 11901:11905 Release 1 refcount change on invalid ref 0 ret -22 [ 399.054063] binder: BINDER_SET_CONTEXT_MGR already set [ 399.054073] binder: 11911:11915 ioctl 40046207 0 returned -16 [ 399.054192] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.054212] binder: 11911:11915 transaction failed 29189/-3, size 72-24 line 3136 03:53:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 399.080679] binder: BINDER_SET_CONTEXT_MGR already set [ 399.080687] binder: 11921:11925 ioctl 40046207 0 returned -16 [ 399.080805] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.080824] binder: 11921:11925 transaction failed 29189/-3, size 72-24 line 3136 [ 399.084970] binder: 11917:11929 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 399.084980] binder: 11917:11929 BC_INCREFS_DONE u0000000000000003 no match [ 399.084986] binder: 11917:11929 ERROR: BC_REGISTER_LOOPER called without request 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 399.085003] binder: 11917:11929 Release 1 refcount change on invalid ref 0 ret -22 [ 399.247521] binder: BINDER_SET_CONTEXT_MGR already set [ 399.247530] binder: 11940:11947 ioctl 40046207 0 returned -16 [ 399.247620] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.247640] binder: 11940:11947 transaction failed 29189/-3, size 72-24 line 3136 [ 399.247862] binder: 11941:11948 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.247871] binder: 11941:11948 BC_INCREFS_DONE u0000000000000003 no match [ 399.247876] binder: 11941:11948 ERROR: BC_REGISTER_LOOPER called without request [ 399.247884] binder: 11941:11948 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.247893] binder: 11941:11948 Release 1 refcount change on invalid ref 0 ret -22 [ 399.274689] binder: BINDER_SET_CONTEXT_MGR already set 03:53:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.274697] binder: 11953:11956 ioctl 40046207 0 returned -16 [ 399.274802] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.274820] binder: 11953:11956 transaction failed 29189/-3, size 72-24 line 3136 [ 399.333952] binder: BINDER_SET_CONTEXT_MGR already set 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.333961] binder: 11966:11972 ioctl 40046207 0 returned -16 [ 399.334067] binder_alloc: 7943: binder_alloc_buf, no vma ** 2 printk messages dropped ** [ 399.347259] binder: 11964:11969 BC_INCREFS_DONE u0000000000000003 no match [ 399.347265] binder: 11964:11969 ERROR: BC_REGISTER_LOOPER called without request [ 399.347272] binder: 11964:11969 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.347284] binder: 11964:11969 Release 1 refcount change on invalid ref 0 ret -22 [ 399.495900] binder: 11987:11991 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.495911] binder: 11987:11991 BC_INCREFS_DONE u0000000000000003 no match [ 399.495917] binder: 11987:11991 ERROR: BC_REGISTER_LOOPER called without request 03:53:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 399.495925] binder: 11987:11991 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.495936] binder: 11987:11991 Release 1 refcount change on invalid ref 0 ret -22 [ 399.525945] binder: BINDER_SET_CONTEXT_MGR already set [ 399.525954] binder: 11985:11994 ioctl 40046207 0 returned -16 [ 399.526046] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.526067] binder: 11985:11994 transaction failed 29189/-3, size 72-24 line 3136 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.534681] binder: 11998:12002 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 399.534714] binder: 11998:12002 Release 1 refcount change on invalid ref 0 ret -22 [ 399.572987] binder: 12006:12013 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.572997] binder: 12006:12013 BC_INCREFS_DONE u0000000000000003 no match [ 399.573003] binder: 12006:12013 ERROR: BC_REGISTER_LOOPER called without request [ 399.573011] binder: 12006:12013 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.573023] binder: 12006:12013 Release 1 refcount change on invalid ref 0 ret -22 [ 399.582345] binder: BINDER_SET_CONTEXT_MGR already set [ 399.582354] binder: 12011:12014 ioctl 40046207 0 returned -16 03:53:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.582456] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.582476] binder: 12011:12014 transaction failed 29189/-3, size 72-24 line 3136 [ 399.598689] binder: 12017:12018 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.598699] binder: 12017:12018 BC_INCREFS_DONE u0000000000000003 no match [ 399.598705] binder: 12017:12018 ERROR: BC_REGISTER_LOOPER called without request 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 399.598713] binder: 12017:12018 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.598724] binder: 12017:12018 Release 1 refcount change on invalid ref 0 ret -22 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.635897] binder: BINDER_SET_CONTEXT_MGR already set [ 399.635906] binder: 12022:12027 ioctl 40046207 0 returned -16 [ 399.636061] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.636080] binder: 12022:12027 transaction failed 29189/-3, size 72-24 line 3136 [ 399.752588] binder: 12034:12037 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.752597] binder: 12034:12037 BC_INCREFS_DONE u0000000000000003 no match [ 399.752603] binder: 12034:12037 ERROR: BC_REGISTER_LOOPER called without request [ 399.752612] binder: 12034:12037 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.752620] binder: 12034:12037 Release 1 refcount change on invalid ref 0 ret -22 [ 399.759891] binder: BINDER_SET_CONTEXT_MGR already set [ 399.759901] binder: 12032:12042 ioctl 40046207 0 returned -16 [ 399.759992] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.760012] binder: 12032:12042 transaction failed 29189/-3, size 72-24 line 3136 [ 399.810925] binder: 12049:12056 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.810935] binder: 12049:12056 BC_INCREFS_DONE u0000000000000003 no match 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 399.810941] binder: 12049:12056 ERROR: BC_REGISTER_LOOPER called without request [ 399.810949] binder: 12049:12056 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.810960] binder: 12049:12056 Release 1 refcount change on invalid ref 0 ret -22 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 399.821331] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 399.821739] binder: 12055:12059 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 399.870005] binder: 12062:12066 Release 1 refcount change on invalid ref 0 ret -22 [ 399.998571] binder: BINDER_SET_CONTEXT_MGR already set [ 399.998580] binder: 12077:12087 ioctl 40046207 0 returned -16 [ 399.998671] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.998700] binder: 12077:12087 transaction failed 29189/-3, size 72-24 line 3136 [ 399.999957] binder: 12078:12084 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.999966] binder: 12078:12084 BC_INCREFS_DONE u0000000000000003 no match [ 399.999973] binder: 12078:12084 ERROR: BC_REGISTER_LOOPER called without request [ 399.999981] binder: 12078:12084 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.999993] binder: 12078:12084 Release 1 refcount change on invalid ref 0 ret -22 03:53:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.046747] binder: 12092:12098 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.046756] binder: 12092:12098 BC_INCREFS_DONE u0000000000000003 no match [ 400.046761] binder: 12092:12098 ERROR: BC_REGISTER_LOOPER called without request [ 400.046769] binder: 12092:12098 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 400.046779] binder: 12092:12098 Release 1 refcount change on invalid ref 0 ret -22 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 400.076255] binder: BINDER_SET_CONTEXT_MGR already set 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 400.076264] binder: 12094:12101 ioctl 40046207 0 returned -16 ** 1 printk messages dropped ** [ 400.078326] binder: 12094:12101 transaction failed 29189/-3, size 72-24 line 3136 [ 400.101978] binder: 12107:12110 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.101988] binder: 12107:12110 BC_INCREFS_DONE u0000000000000003 no match [ 400.101994] binder: 12107:12110 ERROR: BC_REGISTER_LOOPER called without request [ 400.102003] binder: 12107:12110 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 400.102012] binder: 12107:12110 Release 1 refcount change on invalid ref 0 ret -22 [ 400.237888] binder: 12122:12126 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.237898] binder: 12122:12126 BC_INCREFS_DONE u0000000000000003 no match [ 400.237904] binder: 12122:12126 ERROR: BC_REGISTER_LOOPER called without request [ 400.237912] binder: 12122:12126 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 400.237922] binder: 12122:12126 Release 1 refcount change on invalid ref 0 ret -22 [ 400.259670] binder: BINDER_SET_CONTEXT_MGR already set [ 400.259687] binder: 12120:12130 ioctl 40046207 0 returned -16 [ 400.259786] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.259810] binder: 12120:12130 transaction failed 29189/-3, size 72-24 line 3136 ** 6 printk messages dropped ** [ 400.281917] binder: 12140:12141 BC_INCREFS_DONE u0000000000000003 no match ** 4 printk messages dropped ** [ 400.313442] binder: 12146:12150 ioctl 40046207 0 returned -16 [ 400.313550] binder_alloc: 7943: binder_alloc_buf, no vma [ 400.313568] binder: 12146:12150 transaction failed 29189/-3, size 72-24 line 3136 [ 400.474848] binder: BINDER_SET_CONTEXT_MGR already set [ 400.474857] binder: 12162:12168 ioctl 40046207 0 returned -16 03:53:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.474949] binder_alloc: 7943: binder_alloc_buf, no vma [ 400.474968] binder: 12162:12168 transaction failed 29189/-3, size 72-24 line 3136 [ 400.480392] binder: 12159:12169 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.480400] binder: 12159:12169 BC_INCREFS_DONE u0000000000000003 no match [ 400.480405] binder: 12159:12169 ERROR: BC_REGISTER_LOOPER called without request [ 400.480411] binder: 12159:12169 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 400.480421] binder: 12159:12169 Release 1 refcount change on invalid ref 0 ret -22 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.549514] binder: BINDER_SET_CONTEXT_MGR already set [ 400.549524] binder: 12183:12186 ioctl 40046207 0 returned -16 [ 400.549630] binder_alloc: 7943: binder_alloc_buf, no vma [ 400.549649] binder: 12183:12186 transaction failed 29189/-3, size 72-24 line 3136 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.712846] binder: 12203:12209 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.712856] binder: 12203:12209 BC_INCREFS_DONE u0000000000000003 no match [ 400.712861] binder: 12203:12209 ERROR: BC_REGISTER_LOOPER called without request [ 400.712870] binder: 12203:12209 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 7 printk messages dropped ** [ 400.782652] binder: 12230:12231 BC_INCREFS_DONE u0000000000000003 no match [ 400.782658] binder: 12230:12231 ERROR: BC_REGISTER_LOOPER called without request [ 400.782666] binder: 12230:12231 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 400.782675] binder: 12230:12231 Release 1 refcount change on invalid ref 0 ret -22 [ 400.948667] binder: 12250:12253 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.948677] binder: 12250:12253 BC_INCREFS_DONE u0000000000000003 no match [ 400.948682] binder: 12250:12253 ERROR: BC_REGISTER_LOOPER called without request [ 400.948691] binder: 12250:12253 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 400.948701] binder: 12250:12253 Release 1 refcount change on invalid ref 0 ret -22 [ 400.958441] binder: BINDER_SET_CONTEXT_MGR already set [ 400.958450] binder: 12252:12256 ioctl 40046207 0 returned -16 03:53:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 400.958551] binder_alloc: 7943: binder_alloc_buf, no vma [ 400.958569] binder: 12252:12256 transaction failed 29189/-3, size 72-24 line 3136 [ 401.020081] binder: 12264:12271 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 401.020091] binder: 12264:12271 BC_INCREFS_DONE u0000000000000003 no match [ 401.020097] binder: 12264:12271 ERROR: BC_REGISTER_LOOPER called without request [ 401.020105] binder: 12264:12271 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.020115] binder: 12264:12271 Release 1 refcount change on invalid ref 0 ret -22 [ 401.023349] binder: BINDER_SET_CONTEXT_MGR already set [ 401.023359] binder: 12265:12272 ioctl 40046207 0 returned -16 [ 401.023450] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.023468] binder: 12265:12272 transaction failed 29189/-3, size 72-24 line 3136 [ 401.234959] binder: 12292:12302 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.234971] binder: 12292:12302 BC_INCREFS_DONE u0000000000000003 no match [ 401.234977] binder: 12292:12302 ERROR: BC_REGISTER_LOOPER called without request [ 401.234986] binder: 12292:12302 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.234998] binder: 12292:12302 Release 1 refcount change on invalid ref 0 ret -22 [ 401.265601] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.265620] binder: 12293:12299 transaction failed 29189/-3, size 72-24 line 3136 [ 401.269475] binder: 12309:12311 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 401.269484] binder: 12309:12311 BC_INCREFS_DONE u0000000000000003 no match [ 401.269489] binder: 12309:12311 ERROR: BC_REGISTER_LOOPER called without request [ 401.269498] binder: 12309:12311 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 401.269509] binder: 12309:12311 Release 1 refcount change on invalid ref 0 ret -22 [ 401.311289] binder: BINDER_SET_CONTEXT_MGR already set [ 401.311298] binder: 12318:12322 ioctl 40046207 0 returned -16 [ 401.311437] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.311456] binder: 12318:12322 transaction failed 29189/-3, size 72-24 line 3136 [ 401.321954] binder: 12323:12324 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.321964] binder: 12323:12324 BC_INCREFS_DONE u0000000000000003 no match [ 401.321969] binder: 12323:12324 ERROR: BC_REGISTER_LOOPER called without request [ 401.321977] binder: 12323:12324 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.321988] binder: 12323:12324 Release 1 refcount change on invalid ref 0 ret -22 [ 401.458188] binder: BINDER_SET_CONTEXT_MGR already set [ 401.458197] binder: 12334:12340 ioctl 40046207 0 returned -16 [ 401.458289] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 401.458307] binder: 12334:12340 transaction failed 29189/-3, size 72-24 line 3136 [ 401.480003] binder: 12339:12343 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.480012] binder: 12339:12343 BC_INCREFS_DONE u0000000000000003 no match 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 401.480018] binder: 12339:12343 ERROR: BC_REGISTER_LOOPER called without request 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 401.480027] binder: 12339:12343 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 7 printk messages dropped ** [ 401.530488] binder: 12358:12363 ERROR: BC_REGISTER_LOOPER called without request [ 401.530496] binder: 12358:12363 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.530506] binder: 12358:12363 Release 1 refcount change on invalid ref 0 ret -22 [ 401.707477] binder: BINDER_SET_CONTEXT_MGR already set [ 401.707486] binder: 12378:12386 ioctl 40046207 0 returned -16 [ 401.707581] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.707600] binder: 12378:12386 transaction failed 29189/-3, size 72-24 line 3136 03:53:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 401.755457] binder: 12380:12382 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.755466] binder: 12380:12382 BC_INCREFS_DONE u0000000000000003 no match [ 401.755472] binder: 12380:12382 ERROR: BC_REGISTER_LOOPER called without request [ 401.755480] binder: 12380:12382 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.755491] binder: 12380:12382 Release 1 refcount change on invalid ref 0 ret -22 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 401.765378] binder: BINDER_SET_CONTEXT_MGR already set [ 401.765389] binder: 12393:12400 ioctl 40046207 0 returned -16 [ 401.765620] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.765640] binder: 12393:12400 transaction failed 29189/-3, size 72-24 line 3136 ** 2 printk messages dropped ** [ 401.800068] binder: 12405:12407 ERROR: BC_REGISTER_LOOPER called without request [ 401.800076] binder: 12405:12407 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.800087] binder: 12405:12407 Release 1 refcount change on invalid ref 0 ret -22 03:53:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 402.010519] binder: 12425:12428 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.010529] binder: 12425:12428 BC_INCREFS_DONE u0000000000000003 no match [ 402.010534] binder: 12425:12428 ERROR: BC_REGISTER_LOOPER called without request [ 402.010542] binder: 12425:12428 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.010551] binder: 12425:12428 Release 1 refcount change on invalid ref 0 ret -22 [ 402.015722] binder: BINDER_SET_CONTEXT_MGR already set [ 402.015731] binder: 12423:12432 ioctl 40046207 0 returned -16 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 402.015823] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.015842] binder: 12423:12432 transaction failed 29189/-3, size 72-24 line 3136 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 402.079061] binder: 12447:12451 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 1 printk messages dropped ** [ 402.079075] binder: 12447:12451 ERROR: BC_REGISTER_LOOPER called without request ** 2 printk messages dropped ** [ 402.246425] binder: BINDER_SET_CONTEXT_MGR already set [ 402.246434] binder: 12467:12473 ioctl 40046207 0 returned -16 [ 402.246534] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.246554] binder: 12467:12473 transaction failed 29189/-3, size 72-24 line 3136 [ 402.251516] binder: 12469:12474 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 402.251526] binder: 12469:12474 BC_INCREFS_DONE u0000000000000003 no match [ 402.251532] binder: 12469:12474 ERROR: BC_REGISTER_LOOPER called without request [ 402.251540] binder: 12469:12474 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.251549] binder: 12469:12474 Release 1 refcount change on invalid ref 0 ret -22 [ 402.279001] binder: BINDER_SET_CONTEXT_MGR already set [ 402.279010] binder: 12478:12481 ioctl 40046207 0 returned -16 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 402.279111] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 402.279130] binder: 12478:12481 transaction failed 29189/-3, size 72-24 line 3136 [ 402.302097] binder: 12480:12483 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 402.302129] binder: 12480:12483 Release 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 402.339361] binder: 12488:12494 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.339372] binder: 12488:12494 BC_INCREFS_DONE u0000000000000003 no match [ 402.339378] binder: 12488:12494 ERROR: BC_REGISTER_LOOPER called without request 03:53:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 402.339386] binder: 12488:12494 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.339397] binder: 12488:12494 Release 1 refcount change on invalid ref 0 ret -22 [ 402.500977] binder: 12508:12513 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.500988] binder: 12508:12513 BC_INCREFS_DONE u0000000000000003 no match [ 402.500994] binder: 12508:12513 ERROR: BC_REGISTER_LOOPER called without request [ 402.501002] binder: 12508:12513 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 402.501011] binder: 12508:12513 Release 1 refcount change on invalid ref 0 ret -22 [ 402.518043] binder: BINDER_SET_CONTEXT_MGR already set [ 402.518051] binder: 12507:12515 ioctl 40046207 0 returned -16 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) ** 2 printk messages dropped ** [ 402.568423] binder: 12521:12522 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 8 printk messages dropped ** [ 402.740936] binder: 12546:12550 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.740946] binder: 12546:12550 BC_INCREFS_DONE u0000000000000003 no match [ 402.740952] binder: 12546:12550 ERROR: BC_REGISTER_LOOPER called without request [ 402.740960] binder: 12546:12550 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.740969] binder: 12546:12550 Release 1 refcount change on invalid ref 0 ret -22 [ 402.747779] binder: BINDER_SET_CONTEXT_MGR already set [ 402.747789] binder: 12547:12551 ioctl 40046207 0 returned -16 [ 402.747883] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.747902] binder: 12547:12551 transaction failed 29189/-3, size 72-24 line 3136 [ 402.787805] binder: BINDER_SET_CONTEXT_MGR already set [ 402.787814] binder: 12558:12562 ioctl 40046207 0 returned -16 [ 402.787919] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.787937] binder: 12558:12562 transaction failed 29189/-3, size 72-24 line 3136 [ 402.815550] binder: 12556:12563 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.815559] binder: 12556:12563 BC_INCREFS_DONE u0000000000000003 no match 03:53:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 402.815564] binder: 12556:12563 ERROR: BC_REGISTER_LOOPER called without request [ 402.815572] binder: 12556:12563 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.815582] binder: 12556:12563 Release 1 refcount change on invalid ref 0 ret -22 [ 402.819759] binder: BINDER_SET_CONTEXT_MGR already set 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 402.819767] binder: 12567:12568 ioctl 40046207 0 returned -16 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 402.819858] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.819875] binder: 12567:12568 transaction failed 29189/-3, size 72-24 line 3136 [ 402.864210] binder: 12575:12577 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.864219] binder: 12575:12577 BC_INCREFS_DONE u0000000000000003 no match [ 402.864225] binder: 12575:12577 ERROR: BC_REGISTER_LOOPER called without request [ 402.864233] binder: 12575:12577 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.864242] binder: 12575:12577 Release 1 refcount change on invalid ref 0 ret -22 [ 402.998019] binder: BINDER_SET_CONTEXT_MGR already set [ 402.998028] binder: 12591:12594 ioctl 40046207 0 returned -16 [ 402.998117] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.998137] binder: 12591:12594 transaction failed 29189/-3, size 72-24 line 3136 03:53:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 403.007240] binder: 12589:12597 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.007249] binder: 12589:12597 BC_INCREFS_DONE u0000000000000003 no match [ 403.007255] binder: 12589:12597 ERROR: BC_REGISTER_LOOPER called without request [ 403.007263] binder: 12589:12597 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.007273] binder: 12589:12597 Release 1 refcount change on invalid ref 0 ret -22 [ 403.034078] binder: 12601:12602 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 403.034087] binder: 12601:12602 BC_INCREFS_DONE u0000000000000003 no match [ 403.034093] binder: 12601:12602 ERROR: BC_REGISTER_LOOPER called without request [ 403.034102] binder: 12601:12602 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 403.034111] binder: 12601:12602 Release 1 refcount change on invalid ref 0 ret -22 [ 403.067863] binder: 12603:12606 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 403.067895] binder: 12603:12606 Release 1 refcount change on invalid ref 0 ret -22 [ 403.075461] binder: BINDER_SET_CONTEXT_MGR already set [ 403.075469] binder: 12609:12613 ioctl 40046207 0 returned -16 [ 403.075570] binder_alloc: 7943: binder_alloc_buf, no vma [ 403.075588] binder: 12609:12613 transaction failed 29189/-3, size 72-24 line 3136 [ 403.237617] binder: 12626:12628 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.237627] binder: 12626:12628 BC_INCREFS_DONE u0000000000000003 no match [ 403.237632] binder: 12626:12628 ERROR: BC_REGISTER_LOOPER called without request [ 403.237641] binder: 12626:12628 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.237651] binder: 12626:12628 Release 1 refcount change on invalid ref 0 ret -22 [ 403.262201] binder: 12638:12639 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.262211] binder: 12638:12639 BC_INCREFS_DONE u0000000000000003 no match 03:53:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 403.262217] binder: 12638:12639 ERROR: BC_REGISTER_LOOPER called without request [ 403.262224] binder: 12638:12639 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.262234] binder: 12638:12639 Release 1 refcount change on invalid ref 0 ret -22 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 403.283163] binder: BINDER_SET_CONTEXT_MGR already set 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 403.283174] binder: 12627:12641 ioctl 40046207 0 returned -16 [ 403.283326] binder_alloc: 7943: binder_alloc_buf, no vma [ 403.283359] binder: 12627:12641 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 403.350683] binder: 12653:12660 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.350692] binder: 12653:12660 BC_INCREFS_DONE u0000000000000003 no match [ 403.350697] binder: 12653:12660 ERROR: BC_REGISTER_LOOPER called without request [ 403.350705] binder: 12653:12660 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.350715] binder: 12653:12660 Release 1 refcount change on invalid ref 0 ret -22 [ 403.515431] binder: BINDER_SET_CONTEXT_MGR already set [ 403.515439] binder: 12668:12677 ioctl 40046207 0 returned -16 [ 403.516244] binder_alloc: 7943: binder_alloc_buf, no vma [ 403.516264] binder: 12668:12677 transaction failed 29189/-3, size 72-24 line 3136 [ 403.531514] binder: 12674:12679 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.531523] binder: 12674:12679 BC_INCREFS_DONE u0000000000000003 no match 03:53:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 403.531529] binder: 12674:12679 ERROR: BC_REGISTER_LOOPER called without request [ 403.531537] binder: 12674:12679 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.531548] binder: 12674:12679 Release 1 refcount change on invalid ref 0 ret -22 [ 403.575561] binder: BINDER_SET_CONTEXT_MGR already set [ 403.575571] binder: 12688:12689 ioctl 40046207 0 returned -16 [ 403.575662] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 403.575681] binder: 12688:12689 transaction failed 29189/-3, size 72-24 line 3136 [ 403.597058] binder: 12696:12700 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.597067] binder: 12696:12700 BC_INCREFS_DONE u0000000000000003 no match [ 403.597072] binder: 12696:12700 ERROR: BC_REGISTER_LOOPER called without request [ 403.597079] binder: 12696:12700 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.597090] binder: 12696:12700 Release 1 refcount change on invalid ref 0 ret -22 [ 403.771027] binder: 12713:12720 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.771037] binder: 12713:12720 BC_INCREFS_DONE u0000000000000003 no match [ 403.771042] binder: 12713:12720 ERROR: BC_REGISTER_LOOPER called without request [ 403.771050] binder: 12713:12720 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 403.771061] binder: 12713:12720 Release 1 refcount change on invalid ref 0 ret -22 [ 403.775754] binder: BINDER_SET_CONTEXT_MGR already set [ 403.775764] binder: 12710:12718 ioctl 40046207 0 returned -16 [ 403.775856] binder_alloc: 7943: binder_alloc_buf, no vma [ 403.775875] binder: 12710:12718 transaction failed 29189/-3, size 72-24 line 3136 [ 403.823692] binder: 12724:12727 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 403.823702] binder: 12724:12727 BC_INCREFS_DONE u0000000000000003 no match [ 403.823707] binder: 12724:12727 ERROR: BC_REGISTER_LOOPER called without request ** 3 printk messages dropped ** [ 403.861358] binder: 12733:12735 ioctl 40046207 0 returned -16 ** 3 printk messages dropped ** [ 403.876448] binder: 12738:12741 BC_INCREFS_DONE u0000000000000003 no match [ 403.876454] binder: 12738:12741 ERROR: BC_REGISTER_LOOPER called without request [ 403.876463] binder: 12738:12741 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.876474] binder: 12738:12741 Release 1 refcount change on invalid ref 0 ret -22 [ 404.041617] binder: 12756:12758 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.041629] binder: 12756:12758 BC_INCREFS_DONE u0000000000000003 no match 03:53:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 404.041635] binder: 12756:12758 ERROR: BC_REGISTER_LOOPER called without request [ 404.041643] binder: 12756:12758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 404.041653] binder: 12756:12758 Release 1 refcount change on invalid ref 0 ret -22 [ 404.046887] binder: BINDER_SET_CONTEXT_MGR already set [ 404.046895] binder: 12754:12762 ioctl 40046207 0 returned -16 [ 404.047189] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 404.047210] binder: 12754:12762 transaction failed 29189/-3, size 72-24 line 3136 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 404.115246] binder: 12770:12776 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 404.115281] binder: 12770:12776 Release 1 refcount change on invalid ref 0 ret -22 [ 404.164810] binder: BINDER_SET_CONTEXT_MGR already set [ 404.164819] binder: 12774:12783 ioctl 40046207 0 returned -16 [ 404.164930] binder_alloc: 7943: binder_alloc_buf, no vma [ 404.164950] binder: 12774:12783 transaction failed 29189/-3, size 72-24 line 3136 [ 404.286337] binder: 12795:12800 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.286347] binder: 12795:12800 BC_INCREFS_DONE u0000000000000003 no match [ 404.286353] binder: 12795:12800 ERROR: BC_REGISTER_LOOPER called without request 03:53:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 404.286360] binder: 12795:12800 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 404.286372] binder: 12795:12800 Release 1 refcount change on invalid ref 0 ret -22 [ 404.321928] binder: 12808:12813 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.321937] binder: 12808:12813 BC_INCREFS_DONE u0000000000000003 no match 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 404.321943] binder: 12808:12813 ERROR: BC_REGISTER_LOOPER called without request ** 4 printk messages dropped ** [ 404.376627] binder: 12821:12824 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.376636] binder: 12821:12824 BC_INCREFS_DONE u0000000000000003 no match [ 404.376641] binder: 12821:12824 ERROR: BC_REGISTER_LOOPER called without request [ 404.376649] binder: 12821:12824 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 404.376660] binder: 12821:12824 Release 1 refcount change on invalid ref 0 ret -22 [ 404.513829] binder: BINDER_SET_CONTEXT_MGR already set [ 404.513838] binder: 12835:12839 ioctl 40046207 0 returned -16 [ 404.513933] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 404.513951] binder: 12835:12839 transaction failed 29189/-3, size 72-24 line 3136 [ 404.524164] binder: 12838:12840 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.524173] binder: 12838:12840 BC_INCREFS_DONE u0000000000000003 no match [ 404.524179] binder: 12838:12840 ERROR: BC_REGISTER_LOOPER called without request [ 404.524186] binder: 12838:12840 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 404.524197] binder: 12838:12840 Release 1 refcount change on invalid ref 0 ret -22 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 404.583648] binder: BINDER_SET_CONTEXT_MGR already set 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 404.583655] binder: 12850:12855 ioctl 40046207 0 returned -16 [ 404.583781] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 404.583800] binder: 12850:12855 transaction failed 29189/-3, size 72-24 line 3136 [ 404.612501] binder: 12848:12853 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 4 printk messages dropped ** [ 404.643381] binder: BINDER_SET_CONTEXT_MGR already set 03:53:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 404.643390] binder: 12865:12868 ioctl 40046207 0 returned -16 [ 404.643561] binder_alloc: 7943: binder_alloc_buf, no vma [ 404.643580] binder: 12865:12868 transaction failed 29189/-3, size 72-24 line 3136 [ 404.776906] binder: 12876:12883 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.776917] binder: 12876:12883 BC_INCREFS_DONE u0000000000000003 no match [ 404.776923] binder: 12876:12883 ERROR: BC_REGISTER_LOOPER called without request [ 404.776933] binder: 12876:12883 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 404.776943] binder: 12876:12883 Release 1 refcount change on invalid ref 0 ret -22 [ 404.779651] binder: BINDER_SET_CONTEXT_MGR already set 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) ** 9 printk messages dropped ** [ 404.855812] binder: 12895:12900 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 404.866293] binder: 12904:12906 transaction failed 29189/-3, size 72-24 line 3136 [ 405.033762] binder: BINDER_SET_CONTEXT_MGR already set [ 405.033771] binder: 12922:12925 ioctl 40046207 0 returned -16 [ 405.033864] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.033883] binder: 12922:12925 transaction failed 29189/-3, size 72-24 line 3136 [ 405.042097] binder: 12919:12927 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 405.042107] binder: 12919:12927 BC_INCREFS_DONE u0000000000000003 no match [ 405.042113] binder: 12919:12927 ERROR: BC_REGISTER_LOOPER called without request [ 405.042121] binder: 12919:12927 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.042131] binder: 12919:12927 Release 1 refcount change on invalid ref 0 ret -22 03:53:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 405.128307] binder: 12946:12952 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 405.128317] binder: 12946:12952 BC_INCREFS_DONE u0000000000000003 no match 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) ** 2 printk messages dropped ** [ 405.128342] binder: 12946:12952 Release 1 refcount change on invalid ref 0 ret -22 ** 3 printk messages dropped ** [ 405.177356] binder: 12950:12961 transaction failed 29189/-3, size 72-24 line 3136 [ 405.278176] binder: BINDER_SET_CONTEXT_MGR already set [ 405.278185] binder: 12968:12970 ioctl 40046207 0 returned -16 [ 405.278285] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.278304] binder: 12968:12970 transaction failed 29189/-3, size 72-24 line 3136 [ 405.289248] binder: 12964:12973 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 405.289257] binder: 12964:12973 BC_INCREFS_DONE u0000000000000003 no match [ 405.289263] binder: 12964:12973 ERROR: BC_REGISTER_LOOPER called without request [ 405.289271] binder: 12964:12973 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.289280] binder: 12964:12973 Release 1 refcount change on invalid ref 0 ret -22 03:53:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 405.355582] binder: BINDER_SET_CONTEXT_MGR already set [ 405.355591] binder: 12985:12989 ioctl 40046207 0 returned -16 [ 405.355783] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.355802] binder: 12985:12989 transaction failed 29189/-3, size 72-24 line 3136 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 405.359250] binder: 12982:12991 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 1 printk messages dropped ** [ 405.359266] binder: 12982:12991 ERROR: BC_REGISTER_LOOPER called without request ** 4 printk messages dropped ** [ 405.544837] binder: 13006:13009 ERROR: BC_REGISTER_LOOPER called without request [ 405.544845] binder: 13006:13009 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.544854] binder: 13006:13009 Release 1 refcount change on invalid ref 0 ret -22 [ 405.577142] binder: BINDER_SET_CONTEXT_MGR already set [ 405.577153] binder: 13004:13011 ioctl 40046207 0 returned -16 [ 405.577295] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.577317] binder: 13004:13011 transaction failed 29189/-3, size 72-24 line 3136 03:53:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 405.617941] binder: 13017:13021 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 405.617952] binder: 13017:13021 BC_INCREFS_DONE u0000000000000003 no match [ 405.617958] binder: 13017:13021 ERROR: BC_REGISTER_LOOPER called without request [ 405.617966] binder: 13017:13021 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.617977] binder: 13017:13021 Release 1 refcount change on invalid ref 0 ret -22 [ 405.619270] binder: BINDER_SET_CONTEXT_MGR already set [ 405.619279] binder: 13018:13023 ioctl 40046207 0 returned -16 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 405.619701] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.619720] binder: 13018:13023 transaction failed 29189/-3, size 72-24 line 3136 [ 405.712557] binder: BINDER_SET_CONTEXT_MGR already set [ 405.712566] binder: 13044:13047 ioctl 40046207 0 returned -16 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 405.712783] binder_alloc: 7943: binder_alloc_buf, no vma ** 3 printk messages dropped ** [ 405.723400] binder: 13038:13046 ERROR: BC_REGISTER_LOOPER called without request [ 405.723408] binder: 13038:13046 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.723418] binder: 13038:13046 Release 1 refcount change on invalid ref 0 ret -22 [ 405.864096] binder: BINDER_SET_CONTEXT_MGR already set [ 405.864104] binder: 13063:13068 ioctl 40046207 0 returned -16 [ 405.864196] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.864215] binder: 13063:13068 transaction failed 29189/-3, size 72-24 line 3136 [ 405.881173] binder: 13064:13074 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 405.881182] binder: 13064:13074 BC_INCREFS_DONE u0000000000000003 no match 03:53:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 405.881188] binder: 13064:13074 ERROR: BC_REGISTER_LOOPER called without request [ 405.881196] binder: 13064:13074 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.881207] binder: 13064:13074 Release 1 refcount change on invalid ref 0 ret -22 [ 405.956067] binder: BINDER_SET_CONTEXT_MGR already set [ 405.956076] binder: 13082:13090 ioctl 40046207 0 returned -16 [ 405.956169] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 405.956186] binder: 13082:13090 transaction failed 29189/-3, size 72-24 line 3136 [ 405.960104] binder: 13088:13091 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 405.960113] binder: 13088:13091 BC_INCREFS_DONE u0000000000000003 no match ** 6 printk messages dropped ** [ 406.088295] binder: 13107:13113 transaction failed 29189/-3, size 72-24 line 3136 [ 406.092677] binder: 13108:13115 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.092695] binder: 13108:13115 BC_INCREFS_DONE u0000000000000003 no match 03:53:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 406.092701] binder: 13108:13115 ERROR: BC_REGISTER_LOOPER called without request [ 406.092710] binder: 13108:13115 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.092719] binder: 13108:13115 Release 1 refcount change on invalid ref 0 ret -22 [ 406.172044] binder: BINDER_SET_CONTEXT_MGR already set 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) ** 2 printk messages dropped ** [ 406.172177] binder: 13132:13138 transaction failed 29189/-3, size 72-24 line 3136 [ 406.182512] binder: 13121:13142 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) ** 1 printk messages dropped ** [ 406.182527] binder: 13121:13142 ERROR: BC_REGISTER_LOOPER called without request ** 8 printk messages dropped ** [ 406.342148] binder: 13155:13163 ERROR: BC_REGISTER_LOOPER called without request [ 406.342154] binder: 13155:13163 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.342162] binder: 13155:13163 Release 1 refcount change on invalid ref 0 ret -22 [ 406.386243] binder: 13169:13172 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 406.386252] binder: 13169:13172 BC_INCREFS_DONE u0000000000000003 no match [ 406.386258] binder: 13169:13172 ERROR: BC_REGISTER_LOOPER called without request [ 406.386266] binder: 13169:13172 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.386277] binder: 13169:13172 Release 1 refcount change on invalid ref 0 ret -22 [ 406.398456] binder: BINDER_SET_CONTEXT_MGR already set [ 406.398465] binder: 13171:13173 ioctl 40046207 0 returned -16 [ 406.398561] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 406.398581] binder: 13171:13173 transaction failed 29189/-3, size 72-24 line 3136 [ 406.444235] binder: 13182:13185 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.444245] binder: 13182:13185 BC_INCREFS_DONE u0000000000000003 no match ** 3 printk messages dropped ** [ 406.593065] binder: BINDER_SET_CONTEXT_MGR already set [ 406.593074] binder: 13193:13204 ioctl 40046207 0 returned -16 [ 406.593168] binder_alloc: 7943: binder_alloc_buf, no vma [ 406.593186] binder: 13193:13204 transaction failed 29189/-3, size 72-24 line 3136 [ 406.606871] binder: 13197:13207 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.606880] binder: 13197:13207 BC_INCREFS_DONE u0000000000000003 no match 03:53:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 406.606885] binder: 13197:13207 ERROR: BC_REGISTER_LOOPER called without request [ 406.606893] binder: 13197:13207 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.606905] binder: 13197:13207 Release 1 refcount change on invalid ref 0 ret -22 [ 406.653648] binder: BINDER_SET_CONTEXT_MGR already set [ 406.653657] binder: 13218:13222 ioctl 40046207 0 returned -16 [ 406.653764] binder_alloc: 7943: binder_alloc_buf, no vma [ 406.653784] binder: 13218:13222 transaction failed 29189/-3, size 72-24 line 3136 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 406.663925] binder: 13219:13224 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 406.663934] binder: 13219:13224 BC_INCREFS_DONE u0000000000000003 no match ** 3 printk messages dropped ** [ 406.808299] binder: BINDER_SET_CONTEXT_MGR already set ** 5 printk messages dropped ** [ 406.816636] binder: 13242:13244 ERROR: BC_REGISTER_LOOPER called without request [ 406.816643] binder: 13242:13244 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.816651] binder: 13242:13244 Release 1 refcount change on invalid ref 0 ret -22 [ 406.862269] binder: 13248:13252 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.862277] binder: 13248:13252 BC_INCREFS_DONE u0000000000000003 no match [ 406.862281] binder: 13248:13252 ERROR: BC_REGISTER_LOOPER called without request [ 406.862288] binder: 13248:13252 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.862355] binder: 13248:13252 Release 1 refcount change on invalid ref 0 ret -22 03:53:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 406.864148] binder: BINDER_SET_CONTEXT_MGR already set [ 406.864159] binder: 13251:13253 ioctl 40046207 0 returned -16 [ 406.864286] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 406.864306] binder: 13251:13253 transaction failed 29189/-3, size 72-24 line 3136 ** 6 printk messages dropped ** [ 406.935248] binder: 13259:13266 ERROR: BC_REGISTER_LOOPER called without request [ 406.935256] binder: 13259:13266 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.935265] binder: 13259:13266 Release 1 refcount change on invalid ref 0 ret -22 [ 406.975400] binder: BINDER_SET_CONTEXT_MGR already set [ 406.975410] binder: 13273:13281 ioctl 40046207 0 returned -16 [ 406.975522] binder_alloc: 7943: binder_alloc_buf, no vma [ 406.975541] binder: 13273:13281 transaction failed 29189/-3, size 72-24 line 3136 03:53:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 406.993790] binder: 13278:13285 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.993799] binder: 13278:13285 BC_INCREFS_DONE u0000000000000003 no match [ 406.993805] binder: 13278:13285 ERROR: BC_REGISTER_LOOPER called without request [ 406.993813] binder: 13278:13285 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 406.993824] binder: 13278:13285 Release 1 refcount change on invalid ref 0 ret -22 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 407.112808] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 407.112967] binder: 13292:13296 transaction failed 29189/-3, size 72-24 line 3136 ** 2 printk messages dropped ** [ 407.117080] binder: 13297:13303 ERROR: BC_REGISTER_LOOPER called without request [ 407.117089] binder: 13297:13303 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.117098] binder: 13297:13303 Release 1 refcount change on invalid ref 0 ret -22 [ 407.165859] binder: BINDER_SET_CONTEXT_MGR already set [ 407.165868] binder: 13307:13311 ioctl 40046207 0 returned -16 [ 407.165971] binder_alloc: 7943: binder_alloc_buf, no vma [ 407.165989] binder: 13307:13311 transaction failed 29189/-3, size 72-24 line 3136 03:53:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 407.197906] binder: BINDER_SET_CONTEXT_MGR already set [ 407.197916] binder: 13320:13326 ioctl 40046207 0 returned -16 [ 407.198020] binder_alloc: 7943: binder_alloc_buf, no vma [ 407.198039] binder: 13320:13326 transaction failed 29189/-3, size 72-24 line 3136 [ 407.212181] binder: 13317:13325 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 407.212196] binder: 13317:13325 BC_INCREFS_DONE u0000000000000003 no match 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 407.212281] binder: 13317:13325 ERROR: BC_REGISTER_LOOPER called without request [ 407.212291] binder: 13317:13325 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.212304] binder: 13317:13325 Release 1 refcount change on invalid ref 0 ret -22 ** 3 printk messages dropped ** [ 407.344308] binder: 13338:13344 transaction failed 29189/-3, size 72-24 line 3136 [ 407.345736] binder: 13339:13345 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 407.345745] binder: 13339:13345 BC_INCREFS_DONE u0000000000000003 no match [ 407.345750] binder: 13339:13345 ERROR: BC_REGISTER_LOOPER called without request [ 407.345758] binder: 13339:13345 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.345767] binder: 13339:13345 Release 1 refcount change on invalid ref 0 ret -22 [ 407.397773] binder: BINDER_SET_CONTEXT_MGR already set [ 407.397781] binder: 13349:13358 ioctl 40046207 0 returned -16 [ 407.397887] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 407.397905] binder: 13349:13358 transaction failed 29189/-3, size 72-24 line 3136 [ 407.408842] binder: 13353:13362 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 407.408852] binder: 13353:13362 BC_INCREFS_DONE u0000000000000003 no match ** 2 printk messages dropped ** [ 407.408879] binder: 13353:13362 Release 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 407.574065] binder: 13383:13392 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 407.577454] binder: 13383:13392 BC_INCREFS_DONE u0000000000000003 no match [ 407.577460] binder: 13383:13392 ERROR: BC_REGISTER_LOOPER called without request [ 407.577469] binder: 13383:13392 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.577481] binder: 13383:13392 Release 1 refcount change on invalid ref 0 ret -22 [ 407.584691] binder: BINDER_SET_CONTEXT_MGR already set [ 407.584699] binder: 13379:13385 ioctl 40046207 0 returned -16 [ 407.584822] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 407.584842] binder: 13379:13385 transaction failed 29189/-3, size 72-24 line 3136 [ 407.642975] binder: BINDER_SET_CONTEXT_MGR already set [ 407.642984] binder: 13397:13406 ioctl 40046207 0 returned -16 [ 407.643553] binder_alloc: 7943: binder_alloc_buf, no vma [ 407.643570] binder: 13397:13406 transaction failed 29189/-3, size 72-24 line 3136 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 407.650441] binder: 13398:13408 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 4 printk messages dropped ** [ 407.683999] binder: 13415:13417 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 8 printk messages dropped ** [ 407.844022] binder: 13430:13436 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 407.844032] binder: 13430:13436 BC_INCREFS_DONE u0000000000000003 no match [ 407.844038] binder: 13430:13436 ERROR: BC_REGISTER_LOOPER called without request [ 407.844046] binder: 13430:13436 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.844057] binder: 13430:13436 Release 1 refcount change on invalid ref 0 ret -22 [ 407.877979] binder: BINDER_SET_CONTEXT_MGR already set 03:53:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 407.877988] binder: 13440:13447 ioctl 40046207 0 returned -16 [ 407.878096] binder_alloc: 7943: binder_alloc_buf, no vma [ 407.878116] binder: 13440:13447 transaction failed 29189/-3, size 72-24 line 3136 [ 407.907828] binder: 13454:13462 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 407.907838] binder: 13454:13462 BC_INCREFS_DONE u0000000000000003 no match [ 407.907844] binder: 13454:13462 ERROR: BC_REGISTER_LOOPER called without request 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 407.907852] binder: 13454:13462 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.907864] binder: 13454:13462 Release 1 refcount change on invalid ref 0 ret -22 [ 408.037300] binder: BINDER_SET_CONTEXT_MGR already set 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 408.037309] binder: 13471:13474 ioctl 40046207 0 returned -16 ** 2 printk messages dropped ** [ 408.045992] binder: 13469:13475 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 408.046000] binder: 13469:13475 BC_INCREFS_DONE u0000000000000003 no match [ 408.046004] binder: 13469:13475 ERROR: BC_REGISTER_LOOPER called without request [ 408.046011] binder: 13469:13475 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 408.046018] binder: 13469:13475 Release 1 refcount change on invalid ref 0 ret -22 [ 408.071515] binder: 13481:13482 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 408.071524] binder: 13481:13482 BC_INCREFS_DONE u0000000000000003 no match [ 408.071530] binder: 13481:13482 ERROR: BC_REGISTER_LOOPER called without request [ 408.071537] binder: 13481:13482 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 408.071547] binder: 13481:13482 Release 1 refcount change on invalid ref 0 ret -22 [ 408.123388] binder: BINDER_SET_CONTEXT_MGR already set [ 408.123398] binder: 13493:13496 ioctl 40046207 0 returned -16 [ 408.123505] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 408.123524] binder: 13493:13496 transaction failed 29189/-3, size 72-24 line 3136 [ 408.130133] binder: 13499:13502 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) ** 3 printk messages dropped ** [ 408.130166] binder: 13499:13502 Release 1 refcount change on invalid ref 0 ret -22 ** 2 printk messages dropped ** [ 408.286623] binder: 13516:13519 ERROR: BC_REGISTER_LOOPER called without request [ 408.286631] binder: 13516:13519 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 408.286640] binder: 13516:13519 Release 1 refcount change on invalid ref 0 ret -22 [ 408.294589] binder: BINDER_SET_CONTEXT_MGR already set [ 408.294597] binder: 13515:13518 ioctl 40046207 0 returned -16 [ 408.294689] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 408.294708] binder: 13515:13518 transaction failed 29189/-3, size 72-24 line 3136 [ 408.354275] binder: BINDER_SET_CONTEXT_MGR already set [ 408.354284] binder: 13524:13532 ioctl 40046207 0 returned -16 [ 408.354392] binder_alloc: 7943: binder_alloc_buf, no vma [ 408.354411] binder: 13524:13532 transaction failed 29189/-3, size 72-24 line 3136 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 408.357162] binder: 13527:13533 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 408.357171] binder: 13527:13533 BC_INCREFS_DONE u0000000000000003 no match ** 5 printk messages dropped ** [ 408.559217] binder: 13556:13566 ERROR: BC_REGISTER_LOOPER called without request [ 408.559224] binder: 13556:13566 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 408.559231] binder: 13556:13566 Release 1 refcount change on invalid ref 0 ret -22 [ 408.574915] binder: BINDER_SET_CONTEXT_MGR already set [ 408.574925] binder: 13557:13561 ioctl 40046207 0 returned -16 [ 408.575020] binder_alloc: 7943: binder_alloc_buf, no vma [ 408.575038] binder: 13557:13561 transaction failed 29189/-3, size 72-24 line 3136 [ 408.607828] binder: BINDER_SET_CONTEXT_MGR already set ** 146 printk messages dropped ** [ 410.397365] binder: 13886:13888 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.397377] binder: 13886:13888 Release 1 refcount change on invalid ref 0 ret -22 [ 410.398119] binder: BINDER_SET_CONTEXT_MGR already set [ 410.398129] binder: 13879:13884 ioctl 40046207 0 returned -16 [ 410.398224] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.398244] binder: 13879:13884 transaction failed 29189/-3, size 72-24 line 3136 [ 410.459888] binder: 13901:13902 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.459898] binder: 13901:13902 BC_INCREFS_DONE u0000000000000003 no match [ 410.459904] binder: 13901:13902 ERROR: BC_REGISTER_LOOPER called without request [ 410.459912] binder: 13901:13902 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.459922] binder: 13901:13902 Release 1 refcount change on invalid ref 0 ret -22 [ 410.606018] binder: BINDER_SET_CONTEXT_MGR already set [ 410.606027] binder: 13912:13917 ioctl 40046207 0 returned -16 [ 410.607005] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.607131] binder: 13912:13917 transaction failed 29189/-3, size 72-24 line 3136 [ 410.610473] binder: 13914:13918 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.610483] binder: 13914:13918 BC_INCREFS_DONE u0000000000000003 no match [ 410.610489] binder: 13914:13918 ERROR: BC_REGISTER_LOOPER called without request [ 410.610497] binder: 13914:13918 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.610508] binder: 13914:13918 Release 1 refcount change on invalid ref 0 ret -22 [ 410.662000] binder: 13931:13933 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.662010] binder: 13931:13933 BC_INCREFS_DONE u0000000000000003 no match [ 410.662015] binder: 13931:13933 ERROR: BC_REGISTER_LOOPER called without request [ 410.662023] binder: 13931:13933 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.662032] binder: 13931:13933 Release 1 refcount change on invalid ref 0 ret -22 [ 410.701885] binder: BINDER_SET_CONTEXT_MGR already set [ 410.701894] binder: 13930:13939 ioctl 40046207 0 returned -16 [ 410.702111] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.702132] binder: 13930:13939 transaction failed 29189/-3, size 72-24 line 3136 [ 410.725902] binder: 13940:13943 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.725971] binder: 13940:13943 BC_INCREFS_DONE u0000000000000003 no match [ 410.725977] binder: 13940:13943 ERROR: BC_REGISTER_LOOPER called without request [ 410.726037] binder: 13940:13943 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.726048] binder: 13940:13943 Release 1 refcount change on invalid ref 0 ret -22 [ 410.856416] binder: BINDER_SET_CONTEXT_MGR already set [ 410.856425] binder: 13955:13962 ioctl 40046207 0 returned -16 [ 410.856529] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.856549] binder: 13955:13962 transaction failed 29189/-3, size 72-24 line 3136 [ 410.889814] binder: 13957:13963 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.889824] binder: 13957:13963 BC_INCREFS_DONE u0000000000000003 no match [ 410.889830] binder: 13957:13963 ERROR: BC_REGISTER_LOOPER called without request [ 410.889838] binder: 13957:13963 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.889848] binder: 13957:13963 Release 1 refcount change on invalid ref 0 ret -22 [ 410.902832] binder: BINDER_SET_CONTEXT_MGR already set [ 410.902841] binder: 13970:13975 ioctl 40046207 0 returned -16 [ 410.902946] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.902964] binder: 13970:13975 transaction failed 29189/-3, size 72-24 line 3136 [ 410.946461] binder: BINDER_SET_CONTEXT_MGR already set [ 410.946470] binder: 13979:13985 ioctl 40046207 0 returned -16 [ 410.946637] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.946657] binder: 13979:13985 transaction failed 29189/-3, size 72-24 line 3136 [ 411.101651] binder: 14000:14007 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.101661] binder: 14000:14007 BC_INCREFS_DONE u0000000000000003 no match [ 411.101667] binder: 14000:14007 ERROR: BC_REGISTER_LOOPER called without request [ 411.101677] binder: 14000:14007 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.101694] binder: 14000:14007 Release 1 refcount change on invalid ref 0 ret -22 [ 411.117034] binder: BINDER_SET_CONTEXT_MGR already set [ 411.117042] binder: 14003:14010 ioctl 40046207 0 returned -16 [ 411.117137] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.117157] binder: 14003:14010 transaction failed 29189/-3, size 72-24 line 3136 [ 411.175490] binder: BINDER_SET_CONTEXT_MGR already set [ 411.175499] binder: 14021:14025 ioctl 40046207 0 returned -16 [ 411.175601] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.175620] binder: 14021:14025 transaction failed 29189/-3, size 72-24 line 3136 [ 411.337756] binder: BINDER_SET_CONTEXT_MGR already set [ 411.337765] binder: 14045:14051 ioctl 40046207 0 returned -16 [ 411.337857] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.337876] binder: 14045:14051 transaction failed 29189/-3, size 72-24 line 3136 [ 411.352945] binder: 14042:14043 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.352955] binder: 14042:14043 BC_INCREFS_DONE u0000000000000003 no match [ 411.352961] binder: 14042:14043 ERROR: BC_REGISTER_LOOPER called without request [ 411.352969] binder: 14042:14043 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.352978] binder: 14042:14043 Release 1 refcount change on invalid ref 0 ret -22 [ 411.393948] binder: 14055:14067 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.393957] binder: 14055:14067 BC_INCREFS_DONE u0000000000000003 no match [ 411.393963] binder: 14055:14067 ERROR: BC_REGISTER_LOOPER called without request [ 411.393972] binder: 14055:14067 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.393983] binder: 14055:14067 Release 1 refcount change on invalid ref 0 ret -22 [ 411.421999] binder: BINDER_SET_CONTEXT_MGR already set [ 411.422008] binder: 14071:14074 ioctl 40046207 0 returned -16 [ 411.422107] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.422126] binder: 14071:14074 transaction failed 29189/-3, size 72-24 line 3136 [ 411.465781] binder: 14080:14083 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.465791] binder: 14080:14083 BC_INCREFS_DONE u0000000000000003 no match [ 411.465797] binder: 14080:14083 ERROR: BC_REGISTER_LOOPER called without request [ 411.465805] binder: 14080:14083 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.465816] binder: 14080:14083 Release 1 refcount change on invalid ref 0 ret -22 [ 411.607474] binder: BINDER_SET_CONTEXT_MGR already set [ 411.607482] binder: 14096:14098 ioctl 40046207 0 returned -16 [ 411.607604] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.607622] binder: 14096:14098 transaction failed 29189/-3, size 72-24 line 3136 [ 411.620281] binder: 14100:14103 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.620858] binder: 14100:14103 BC_INCREFS_DONE u0000000000000003 no match [ 411.620863] binder: 14100:14103 ERROR: BC_REGISTER_LOOPER called without request [ 411.620872] binder: 14100:14103 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.620881] binder: 14100:14103 Release 1 refcount change on invalid ref 0 ret -22 [ 411.633780] binder: BINDER_SET_CONTEXT_MGR already set [ 411.633788] binder: 14106:14108 ioctl 40046207 0 returned -16 [ 411.633881] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.633900] binder: 14106:14108 transaction failed 29189/-3, size 72-24 line 3136 [ 411.682397] binder: 14111:14113 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.682419] binder: 14111:14113 BC_INCREFS_DONE u0000000000000003 no match [ 411.682424] binder: 14111:14113 ERROR: BC_REGISTER_LOOPER called without request [ 411.682432] binder: 14111:14113 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.682443] binder: 14111:14113 Release 1 refcount change on invalid ref 0 ret -22 [ 411.712540] binder: BINDER_SET_CONTEXT_MGR already set [ 411.712549] binder: 14121:14126 ioctl 40046207 0 returned -16 [ 411.712660] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.712680] binder: 14121:14126 transaction failed 29189/-3, size 72-24 line 3136 [ 411.878603] binder: BINDER_SET_CONTEXT_MGR already set [ 411.878611] binder: 14144:14147 ioctl 40046207 0 returned -16 [ 411.878704] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.878723] binder: 14144:14147 transaction failed 29189/-3, size 72-24 line 3136 [ 411.898439] binder: 14139:14149 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.898448] binder: 14139:14149 BC_INCREFS_DONE u0000000000000003 no match [ 411.898453] binder: 14139:14149 ERROR: BC_REGISTER_LOOPER called without request [ 411.898461] binder: 14139:14149 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.898471] binder: 14139:14149 Release 1 refcount change on invalid ref 0 ret -22 [ 411.954142] binder: BINDER_SET_CONTEXT_MGR already set [ 411.954154] binder: 14158:14161 ioctl 40046207 0 returned -16 [ 411.954276] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.954293] binder: 14158:14161 transaction failed 29189/-3, size 72-24 line 3136 [ 411.995099] binder: 14165:14169 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.995109] binder: 14165:14169 BC_INCREFS_DONE u0000000000000003 no match [ 411.995115] binder: 14165:14169 ERROR: BC_REGISTER_LOOPER called without request [ 411.995131] binder: 14165:14169 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.995249] binder: 14165:14169 Release 1 refcount change on invalid ref 0 ret -22 [ 412.127118] binder: 14188:14192 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.127128] binder: 14188:14192 BC_INCREFS_DONE u0000000000000003 no match [ 412.127133] binder: 14188:14192 ERROR: BC_REGISTER_LOOPER called without request [ 412.127142] binder: 14188:14192 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.127153] binder: 14188:14192 Release 1 refcount change on invalid ref 0 ret -22 [ 412.138792] binder: BINDER_SET_CONTEXT_MGR already set [ 412.138801] binder: 14187:14195 ioctl 40046207 0 returned -16 [ 412.138904] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.138923] binder: 14187:14195 transaction failed 29189/-3, size 72-24 line 3136 [ 412.186021] binder: 14198:14201 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.186031] binder: 14198:14201 BC_INCREFS_DONE u0000000000000003 no match [ 412.186036] binder: 14198:14201 ERROR: BC_REGISTER_LOOPER called without request [ 412.186045] binder: 14198:14201 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.186055] binder: 14198:14201 Release 1 refcount change on invalid ref 0 ret -22 [ 412.209744] binder: BINDER_SET_CONTEXT_MGR already set [ 412.209753] binder: 14199:14203 ioctl 40046207 0 returned -16 [ 412.209853] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.209871] binder: 14199:14203 transaction failed 29189/-3, size 72-24 line 3136 [ 412.390246] binder: BINDER_SET_CONTEXT_MGR already set [ 412.390255] binder: 14229:14233 ioctl 40046207 0 returned -16 [ 412.390349] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.390370] binder: 14229:14233 transaction failed 29189/-3, size 72-24 line 3136 [ 412.412194] binder: 14228:14236 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.412204] binder: 14228:14236 BC_INCREFS_DONE u0000000000000003 no match [ 412.412209] binder: 14228:14236 ERROR: BC_REGISTER_LOOPER called without request [ 412.412217] binder: 14228:14236 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.412310] binder: 14228:14236 Release 1 refcount change on invalid ref 0 ret -22 [ 412.420818] binder: BINDER_SET_CONTEXT_MGR already set [ 412.420829] binder: 14241:14242 ioctl 40046207 0 returned -16 [ 412.420938] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.420960] binder: 14241:14242 transaction failed 29189/-3, size 72-24 line 3136 [ 412.452783] binder: BINDER_SET_CONTEXT_MGR already set [ 412.452792] binder: 14246:14253 ioctl 40046207 0 returned -16 [ 412.453025] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.453044] binder: 14246:14253 transaction failed 29189/-3, size 72-24 line 3136 [ 412.467228] binder: 14254:14259 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.467237] binder: 14254:14259 BC_INCREFS_DONE u0000000000000003 no match [ 412.467243] binder: 14254:14259 ERROR: BC_REGISTER_LOOPER called without request [ 412.467251] binder: 14254:14259 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.467261] binder: 14254:14259 Release 1 refcount change on invalid ref 0 ret -22 [ 412.630150] binder: 14274:14277 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.630160] binder: 14274:14277 BC_INCREFS_DONE u0000000000000003 no match [ 412.630166] binder: 14274:14277 ERROR: BC_REGISTER_LOOPER called without request [ 412.630174] binder: 14274:14277 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.630197] binder: 14274:14277 Release 1 refcount change on invalid ref 0 ret -22 [ 412.649516] binder: BINDER_SET_CONTEXT_MGR already set [ 412.649524] binder: 14272:14281 ioctl 40046207 0 returned -16 [ 412.649612] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.649629] binder: 14272:14281 transaction failed 29189/-3, size 72-24 line 3136 [ 412.700986] binder: 14285:14298 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.700995] binder: 14285:14298 BC_INCREFS_DONE u0000000000000003 no match [ 412.701001] binder: 14285:14298 ERROR: BC_REGISTER_LOOPER called without request [ 412.701010] binder: 14285:14298 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.701020] binder: 14285:14298 Release 1 refcount change on invalid ref 0 ret -22 [ 412.721368] binder: BINDER_SET_CONTEXT_MGR already set [ 412.721377] binder: 14295:14301 ioctl 40046207 0 returned -16 [ 412.721475] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.721494] binder: 14295:14301 transaction failed 29189/-3, size 72-24 line 3136 [ 412.892443] binder: 14316:14320 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.892453] binder: 14316:14320 BC_INCREFS_DONE u0000000000000003 no match [ 412.892458] binder: 14316:14320 ERROR: BC_REGISTER_LOOPER called without request [ 412.892466] binder: 14316:14320 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.892475] binder: 14316:14320 Release 1 refcount change on invalid ref 0 ret -22 [ 412.896942] binder: BINDER_SET_CONTEXT_MGR already set [ 412.896950] binder: 14318:14321 ioctl 40046207 0 returned -16 [ 412.897657] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.897676] binder: 14318:14321 transaction failed 29189/-3, size 72-24 line 3136 [ 412.944225] binder: 14325:14331 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.944235] binder: 14325:14331 BC_INCREFS_DONE u0000000000000003 no match [ 412.944240] binder: 14325:14331 ERROR: BC_REGISTER_LOOPER called without request [ 412.944249] binder: 14325:14331 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.944261] binder: 14325:14331 Release 1 refcount change on invalid ref 0 ret -22 [ 412.952047] binder: BINDER_SET_CONTEXT_MGR already set [ 412.952056] binder: 14329:14330 ioctl 40046207 0 returned -16 [ 412.952162] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.952192] binder: 14329:14330 transaction failed 29189/-3, size 72-24 line 3136 [ 412.981539] binder: 14338:14339 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.981548] binder: 14338:14339 BC_INCREFS_DONE u0000000000000003 no match [ 412.981554] binder: 14338:14339 ERROR: BC_REGISTER_LOOPER called without request [ 412.981562] binder: 14338:14339 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.981571] binder: 14338:14339 Release 1 refcount change on invalid ref 0 ret -22 [ 413.131986] binder: BINDER_SET_CONTEXT_MGR already set [ 413.131994] binder: 14355:14363 ioctl 40046207 0 returned -16 [ 413.138006] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.138029] binder: 14355:14363 transaction failed 29189/-3, size 72-24 line 3136 [ 413.145395] binder: 14358:14362 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.145404] binder: 14358:14362 BC_INCREFS_DONE u0000000000000003 no match [ 413.145410] binder: 14358:14362 ERROR: BC_REGISTER_LOOPER called without request [ 413.145418] binder: 14358:14362 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.145429] binder: 14358:14362 Release 1 refcount change on invalid ref 0 ret -22 [ 413.181436] binder: 14371:14372 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.181446] binder: 14371:14372 BC_INCREFS_DONE u0000000000000003 no match [ 413.181451] binder: 14371:14372 ERROR: BC_REGISTER_LOOPER called without request [ 413.181459] binder: 14371:14372 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.181469] binder: 14371:14372 Release 1 refcount change on invalid ref 0 ret -22 [ 413.200199] binder: BINDER_SET_CONTEXT_MGR already set [ 413.200209] binder: 14375:14378 ioctl 40046207 0 returned -16 [ 413.200302] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.200320] binder: 14375:14378 transaction failed 29189/-3, size 72-24 line 3136 [ 413.402305] binder: BINDER_SET_CONTEXT_MGR already set [ 413.402313] binder: 14404:14406 ioctl 40046207 0 returned -16 [ 413.402415] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.402433] binder: 14404:14406 transaction failed 29189/-3, size 72-24 line 3136 [ 413.407583] binder: 14399:14407 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.407594] binder: 14399:14407 BC_INCREFS_DONE u0000000000000003 no match [ 413.407600] binder: 14399:14407 ERROR: BC_REGISTER_LOOPER called without request [ 413.407673] binder: 14399:14407 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.407693] binder: 14399:14407 Release 1 refcount change on invalid ref 0 ret -22 [ 413.466920] binder: BINDER_SET_CONTEXT_MGR already set [ 413.466928] binder: 14415:14417 ioctl 40046207 0 returned -16 [ 413.467019] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.467039] binder: 14415:14417 transaction failed 29189/-3, size 72-24 line 3136 [ 413.493552] binder: 14420:14427 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.493562] binder: 14420:14427 BC_INCREFS_DONE u0000000000000003 no match [ 413.493568] binder: 14420:14427 ERROR: BC_REGISTER_LOOPER called without request [ 413.493576] binder: 14420:14427 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.493585] binder: 14420:14427 Release 1 refcount change on invalid ref 0 ret -22 [ 413.669910] binder: BINDER_SET_CONTEXT_MGR already set [ 413.669920] binder: 14440:14450 ioctl 40046207 0 returned -16 [ 413.670009] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.670029] binder: 14440:14450 transaction failed 29189/-3, size 72-24 line 3136 [ 413.674583] binder: 14443:14448 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.674593] binder: 14443:14448 BC_INCREFS_DONE u0000000000000003 no match [ 413.674598] binder: 14443:14448 ERROR: BC_REGISTER_LOOPER called without request [ 413.674608] binder: 14443:14448 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.674618] binder: 14443:14448 Release 1 refcount change on invalid ref 0 ret -22 [ 413.728835] binder: BINDER_SET_CONTEXT_MGR already set [ 413.728844] binder: 14454:14464 ioctl 40046207 0 returned -16 [ 413.736373] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.736393] binder: 14454:14464 transaction failed 29189/-3, size 72-24 line 3136 [ 413.754013] binder: 14457:14465 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.754024] binder: 14457:14465 BC_INCREFS_DONE u0000000000000003 no match [ 413.754030] binder: 14457:14465 ERROR: BC_REGISTER_LOOPER called without request [ 413.754038] binder: 14457:14465 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.754049] binder: 14457:14465 Release 1 refcount change on invalid ref 0 ret -22 [ 413.882074] binder: BINDER_SET_CONTEXT_MGR already set [ 413.882083] binder: 14485:14490 ioctl 40046207 0 returned -16 [ 413.882241] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.882262] binder: 14485:14490 transaction failed 29189/-3, size 72-24 line 3136 [ 413.903470] binder: 14483:14486 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.903480] binder: 14483:14486 BC_INCREFS_DONE u0000000000000003 no match [ 413.903485] binder: 14483:14486 ERROR: BC_REGISTER_LOOPER called without request [ 413.903494] binder: 14483:14486 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.903506] binder: 14483:14486 Release 1 refcount change on invalid ref 0 ret -22 [ 413.937258] binder: BINDER_SET_CONTEXT_MGR already set [ 413.937267] binder: 14497:14500 ioctl 40046207 0 returned -16 [ 413.937859] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.937878] binder: 14497:14500 transaction failed 29189/-3, size 72-24 line 3136 [ 413.967466] binder: 14504:14508 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.967475] binder: 14504:14508 BC_INCREFS_DONE u0000000000000003 no match [ 413.967480] binder: 14504:14508 ERROR: BC_REGISTER_LOOPER called without request [ 413.967486] binder: 14504:14508 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.967496] binder: 14504:14508 Release 1 refcount change on invalid ref 0 ret -22 [ 414.163270] binder: BINDER_SET_CONTEXT_MGR already set [ 414.163278] binder: 14528:14532 ioctl 40046207 0 returned -16 [ 414.163481] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.163501] binder: 14528:14532 transaction failed 29189/-3, size 72-24 line 3136 [ 414.168554] binder: 14529:14536 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.168563] binder: 14529:14536 BC_INCREFS_DONE u0000000000000003 no match [ 414.168569] binder: 14529:14536 ERROR: BC_REGISTER_LOOPER called without request [ 414.168577] binder: 14529:14536 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.168586] binder: 14529:14536 Release 1 refcount change on invalid ref 0 ret -22 [ 414.219106] binder: 14548:14551 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.219116] binder: 14548:14551 BC_INCREFS_DONE u0000000000000003 no match [ 414.219122] binder: 14548:14551 ERROR: BC_REGISTER_LOOPER called without request [ 414.219130] binder: 14548:14551 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.219142] binder: 14548:14551 Release 1 refcount change on invalid ref 0 ret -22 [ 414.243515] binder: BINDER_SET_CONTEXT_MGR already set [ 414.243523] binder: 14553:14557 ioctl 40046207 0 returned -16 [ 414.243603] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.243619] binder: 14553:14557 transaction failed 29189/-3, size 72-24 line 3136 [ 414.425830] binder: BINDER_SET_CONTEXT_MGR already set [ 414.425838] binder: 14572:14577 ioctl 40046207 0 returned -16 [ 414.425943] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.425962] binder: 14572:14577 transaction failed 29189/-3, size 72-24 line 3136 [ 414.460751] binder: 14571:14580 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.460761] binder: 14571:14580 BC_INCREFS_DONE u0000000000000003 no match [ 414.460767] binder: 14571:14580 ERROR: BC_REGISTER_LOOPER called without request [ 414.460776] binder: 14571:14580 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.460787] binder: 14571:14580 Release 1 refcount change on invalid ref 0 ret -22 [ 414.480776] binder: BINDER_SET_CONTEXT_MGR already set [ 414.480784] binder: 14584:14588 ioctl 40046207 0 returned -16 [ 414.480933] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.480951] binder: 14584:14588 transaction failed 29189/-3, size 72-24 line 3136 [ 414.513037] binder: 14591:14598 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.513047] binder: 14591:14598 BC_INCREFS_DONE u0000000000000003 no match [ 414.513052] binder: 14591:14598 ERROR: BC_REGISTER_LOOPER called without request [ 414.513059] binder: 14591:14598 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.513069] binder: 14591:14598 Release 1 refcount change on invalid ref 0 ret -22 [ 414.531303] binder: BINDER_SET_CONTEXT_MGR already set [ 414.531312] binder: 14596:14601 ioctl 40046207 0 returned -16 [ 414.531409] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.531428] binder: 14596:14601 transaction failed 29189/-3, size 72-24 line 3136 [ 414.698937] binder: 14617:14620 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.698947] binder: 14617:14620 BC_INCREFS_DONE u0000000000000003 no match [ 414.698952] binder: 14617:14620 ERROR: BC_REGISTER_LOOPER called without request [ 414.698960] binder: 14617:14620 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.698970] binder: 14617:14620 Release 1 refcount change on invalid ref 0 ret -22 [ 414.707807] binder: BINDER_SET_CONTEXT_MGR already set [ 414.707817] binder: 14615:14623 ioctl 40046207 0 returned -16 [ 414.707910] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.707930] binder: 14615:14623 transaction failed 29189/-3, size 72-24 line 3136 [ 414.760555] binder: 14632:14637 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.760565] binder: 14632:14637 BC_INCREFS_DONE u0000000000000003 no match [ 414.760571] binder: 14632:14637 ERROR: BC_REGISTER_LOOPER called without request [ 414.760578] binder: 14632:14637 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.760591] binder: 14632:14637 Release 1 refcount change on invalid ref 0 ret -22 [ 414.774096] binder: BINDER_SET_CONTEXT_MGR already set [ 414.774105] binder: 14629:14633 ioctl 40046207 0 returned -16 [ 414.774195] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.774213] binder: 14629:14633 transaction failed 29189/-3, size 72-24 line 3136 [ 414.825929] binder: 14643:14650 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.825939] binder: 14643:14650 BC_INCREFS_DONE u0000000000000003 no match [ 414.825945] binder: 14643:14650 ERROR: BC_REGISTER_LOOPER called without request [ 414.825953] binder: 14643:14650 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.825962] binder: 14643:14650 Release 1 refcount change on invalid ref 0 ret -22 [ 414.958785] binder: BINDER_SET_CONTEXT_MGR already set [ 414.958794] binder: 14658:14664 ioctl 40046207 0 returned -16 [ 414.958889] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.958907] binder: 14658:14664 transaction failed 29189/-3, size 72-24 line 3136 [ 414.959593] binder: 14661:14665 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.959603] binder: 14661:14665 BC_INCREFS_DONE u0000000000000003 no match [ 414.959609] binder: 14661:14665 ERROR: BC_REGISTER_LOOPER called without request [ 414.959617] binder: 14661:14665 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.959626] binder: 14661:14665 Release 1 refcount change on invalid ref 0 ret -22 [ 415.023024] binder: 14671:14679 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.023033] binder: 14671:14679 BC_INCREFS_DONE u0000000000000003 no match [ 415.023039] binder: 14671:14679 ERROR: BC_REGISTER_LOOPER called without request [ 415.023047] binder: 14671:14679 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.023055] binder: 14671:14679 Release 1 refcount change on invalid ref 0 ret -22 [ 415.036888] binder: BINDER_SET_CONTEXT_MGR already set [ 415.036897] binder: 14678:14682 ioctl 40046207 0 returned -16 [ 415.046483] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.046504] binder: 14678:14682 transaction failed 29189/-3, size 72-24 line 3136 [ 415.082094] binder: 14684:14690 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.082104] binder: 14684:14690 BC_INCREFS_DONE u0000000000000003 no match [ 415.082109] binder: 14684:14690 ERROR: BC_REGISTER_LOOPER called without request [ 415.082120] binder: 14684:14690 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.082131] binder: 14684:14690 Release 1 refcount change on invalid ref 0 ret -22 [ 415.228533] binder: 14712:14713 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.228541] binder: 14712:14713 BC_INCREFS_DONE u0000000000000003 no match [ 415.228546] binder: 14712:14713 ERROR: BC_REGISTER_LOOPER called without request [ 415.228552] binder: 14712:14713 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.228560] binder: 14712:14713 Release 1 refcount change on invalid ref 0 ret -22 [ 415.228620] binder: BINDER_SET_CONTEXT_MGR already set [ 415.228629] binder: 14706:14715 ioctl 40046207 0 returned -16 [ 415.228732] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.228751] binder: 14706:14715 transaction failed 29189/-3, size 72-24 line 3136 [ 415.297924] binder: 14729:14736 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.297932] binder: 14729:14736 BC_INCREFS_DONE u0000000000000003 no match [ 415.297937] binder: 14729:14736 ERROR: BC_REGISTER_LOOPER called without request [ 415.297943] binder: 14729:14736 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.297954] binder: 14729:14736 Release 1 refcount change on invalid ref 0 ret -22 [ 415.310559] binder: BINDER_SET_CONTEXT_MGR already set [ 415.310567] binder: 14732:14737 ioctl 40046207 0 returned -16 [ 415.310663] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.310681] binder: 14732:14737 transaction failed 29189/-3, size 72-24 line 3136 [ 415.464194] binder: BINDER_SET_CONTEXT_MGR already set [ 415.464204] binder: 14746:14753 ioctl 40046207 0 returned -16 [ 415.464302] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.464321] binder: 14746:14753 transaction failed 29189/-3, size 72-24 line 3136 [ 415.469194] binder: 14749:14756 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.469203] binder: 14749:14756 BC_INCREFS_DONE u0000000000000003 no match [ 415.469209] binder: 14749:14756 ERROR: BC_REGISTER_LOOPER called without request [ 415.469216] binder: 14749:14756 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.469225] binder: 14749:14756 Release 1 refcount change on invalid ref 0 ret -22 [ 415.493633] binder: BINDER_SET_CONTEXT_MGR already set [ 415.493643] binder: 14760:14762 ioctl 40046207 0 returned -16 [ 415.493748] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.493767] binder: 14760:14762 transaction failed 29189/-3, size 72-24 line 3136 [ 415.526927] binder: 14763:14766 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.526936] binder: 14763:14766 BC_INCREFS_DONE u0000000000000003 no match [ 415.526942] binder: 14763:14766 ERROR: BC_REGISTER_LOOPER called without request [ 415.526950] binder: 14763:14766 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.526960] binder: 14763:14766 Release 1 refcount change on invalid ref 0 ret -22 [ 415.536567] binder: BINDER_SET_CONTEXT_MGR already set [ 415.536576] binder: 14768:14774 ioctl 40046207 0 returned -16 [ 415.536682] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.536702] binder: 14768:14774 transaction failed 29189/-3, size 72-24 line 3136 [ 415.730019] binder: 14791:14797 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.730029] binder: 14791:14797 BC_INCREFS_DONE u0000000000000003 no match [ 415.730035] binder: 14791:14797 ERROR: BC_REGISTER_LOOPER called without request [ 415.730043] binder: 14791:14797 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.730053] binder: 14791:14797 Release 1 refcount change on invalid ref 0 ret -22 [ 415.734572] binder: BINDER_SET_CONTEXT_MGR already set [ 415.734582] binder: 14790:14795 ioctl 40046207 0 returned -16 [ 415.734935] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.734955] binder: 14790:14795 transaction failed 29189/-3, size 72-24 line 3136 [ 415.761156] binder: 14802:14804 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.761165] binder: 14802:14804 BC_INCREFS_DONE u0000000000000003 no match [ 415.761171] binder: 14802:14804 ERROR: BC_REGISTER_LOOPER called without request [ 415.761180] binder: 14802:14804 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.761199] binder: 14802:14804 Release 1 refcount change on invalid ref 0 ret -22 [ 415.805675] binder: BINDER_SET_CONTEXT_MGR already set [ 415.805688] binder: 14809:14813 ioctl 40046207 0 returned -16 [ 415.806263] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.806282] binder: 14809:14813 transaction failed 29189/-3, size 72-24 line 3136 [ 415.812347] binder: 14812:14814 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.812357] binder: 14812:14814 BC_INCREFS_DONE u0000000000000003 no match [ 415.812362] binder: 14812:14814 ERROR: BC_REGISTER_LOOPER called without request [ 415.812371] binder: 14812:14814 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.812380] binder: 14812:14814 Release 1 refcount change on invalid ref 0 ret -22 [ 415.982992] binder: BINDER_SET_CONTEXT_MGR already set [ 415.983002] binder: 14833:14836 ioctl 40046207 0 returned -16 [ 415.983111] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.983130] binder: 14833:14836 transaction failed 29189/-3, size 72-24 line 3136 [ 416.005970] binder: BINDER_SET_CONTEXT_MGR already set [ 416.005978] binder: 14843:14847 ioctl 40046207 0 returned -16 [ 416.006072] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.006091] binder: 14843:14847 transaction failed 29189/-3, size 72-24 line 3136 [ 416.023537] binder: 14835:14842 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.023547] binder: 14835:14842 BC_INCREFS_DONE u0000000000000003 no match [ 416.023553] binder: 14835:14842 ERROR: BC_REGISTER_LOOPER called without request [ 416.023561] binder: 14835:14842 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.023573] binder: 14835:14842 Release 1 refcount change on invalid ref 0 ret -22 [ 416.091282] binder: BINDER_SET_CONTEXT_MGR already set [ 416.091291] binder: 14859:14863 ioctl 40046207 0 returned -16 [ 416.091394] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.091412] binder: 14859:14863 transaction failed 29189/-3, size 72-24 line 3136 [ 416.115902] binder: 14864:14870 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.115912] binder: 14864:14870 BC_INCREFS_DONE u0000000000000003 no match [ 416.115918] binder: 14864:14870 ERROR: BC_REGISTER_LOOPER called without request [ 416.115926] binder: 14864:14870 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.115936] binder: 14864:14870 Release 1 refcount change on invalid ref 0 ret -22 [ 416.254645] binder: 14882:14889 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.254655] binder: 14882:14889 BC_INCREFS_DONE u0000000000000003 no match [ 416.254661] binder: 14882:14889 ERROR: BC_REGISTER_LOOPER called without request [ 416.254669] binder: 14882:14889 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.254679] binder: 14882:14889 Release 1 refcount change on invalid ref 0 ret -22 [ 416.256702] binder: BINDER_SET_CONTEXT_MGR already set [ 416.256712] binder: 14881:14887 ioctl 40046207 0 returned -16 [ 416.257083] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.257106] binder: 14881:14887 transaction failed 29189/-3, size 72-24 line 3136 [ 416.308116] binder: 14893:14901 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.308127] binder: 14893:14901 BC_INCREFS_DONE u0000000000000003 no match [ 416.308133] binder: 14893:14901 ERROR: BC_REGISTER_LOOPER called without request [ 416.308142] binder: 14893:14901 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.308154] binder: 14893:14901 Release 1 refcount change on invalid ref 0 ret -22 [ 416.346622] binder: BINDER_SET_CONTEXT_MGR already set [ 416.346631] binder: 14897:14905 ioctl 40046207 0 returned -16 [ 416.346729] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.346748] binder: 14897:14905 transaction failed 29189/-3, size 72-24 line 3136 [ 416.360415] binder: 14906:14909 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.360425] binder: 14906:14909 BC_INCREFS_DONE u0000000000000003 no match [ 416.360431] binder: 14906:14909 ERROR: BC_REGISTER_LOOPER called without request [ 416.360447] binder: 14906:14909 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.360480] binder: 14906:14909 Release 1 refcount change on invalid ref 0 ret -22 [ 416.515347] binder: BINDER_SET_CONTEXT_MGR already set [ 416.515356] binder: 14924:14925 ioctl 40046207 0 returned -16 [ 416.515449] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.515466] binder: 14924:14925 transaction failed 29189/-3, size 72-24 line 3136 [ 416.532588] binder: 14927:14931 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.532598] binder: 14927:14931 BC_INCREFS_DONE u0000000000000003 no match [ 416.532604] binder: 14927:14931 ERROR: BC_REGISTER_LOOPER called without request [ 416.532612] binder: 14927:14931 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.532624] binder: 14927:14931 Release 1 refcount change on invalid ref 0 ret -22 [ 416.600176] binder: BINDER_SET_CONTEXT_MGR already set [ 416.600184] binder: 14937:14944 ioctl 40046207 0 returned -16 [ 416.600290] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.600309] binder: 14937:14944 transaction failed 29189/-3, size 72-24 line 3136 [ 416.648148] binder: BINDER_SET_CONTEXT_MGR already set [ 416.648156] binder: 14955:14959 ioctl 40046207 0 returned -16 [ 416.648304] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.648321] binder: 14955:14959 transaction failed 29189/-3, size 72-24 line 3136 [ 416.658819] binder: 14942:14957 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.658828] binder: 14942:14957 BC_INCREFS_DONE u0000000000000003 no match [ 416.658834] binder: 14942:14957 ERROR: BC_REGISTER_LOOPER called without request [ 416.658842] binder: 14942:14957 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.658853] binder: 14942:14957 Release 1 refcount change on invalid ref 0 ret -22 [ 416.817137] binder: 14971:14974 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.817146] binder: 14971:14974 BC_INCREFS_DONE u0000000000000003 no match [ 416.817152] binder: 14971:14974 ERROR: BC_REGISTER_LOOPER called without request [ 416.817160] binder: 14971:14974 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.817169] binder: 14971:14974 Release 1 refcount change on invalid ref 0 ret -22 [ 416.824229] binder: BINDER_SET_CONTEXT_MGR already set [ 416.824238] binder: 14970:14973 ioctl 40046207 0 returned -16 [ 416.824328] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.824347] binder: 14970:14973 transaction failed 29189/-3, size 72-24 line 3136 [ 416.894913] binder: BINDER_SET_CONTEXT_MGR already set [ 416.894922] binder: 14991:14996 ioctl 40046207 0 returned -16 [ 416.895091] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.895109] binder: 14991:14996 transaction failed 29189/-3, size 72-24 line 3136 [ 416.898378] binder: 14987:14994 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.898387] binder: 14987:14994 BC_INCREFS_DONE u0000000000000003 no match [ 416.898393] binder: 14987:14994 ERROR: BC_REGISTER_LOOPER called without request [ 416.898401] binder: 14987:14994 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.898411] binder: 14987:14994 Release 1 refcount change on invalid ref 0 ret -22 [ 416.946963] binder: 15001:15007 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.946972] binder: 15001:15007 BC_INCREFS_DONE u0000000000000003 no match [ 416.946977] binder: 15001:15007 ERROR: BC_REGISTER_LOOPER called without request [ 416.946985] binder: 15001:15007 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.946996] binder: 15001:15007 Release 1 refcount change on invalid ref 0 ret -22 [ 417.091049] binder: BINDER_SET_CONTEXT_MGR already set [ 417.091058] binder: 15014:15023 ioctl 40046207 0 returned -16 [ 417.091129] binder: 15015:15022 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.091138] binder: 15015:15022 BC_INCREFS_DONE u0000000000000003 no match [ 417.091142] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.091146] binder: 15015:15022 ERROR: BC_REGISTER_LOOPER called without request [ 417.091153] binder: 15015:15022 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.091161] binder: 15014:15023 transaction failed 29189/-3, size 72-24 line 3136 [ 417.091169] binder: 15015:15022 Release 1 refcount change on invalid ref 0 ret -22 [ 417.137607] binder: BINDER_SET_CONTEXT_MGR already set [ 417.137617] binder: 15028:15037 ioctl 40046207 0 returned -16 [ 417.137723] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.137742] binder: 15028:15037 transaction failed 29189/-3, size 72-24 line 3136 [ 417.151641] binder: 15039:15041 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.151650] binder: 15039:15041 BC_INCREFS_DONE u0000000000000003 no match [ 417.151655] binder: 15039:15041 ERROR: BC_REGISTER_LOOPER called without request [ 417.151663] binder: 15039:15041 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.151673] binder: 15039:15041 Release 1 refcount change on invalid ref 0 ret -22 [ 417.333597] binder: 15064:15068 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.333607] binder: 15064:15068 BC_INCREFS_DONE u0000000000000003 no match [ 417.333613] binder: 15064:15068 ERROR: BC_REGISTER_LOOPER called without request [ 417.333622] binder: 15064:15068 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.333631] binder: 15064:15068 Release 1 refcount change on invalid ref 0 ret -22 [ 417.339909] binder: BINDER_SET_CONTEXT_MGR already set [ 417.339923] binder: 15063:15067 ioctl 40046207 0 returned -16 [ 417.340022] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.340040] binder: 15063:15067 transaction failed 29189/-3, size 72-24 line 3136 [ 417.382890] binder: BINDER_SET_CONTEXT_MGR already set [ 417.382900] binder: 15076:15079 ioctl 40046207 0 returned -16 [ 417.383005] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.383023] binder: 15076:15079 transaction failed 29189/-3, size 72-24 line 3136 [ 417.393662] binder: 15072:15078 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.393673] binder: 15072:15078 BC_INCREFS_DONE u0000000000000003 no match [ 417.393680] binder: 15072:15078 ERROR: BC_REGISTER_LOOPER called without request [ 417.393717] binder: 15072:15078 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.393729] binder: 15072:15078 Release 1 refcount change on invalid ref 0 ret -22 [ 417.457881] binder: 15091:15098 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.457891] binder: 15091:15098 BC_INCREFS_DONE u0000000000000003 no match [ 417.457897] binder: 15091:15098 ERROR: BC_REGISTER_LOOPER called without request [ 417.457905] binder: 15091:15098 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.457914] binder: 15091:15098 Release 1 refcount change on invalid ref 0 ret -22 [ 417.563377] binder: BINDER_SET_CONTEXT_MGR already set [ 417.563385] binder: 15103:15108 ioctl 40046207 0 returned -16 [ 417.563783] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.563802] binder: 15103:15108 transaction failed 29189/-3, size 72-24 line 3136 [ 417.611360] binder: 15109:15120 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.611369] binder: 15109:15120 BC_INCREFS_DONE u0000000000000003 no match [ 417.611375] binder: 15109:15120 ERROR: BC_REGISTER_LOOPER called without request [ 417.611383] binder: 15109:15120 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.611392] binder: 15109:15120 Release 1 refcount change on invalid ref 0 ret -22 [ 417.615891] binder: BINDER_SET_CONTEXT_MGR already set [ 417.615899] binder: 15118:15123 ioctl 40046207 0 returned -16 [ 417.616006] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.616025] binder: 15118:15123 transaction failed 29189/-3, size 72-24 line 3136 [ 417.642305] binder: 15125:15128 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.642314] binder: 15125:15128 BC_INCREFS_DONE u0000000000000003 no match [ 417.642320] binder: 15125:15128 ERROR: BC_REGISTER_LOOPER called without request [ 417.642327] binder: 15125:15128 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.642337] binder: 15125:15128 Release 1 refcount change on invalid ref 0 ret -22 [ 417.655491] binder: BINDER_SET_CONTEXT_MGR already set [ 417.655499] binder: 15132:15135 ioctl 40046207 0 returned -16 [ 417.655624] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.655640] binder: 15132:15135 transaction failed 29189/-3, size 72-24 line 3136 [ 417.810452] binder: BINDER_SET_CONTEXT_MGR already set [ 417.810460] binder: 15148:15150 ioctl 40046207 0 returned -16 [ 417.810551] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.810571] binder: 15148:15150 transaction failed 29189/-3, size 72-24 line 3136 [ 417.837816] binder: BINDER_SET_CONTEXT_MGR already set [ 417.837824] binder: 15157:15160 ioctl 40046207 0 returned -16 [ 417.837911] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.837929] binder: 15157:15160 transaction failed 29189/-3, size 72-24 line 3136 [ 417.848028] binder: 15147:15158 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.848039] binder: 15147:15158 BC_INCREFS_DONE u0000000000000003 no match [ 417.848045] binder: 15147:15158 ERROR: BC_REGISTER_LOOPER called without request [ 417.848054] binder: 15147:15158 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.848064] binder: 15147:15158 Release 1 refcount change on invalid ref 0 ret -22 [ 417.884123] binder: 15166:15171 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.884132] binder: 15166:15171 BC_INCREFS_DONE u0000000000000003 no match [ 417.884137] binder: 15166:15171 ERROR: BC_REGISTER_LOOPER called without request [ 417.884146] binder: 15166:15171 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.884154] binder: 15166:15171 Release 1 refcount change on invalid ref 0 ret -22 [ 417.918323] binder: BINDER_SET_CONTEXT_MGR already set [ 417.918332] binder: 15167:15168 ioctl 40046207 0 returned -16 [ 417.918430] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.918449] binder: 15167:15168 transaction failed 29189/-3, size 72-24 line 3136 [ 418.081712] binder: 15188:15196 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.081722] binder: 15188:15196 BC_INCREFS_DONE u0000000000000003 no match [ 418.081728] binder: 15188:15196 ERROR: BC_REGISTER_LOOPER called without request [ 418.081736] binder: 15188:15196 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.081746] binder: 15188:15196 Release 1 refcount change on invalid ref 0 ret -22 [ 418.087154] binder: BINDER_SET_CONTEXT_MGR already set [ 418.087162] binder: 15192:15198 ioctl 40046207 0 returned -16 [ 418.087269] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.087288] binder: 15192:15198 transaction failed 29189/-3, size 72-24 line 3136 [ 418.108069] binder: BINDER_SET_CONTEXT_MGR already set [ 418.108078] binder: 15203:15204 ioctl 40046207 0 returned -16 [ 418.108164] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.108190] binder: 15203:15204 transaction failed 29189/-3, size 72-24 line 3136 [ 418.125753] binder: 15205:15206 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.125763] binder: 15205:15206 BC_INCREFS_DONE u0000000000000003 no match [ 418.125769] binder: 15205:15206 ERROR: BC_REGISTER_LOOPER called without request [ 418.125777] binder: 15205:15206 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.125788] binder: 15205:15206 Release 1 refcount change on invalid ref 0 ret -22 [ 418.152417] binder: BINDER_SET_CONTEXT_MGR already set [ 418.152426] binder: 15208:15216 ioctl 40046207 0 returned -16 [ 418.152519] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.152537] binder: 15208:15216 transaction failed 29189/-3, size 72-24 line 3136 [ 418.180002] binder: 15212:15217 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.180009] binder: 15212:15217 BC_INCREFS_DONE u0000000000000003 no match [ 418.180014] binder: 15212:15217 ERROR: BC_REGISTER_LOOPER called without request [ 418.180021] binder: 15212:15217 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.180030] binder: 15212:15217 Release 1 refcount change on invalid ref 0 ret -22 [ 418.355645] binder: BINDER_SET_CONTEXT_MGR already set [ 418.355654] binder: 15232:15238 ioctl 40046207 0 returned -16 [ 418.355763] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.355782] binder: 15232:15238 transaction failed 29189/-3, size 72-24 line 3136 [ 418.374760] binder: 15235:15236 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.374768] binder: 15235:15236 BC_INCREFS_DONE u0000000000000003 no match [ 418.374773] binder: 15235:15236 ERROR: BC_REGISTER_LOOPER called without request [ 418.374779] binder: 15235:15236 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.374787] binder: 15235:15236 Release 1 refcount change on invalid ref 0 ret -22 [ 418.410825] binder: 15252:15253 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.410835] binder: 15252:15253 BC_INCREFS_DONE u0000000000000003 no match [ 418.410841] binder: 15252:15253 ERROR: BC_REGISTER_LOOPER called without request [ 418.410849] binder: 15252:15253 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.410859] binder: 15252:15253 Release 1 refcount change on invalid ref 0 ret -22 [ 418.421973] binder: BINDER_SET_CONTEXT_MGR already set [ 418.421982] binder: 15247:15255 ioctl 40046207 0 returned -16 [ 418.422081] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.422100] binder: 15247:15255 transaction failed 29189/-3, size 72-24 line 3136 [ 418.458461] binder: 15261:15263 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.458470] binder: 15261:15263 BC_INCREFS_DONE u0000000000000003 no match [ 418.458475] binder: 15261:15263 ERROR: BC_REGISTER_LOOPER called without request [ 418.458497] binder: 15261:15263 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.458507] binder: 15261:15263 Release 1 refcount change on invalid ref 0 ret -22 [ 418.575500] binder: BINDER_SET_CONTEXT_MGR already set [ 418.575509] binder: 15272:15275 ioctl 40046207 0 returned -16 [ 418.575609] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.575630] binder: 15272:15275 transaction failed 29189/-3, size 72-24 line 3136 [ 418.582623] binder: 15276:15279 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.582633] binder: 15276:15279 BC_INCREFS_DONE u0000000000000003 no match [ 418.582639] binder: 15276:15279 ERROR: BC_REGISTER_LOOPER called without request [ 418.582647] binder: 15276:15279 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.582659] binder: 15276:15279 Release 1 refcount change on invalid ref 0 ret -22 [ 418.623207] binder: 15287:15289 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.623217] binder: 15287:15289 BC_INCREFS_DONE u0000000000000003 no match [ 418.623222] binder: 15287:15289 ERROR: BC_REGISTER_LOOPER called without request [ 418.623229] binder: 15287:15289 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.623238] binder: 15287:15289 Release 1 refcount change on invalid ref 0 ret -22 [ 418.657953] binder: BINDER_SET_CONTEXT_MGR already set [ 418.657961] binder: 15286:15291 ioctl 40046207 0 returned -16 [ 418.661170] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.661187] binder: 15286:15291 transaction failed 29189/-3, size 72-24 line 3136 [ 418.664773] binder: 15298:15299 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.664783] binder: 15298:15299 BC_INCREFS_DONE u0000000000000003 no match [ 418.664788] binder: 15298:15299 ERROR: BC_REGISTER_LOOPER called without request [ 418.664796] binder: 15298:15299 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.664806] binder: 15298:15299 Release 1 refcount change on invalid ref 0 ret -22 [ 418.846027] binder: BINDER_SET_CONTEXT_MGR already set [ 418.846035] binder: 15315:15321 ioctl 40046207 0 returned -16 [ 418.846136] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.846155] binder: 15315:15321 transaction failed 29189/-3, size 72-24 line 3136 [ 418.854570] binder: 15317:15322 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.854579] binder: 15317:15322 BC_INCREFS_DONE u0000000000000003 no match [ 418.854584] binder: 15317:15322 ERROR: BC_REGISTER_LOOPER called without request [ 418.854596] binder: 15317:15322 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.854604] binder: 15317:15322 Release 1 refcount change on invalid ref 0 ret -22 [ 418.880061] binder: BINDER_SET_CONTEXT_MGR already set [ 418.880069] binder: 15326:15327 ioctl 40046207 0 returned -16 [ 418.880166] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.880193] binder: 15326:15327 transaction failed 29189/-3, size 72-24 line 3136 [ 418.912429] binder: BINDER_SET_CONTEXT_MGR already set [ 418.912437] binder: 15331:15333 ioctl 40046207 0 returned -16 [ 418.912537] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.912555] binder: 15331:15333 transaction failed 29189/-3, size 72-24 line 3136 [ 418.924767] binder: 15332:15334 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.924777] binder: 15332:15334 BC_INCREFS_DONE u0000000000000003 no match [ 418.924782] binder: 15332:15334 ERROR: BC_REGISTER_LOOPER called without request [ 418.924789] binder: 15332:15334 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.924799] binder: 15332:15334 Release 1 refcount change on invalid ref 0 ret -22 [ 418.961709] binder: BINDER_SET_CONTEXT_MGR already set [ 418.961718] binder: 15340:15343 ioctl 40046207 0 returned -16 [ 418.961823] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.961842] binder: 15340:15343 transaction failed 29189/-3, size 72-24 line 3136 [ 418.966597] binder: 15341:15348 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.966608] binder: 15341:15348 BC_INCREFS_DONE u0000000000000003 no match [ 418.966614] binder: 15341:15348 ERROR: BC_REGISTER_LOOPER called without request [ 418.966623] binder: 15341:15348 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.966634] binder: 15341:15348 Release 1 refcount change on invalid ref 0 ret -22 [ 419.084029] binder: BINDER_SET_CONTEXT_MGR already set [ 419.084038] binder: 15355:15360 ioctl 40046207 0 returned -16 [ 419.084247] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.084266] binder: 15355:15360 transaction failed 29189/-3, size 72-24 line 3136 [ 419.109426] binder: 15358:15361 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.109435] binder: 15358:15361 BC_INCREFS_DONE u0000000000000003 no match [ 419.109441] binder: 15358:15361 ERROR: BC_REGISTER_LOOPER called without request [ 419.109449] binder: 15358:15361 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.109460] binder: 15358:15361 Release 1 refcount change on invalid ref 0 ret -22 [ 419.127556] binder: BINDER_SET_CONTEXT_MGR already set [ 419.127567] binder: 15365:15370 ioctl 40046207 0 returned -16 [ 419.127673] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.127691] binder: 15365:15370 transaction failed 29189/-3, size 72-24 line 3136 [ 419.167942] binder: BINDER_SET_CONTEXT_MGR already set [ 419.167951] binder: 15377:15383 ioctl 40046207 0 returned -16 [ 419.168040] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.168059] binder: 15377:15383 transaction failed 29189/-3, size 72-24 line 3136 [ 419.198874] binder: 15379:15386 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.198884] binder: 15379:15386 BC_INCREFS_DONE u0000000000000003 no match [ 419.198889] binder: 15379:15386 ERROR: BC_REGISTER_LOOPER called without request [ 419.198898] binder: 15379:15386 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.198910] binder: 15379:15386 Release 1 refcount change on invalid ref 0 ret -22 [ 419.447458] binder: 15395:15400 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.447468] binder: 15395:15400 BC_INCREFS_DONE u0000000000000003 no match [ 419.447474] binder: 15395:15400 ERROR: BC_REGISTER_LOOPER called without request [ 419.447482] binder: 15395:15400 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.447494] binder: 15395:15400 Release 1 refcount change on invalid ref 0 ret -22 [ 419.463613] binder: BINDER_SET_CONTEXT_MGR already set [ 419.463621] binder: 15401:15409 ioctl 40046207 0 returned -16 [ 419.469616] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.469634] binder: 15401:15409 transaction failed 29189/-3, size 72-24 line 3136 [ 419.527014] binder: BINDER_SET_CONTEXT_MGR already set [ 419.527023] binder: 15418:15424 ioctl 40046207 0 returned -16 [ 419.527117] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.527136] binder: 15418:15424 transaction failed 29189/-3, size 72-24 line 3136 [ 419.544842] binder: 15420:15426 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.544852] binder: 15420:15426 BC_INCREFS_DONE u0000000000000003 no match [ 419.544858] binder: 15420:15426 ERROR: BC_REGISTER_LOOPER called without request [ 419.544867] binder: 15420:15426 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.544877] binder: 15420:15426 Release 1 refcount change on invalid ref 0 ret -22 [ 419.552022] binder: BINDER_SET_CONTEXT_MGR already set [ 419.552030] binder: 15430:15432 ioctl 40046207 0 returned -16 [ 419.552118] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.552136] binder: 15430:15432 transaction failed 29189/-3, size 72-24 line 3136 [ 419.694038] binder: 15445:15449 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.694048] binder: 15445:15449 BC_INCREFS_DONE u0000000000000003 no match [ 419.694069] binder: 15445:15449 ERROR: BC_REGISTER_LOOPER called without request [ 419.694095] binder: 15445:15449 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.694105] binder: 15445:15449 Release 1 refcount change on invalid ref 0 ret -22 [ 419.730873] binder: BINDER_SET_CONTEXT_MGR already set [ 419.730882] binder: 15442:15452 ioctl 40046207 0 returned -16 [ 419.730979] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.731005] binder: 15442:15452 transaction failed 29189/-3, size 72-24 line 3136 [ 419.745719] binder: 15454:15460 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.745728] binder: 15454:15460 BC_INCREFS_DONE u0000000000000003 no match [ 419.745734] binder: 15454:15460 ERROR: BC_REGISTER_LOOPER called without request [ 419.745742] binder: 15454:15460 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.745753] binder: 15454:15460 Release 1 refcount change on invalid ref 0 ret -22 [ 419.783869] binder: BINDER_SET_CONTEXT_MGR already set [ 419.783878] binder: 15466:15473 ioctl 40046207 0 returned -16 [ 419.783987] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.784005] binder: 15466:15473 transaction failed 29189/-3, size 72-24 line 3136 [ 419.936294] binder: BINDER_SET_CONTEXT_MGR already set [ 419.936304] binder: 15483:15487 ioctl 40046207 0 returned -16 [ 419.936409] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.936430] binder: 15483:15487 transaction failed 29189/-3, size 72-24 line 3136 [ 419.939910] binder: 15485:15489 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.939921] binder: 15485:15489 BC_INCREFS_DONE u0000000000000003 no match [ 419.939927] binder: 15485:15489 ERROR: BC_REGISTER_LOOPER called without request [ 419.939936] binder: 15485:15489 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.939946] binder: 15485:15489 Release 1 refcount change on invalid ref 0 ret -22 [ 419.998682] binder: BINDER_SET_CONTEXT_MGR already set [ 419.998691] binder: 15495:15503 ioctl 40046207 0 returned -16 [ 419.998798] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.998818] binder: 15495:15503 transaction failed 29189/-3, size 72-24 line 3136 [ 420.005912] binder: 15501:15506 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.005921] binder: 15501:15506 BC_INCREFS_DONE u0000000000000003 no match [ 420.005927] binder: 15501:15506 ERROR: BC_REGISTER_LOOPER called without request [ 420.005935] binder: 15501:15506 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.005944] binder: 15501:15506 Release 1 refcount change on invalid ref 0 ret -22 [ 420.177610] binder: BINDER_SET_CONTEXT_MGR already set [ 420.177620] binder: 15527:15528 ioctl 40046207 0 returned -16 [ 420.177714] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.177735] binder: 15527:15528 transaction failed 29189/-3, size 72-24 line 3136 [ 420.199941] binder: 15521:15529 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.199951] binder: 15521:15529 BC_INCREFS_DONE u0000000000000003 no match [ 420.199957] binder: 15521:15529 ERROR: BC_REGISTER_LOOPER called without request [ 420.199966] binder: 15521:15529 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.199977] binder: 15521:15529 Release 1 refcount change on invalid ref 0 ret -22 [ 420.214456] binder: BINDER_SET_CONTEXT_MGR already set [ 420.214469] binder: 15534:15539 ioctl 40046207 0 returned -16 [ 420.214885] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.214903] binder: 15534:15539 transaction failed 29189/-3, size 72-24 line 3136 [ 420.238540] binder: BINDER_SET_CONTEXT_MGR already set [ 420.238549] binder: 15543:15544 ioctl 40046207 0 returned -16 [ 420.238639] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.238657] binder: 15543:15544 transaction failed 29189/-3, size 72-24 line 3136 [ 420.390863] binder: 15558:15560 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.390873] binder: 15558:15560 BC_INCREFS_DONE u0000000000000003 no match [ 420.390879] binder: 15558:15560 ERROR: BC_REGISTER_LOOPER called without request [ 420.390887] binder: 15558:15560 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.390896] binder: 15558:15560 Release 1 refcount change on invalid ref 0 ret -22 [ 420.424347] binder: 15571:15573 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.424356] binder: 15571:15573 BC_INCREFS_DONE u0000000000000003 no match [ 420.424362] binder: 15571:15573 ERROR: BC_REGISTER_LOOPER called without request [ 420.424369] binder: 15571:15573 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.424378] binder: 15571:15573 Release 1 refcount change on invalid ref 0 ret -22 [ 420.453328] binder: BINDER_SET_CONTEXT_MGR already set [ 420.453336] binder: 15559:15567 ioctl 40046207 0 returned -16 [ 420.453447] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.453466] binder: 15559:15567 transaction failed 29189/-3, size 72-24 line 3136 [ 420.454447] binder: 15574:15576 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.454456] binder: 15574:15576 BC_INCREFS_DONE u0000000000000003 no match [ 420.454470] binder: 15574:15576 ERROR: BC_REGISTER_LOOPER called without request [ 420.454611] binder: 15574:15576 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.454621] binder: 15574:15576 Release 1 refcount change on invalid ref 0 ret -22 [ 420.504418] binder: 15583:15589 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.504427] binder: 15583:15589 BC_INCREFS_DONE u0000000000000003 no match [ 420.504432] binder: 15583:15589 ERROR: BC_REGISTER_LOOPER called without request [ 420.504439] binder: 15583:15589 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.504448] binder: 15583:15589 Release 1 refcount change on invalid ref 0 ret -22 [ 420.651757] binder: BINDER_SET_CONTEXT_MGR already set [ 420.651768] binder: 15601:15604 ioctl 40046207 0 returned -16 [ 420.651864] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.651885] binder: 15601:15604 transaction failed 29189/-3, size 72-24 line 3136 [ 420.669304] binder: 15600:15607 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.669313] binder: 15600:15607 BC_INCREFS_DONE u0000000000000003 no match [ 420.669319] binder: 15600:15607 ERROR: BC_REGISTER_LOOPER called without request [ 420.669327] binder: 15600:15607 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.669338] binder: 15600:15607 Release 1 refcount change on invalid ref 0 ret -22 [ 420.713863] binder: BINDER_SET_CONTEXT_MGR already set [ 420.713879] binder: 15610:15612 ioctl 40046207 0 returned -16 [ 420.714048] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.714068] binder: 15610:15612 transaction failed 29189/-3, size 72-24 line 3136 [ 420.730904] binder: 15615:15623 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.730915] binder: 15615:15623 BC_INCREFS_DONE u0000000000000003 no match [ 420.730920] binder: 15615:15623 ERROR: BC_REGISTER_LOOPER called without request [ 420.730928] binder: 15615:15623 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.730938] binder: 15615:15623 Release 1 refcount change on invalid ref 0 ret -22 [ 420.890275] binder: 15639:15642 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.890285] binder: 15639:15642 BC_INCREFS_DONE u0000000000000003 no match [ 420.890291] binder: 15639:15642 ERROR: BC_REGISTER_LOOPER called without request [ 420.890300] binder: 15639:15642 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.890309] binder: 15639:15642 Release 1 refcount change on invalid ref 0 ret -22 [ 420.903471] binder: BINDER_SET_CONTEXT_MGR already set [ 420.903479] binder: 15641:15646 ioctl 40046207 0 returned -16 [ 420.903569] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.903589] binder: 15641:15646 transaction failed 29189/-3, size 72-24 line 3136 [ 420.941542] binder: BINDER_SET_CONTEXT_MGR already set [ 420.941550] binder: 15652:15653 ioctl 40046207 0 returned -16 [ 420.941653] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.941672] binder: 15652:15653 transaction failed 29189/-3, size 72-24 line 3136 [ 420.978069] binder: 15657:15660 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.978078] binder: 15657:15660 BC_INCREFS_DONE u0000000000000003 no match [ 420.978084] binder: 15657:15660 ERROR: BC_REGISTER_LOOPER called without request [ 420.978092] binder: 15657:15660 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.978102] binder: 15657:15660 Release 1 refcount change on invalid ref 0 ret -22 [ 420.991071] binder: BINDER_SET_CONTEXT_MGR already set [ 420.991079] binder: 15662:15664 ioctl 40046207 0 returned -16 [ 420.991167] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.991197] binder: 15662:15664 transaction failed 29189/-3, size 72-24 line 3136 [ 421.055839] binder: 15671:15678 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.055849] binder: 15671:15678 BC_INCREFS_DONE u0000000000000003 no match [ 421.055855] binder: 15671:15678 ERROR: BC_REGISTER_LOOPER called without request [ 421.055863] binder: 15671:15678 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.055873] binder: 15671:15678 Release 1 refcount change on invalid ref 0 ret -22 [ 421.165021] binder: 15682:15685 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.165030] binder: 15682:15685 BC_INCREFS_DONE u0000000000000003 no match [ 421.165035] binder: 15682:15685 ERROR: BC_REGISTER_LOOPER called without request [ 421.165043] binder: 15682:15685 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.165051] binder: 15682:15685 Release 1 refcount change on invalid ref 0 ret -22 [ 421.213813] binder: BINDER_SET_CONTEXT_MGR already set [ 421.213822] binder: 15686:15689 ioctl 40046207 0 returned -16 [ 421.213914] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.213934] binder: 15686:15689 transaction failed 29189/-3, size 72-24 line 3136 [ 421.251968] binder: BINDER_SET_CONTEXT_MGR already set [ 421.251977] binder: 15696:15699 ioctl 40046207 0 returned -16 [ 421.258838] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.258857] binder: 15696:15699 transaction failed 29189/-3, size 72-24 line 3136 [ 421.260333] binder: 15698:15700 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.260343] binder: 15698:15700 BC_INCREFS_DONE u0000000000000003 no match [ 421.260349] binder: 15698:15700 ERROR: BC_REGISTER_LOOPER called without request [ 421.260358] binder: 15698:15700 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.260369] binder: 15698:15700 Release 1 refcount change on invalid ref 0 ret -22 [ 421.310142] binder: BINDER_SET_CONTEXT_MGR already set [ 421.310151] binder: 15708:15714 ioctl 40046207 0 returned -16 [ 421.313669] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.313696] binder: 15708:15714 transaction failed 29189/-3, size 72-24 line 3136 [ 421.314456] binder: 15710:15716 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.314474] binder: 15710:15716 BC_INCREFS_DONE u0000000000000003 no match [ 421.314555] binder: 15710:15716 ERROR: BC_REGISTER_LOOPER called without request [ 421.314564] binder: 15710:15716 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.314574] binder: 15710:15716 Release 1 refcount change on invalid ref 0 ret -22 [ 421.458457] binder: 15729:15731 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.458466] binder: 15729:15731 BC_INCREFS_DONE u0000000000000003 no match [ 421.458472] binder: 15729:15731 ERROR: BC_REGISTER_LOOPER called without request [ 421.458481] binder: 15729:15731 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.458490] binder: 15729:15731 Release 1 refcount change on invalid ref 0 ret -22 [ 421.476614] binder: BINDER_SET_CONTEXT_MGR already set [ 421.476622] binder: 15727:15732 ioctl 40046207 0 returned -16 [ 421.476859] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.476877] binder: 15727:15732 transaction failed 29189/-3, size 72-24 line 3136 [ 421.550159] binder: 15751:15754 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.550170] binder: 15751:15754 BC_INCREFS_DONE u0000000000000003 no match [ 421.550175] binder: 15751:15754 ERROR: BC_REGISTER_LOOPER called without request [ 421.550195] binder: 15751:15754 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.550204] binder: 15751:15754 Release 1 refcount change on invalid ref 0 ret -22 [ 421.694284] binder: 15766:15768 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.694294] binder: 15766:15768 BC_INCREFS_DONE u0000000000000003 no match [ 421.694300] binder: 15766:15768 ERROR: BC_REGISTER_LOOPER called without request [ 421.694311] binder: 15766:15768 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.694323] binder: 15766:15768 Release 1 refcount change on invalid ref 0 ret -22 [ 421.699032] binder: BINDER_SET_CONTEXT_MGR already set [ 421.699042] binder: 15762:15770 ioctl 40046207 0 returned -16 [ 421.699152] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.699174] binder: 15762:15770 transaction failed 29189/-3, size 72-24 line 3136 [ 421.777755] binder: 15781:15786 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.777766] binder: 15781:15786 BC_INCREFS_DONE u0000000000000003 no match [ 421.777772] binder: 15781:15786 ERROR: BC_REGISTER_LOOPER called without request [ 421.777779] binder: 15781:15786 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.777791] binder: 15781:15786 Release 1 refcount change on invalid ref 0 ret -22 [ 421.778150] binder: BINDER_SET_CONTEXT_MGR already set [ 421.778169] binder: 15779:15787 ioctl 40046207 0 returned -16 [ 421.783796] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.783814] binder: 15779:15787 transaction failed 29189/-3, size 72-24 line 3136 [ 421.949810] binder: BINDER_SET_CONTEXT_MGR already set [ 421.949819] binder: 15807:15812 ioctl 40046207 0 returned -16 [ 421.949911] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.949931] binder: 15807:15812 transaction failed 29189/-3, size 72-24 line 3136 [ 421.979060] binder: 15806:15814 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.979069] binder: 15806:15814 BC_INCREFS_DONE u0000000000000003 no match [ 421.979075] binder: 15806:15814 ERROR: BC_REGISTER_LOOPER called without request [ 421.979083] binder: 15806:15814 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.979093] binder: 15806:15814 Release 1 refcount change on invalid ref 0 ret -22 [ 422.020158] binder: BINDER_SET_CONTEXT_MGR already set [ 422.020167] binder: 15820:15826 ioctl 40046207 0 returned -16 [ 422.020288] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.020307] binder: 15820:15826 transaction failed 29189/-3, size 72-24 line 3136 [ 422.021040] binder: 15822:15829 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.021049] binder: 15822:15829 BC_INCREFS_DONE u0000000000000003 no match [ 422.021054] binder: 15822:15829 ERROR: BC_REGISTER_LOOPER called without request [ 422.021062] binder: 15822:15829 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.021071] binder: 15822:15829 Release 1 refcount change on invalid ref 0 ret -22 [ 422.081393] binder: 15835:15841 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.081403] binder: 15835:15841 BC_INCREFS_DONE u0000000000000003 no match [ 422.081409] binder: 15835:15841 ERROR: BC_REGISTER_LOOPER called without request [ 422.081417] binder: 15835:15841 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.081429] binder: 15835:15841 Release 1 refcount change on invalid ref 0 ret -22 [ 422.101025] binder: BINDER_SET_CONTEXT_MGR already set [ 422.101034] binder: 15833:15845 ioctl 40046207 0 returned -16 [ 422.101123] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.101142] binder: 15833:15845 transaction failed 29189/-3, size 72-24 line 3136 [ 422.257892] binder: BINDER_SET_CONTEXT_MGR already set [ 422.257901] binder: 15867:15871 ioctl 40046207 0 returned -16 [ 422.257991] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.258010] binder: 15867:15871 transaction failed 29189/-3, size 72-24 line 3136 [ 422.286199] binder: 15866:15873 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.286208] binder: 15866:15873 BC_INCREFS_DONE u0000000000000003 no match [ 422.286214] binder: 15866:15873 ERROR: BC_REGISTER_LOOPER called without request [ 422.286223] binder: 15866:15873 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.286234] binder: 15866:15873 Release 1 refcount change on invalid ref 0 ret -22 [ 422.324167] binder: BINDER_SET_CONTEXT_MGR already set [ 422.324177] binder: 15880:15884 ioctl 40046207 0 returned -16 [ 422.324288] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.324308] binder: 15880:15884 transaction failed 29189/-3, size 72-24 line 3136 [ 422.349275] binder: 15886:15893 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.349284] binder: 15886:15893 BC_INCREFS_DONE u0000000000000003 no match [ 422.349290] binder: 15886:15893 ERROR: BC_REGISTER_LOOPER called without request [ 422.349298] binder: 15886:15893 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.349307] binder: 15886:15893 Release 1 refcount change on invalid ref 0 ret -22 [ 422.519143] binder: BINDER_SET_CONTEXT_MGR already set [ 422.519151] binder: 15909:15918 ioctl 40046207 0 returned -16 [ 422.519314] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.519332] binder: 15909:15918 transaction failed 29189/-3, size 72-24 line 3136 [ 422.534084] binder: 15914:15916 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.534095] binder: 15914:15916 BC_INCREFS_DONE u0000000000000003 no match [ 422.534101] binder: 15914:15916 ERROR: BC_REGISTER_LOOPER called without request [ 422.534110] binder: 15914:15916 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.534119] binder: 15914:15916 Release 1 refcount change on invalid ref 0 ret -22 [ 422.586753] binder: 15929:15936 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.586762] binder: 15929:15936 BC_INCREFS_DONE u0000000000000003 no match [ 422.586768] binder: 15929:15936 ERROR: BC_REGISTER_LOOPER called without request [ 422.586775] binder: 15929:15936 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.586786] binder: 15929:15936 Release 1 refcount change on invalid ref 0 ret -22 [ 422.599859] binder: BINDER_SET_CONTEXT_MGR already set [ 422.599868] binder: 15928:15937 ioctl 40046207 0 returned -16 [ 422.599978] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.599999] binder: 15928:15937 transaction failed 29189/-3, size 72-24 line 3136 [ 422.768810] binder: BINDER_SET_CONTEXT_MGR already set [ 422.768919] binder: 15956:15961 ioctl 40046207 0 returned -16 [ 422.769017] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.769038] binder: 15956:15961 transaction failed 29189/-3, size 72-24 line 3136 [ 422.784453] binder: 15954:15963 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.784470] binder: 15954:15963 BC_INCREFS_DONE u0000000000000003 no match [ 422.784506] binder: 15954:15963 ERROR: BC_REGISTER_LOOPER called without request [ 422.784514] binder: 15954:15963 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.784524] binder: 15954:15963 Release 1 refcount change on invalid ref 0 ret -22 [ 422.828226] binder: BINDER_SET_CONTEXT_MGR already set [ 422.828235] binder: 15972:15973 ioctl 40046207 0 returned -16 [ 422.828345] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.828379] binder: 15972:15973 transaction failed 29189/-3, size 72-24 line 3136 [ 422.862346] binder: BINDER_SET_CONTEXT_MGR already set [ 422.862354] binder: 15980:15981 ioctl 40046207 0 returned -16 [ 422.862454] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.862472] binder: 15980:15981 transaction failed 29189/-3, size 72-24 line 3136 [ 422.872093] binder: 15985:15986 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.872102] binder: 15985:15986 BC_INCREFS_DONE u0000000000000003 no match [ 422.872108] binder: 15985:15986 ERROR: BC_REGISTER_LOOPER called without request [ 422.872116] binder: 15985:15986 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.872127] binder: 15985:15986 Release 1 refcount change on invalid ref 0 ret -22 [ 423.017578] binder: 16000:16003 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.017588] binder: 16000:16003 BC_INCREFS_DONE u0000000000000003 no match [ 423.017594] binder: 16000:16003 ERROR: BC_REGISTER_LOOPER called without request [ 423.017602] binder: 16000:16003 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.017612] binder: 16000:16003 Release 1 refcount change on invalid ref 0 ret -22 [ 423.049755] binder: BINDER_SET_CONTEXT_MGR already set [ 423.049763] binder: 16001:16007 ioctl 40046207 0 returned -16 [ 423.049950] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.049968] binder: 16001:16007 transaction failed 29189/-3, size 72-24 line 3136 [ 423.050072] binder: 16010:16014 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.050082] binder: 16010:16014 BC_INCREFS_DONE u0000000000000003 no match [ 423.050088] binder: 16010:16014 ERROR: BC_REGISTER_LOOPER called without request [ 423.050096] binder: 16010:16014 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.050106] binder: 16010:16014 Release 1 refcount change on invalid ref 0 ret -22 [ 423.098180] binder: BINDER_SET_CONTEXT_MGR already set [ 423.098198] binder: 16018:16021 ioctl 40046207 0 returned -16 [ 423.098305] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.098324] binder: 16018:16021 transaction failed 29189/-3, size 72-24 line 3136 [ 423.123225] binder: 16017:16023 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.123235] binder: 16017:16023 BC_INCREFS_DONE u0000000000000003 no match [ 423.123241] binder: 16017:16023 ERROR: BC_REGISTER_LOOPER called without request [ 423.123249] binder: 16017:16023 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.123260] binder: 16017:16023 Release 1 refcount change on invalid ref 0 ret -22 [ 423.319027] binder: BINDER_SET_CONTEXT_MGR already set [ 423.319035] binder: 16035:16041 ioctl 40046207 0 returned -16 [ 423.319297] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.319315] binder: 16035:16041 transaction failed 29189/-3, size 72-24 line 3136 [ 423.322572] binder: 16038:16044 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.322582] binder: 16038:16044 BC_INCREFS_DONE u0000000000000003 no match [ 423.322587] binder: 16038:16044 ERROR: BC_REGISTER_LOOPER called without request [ 423.322596] binder: 16038:16044 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.322605] binder: 16038:16044 Release 1 refcount change on invalid ref 0 ret -22 [ 423.391160] binder: 16053:16058 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.391170] binder: 16053:16058 BC_INCREFS_DONE u0000000000000003 no match [ 423.391176] binder: 16053:16058 ERROR: BC_REGISTER_LOOPER called without request [ 423.391192] binder: 16053:16058 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.391204] binder: 16053:16058 Release 1 refcount change on invalid ref 0 ret -22 [ 423.402944] binder: BINDER_SET_CONTEXT_MGR already set [ 423.402954] binder: 16060:16064 ioctl 40046207 0 returned -16 [ 423.404015] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.404034] binder: 16060:16064 transaction failed 29189/-3, size 72-24 line 3136 [ 423.590617] binder: BINDER_SET_CONTEXT_MGR already set [ 423.590625] binder: 16083:16089 ioctl 40046207 0 returned -16 [ 423.590804] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.590824] binder: 16083:16089 transaction failed 29189/-3, size 72-24 line 3136 [ 423.597757] binder: 16081:16091 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.597766] binder: 16081:16091 BC_INCREFS_DONE u0000000000000003 no match [ 423.597772] binder: 16081:16091 ERROR: BC_REGISTER_LOOPER called without request [ 423.597781] binder: 16081:16091 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.597792] binder: 16081:16091 Release 1 refcount change on invalid ref 0 ret -22 [ 423.626009] binder: BINDER_SET_CONTEXT_MGR already set [ 423.626018] binder: 16094:16098 ioctl 40046207 0 returned -16 [ 423.626125] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.626160] binder: 16094:16098 transaction failed 29189/-3, size 72-24 line 3136 [ 423.631314] binder: 16097:16100 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.631323] binder: 16097:16100 BC_INCREFS_DONE u0000000000000003 no match [ 423.631329] binder: 16097:16100 ERROR: BC_REGISTER_LOOPER called without request [ 423.631338] binder: 16097:16100 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.631347] binder: 16097:16100 Release 1 refcount change on invalid ref 0 ret -22 [ 423.673321] binder: BINDER_SET_CONTEXT_MGR already set [ 423.673330] binder: 16108:16110 ioctl 40046207 0 returned -16 [ 423.673437] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.673456] binder: 16108:16110 transaction failed 29189/-3, size 72-24 line 3136 [ 423.689531] binder: 16112:16115 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.689541] binder: 16112:16115 BC_INCREFS_DONE u0000000000000003 no match [ 423.689547] binder: 16112:16115 ERROR: BC_REGISTER_LOOPER called without request [ 423.689556] binder: 16112:16115 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.689568] binder: 16112:16115 Release 1 refcount change on invalid ref 0 ret -22 [ 423.837275] binder: BINDER_SET_CONTEXT_MGR already set [ 423.837283] binder: 16125:16129 ioctl 40046207 0 returned -16 [ 423.837386] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.837405] binder: 16125:16129 transaction failed 29189/-3, size 72-24 line 3136 [ 423.843855] binder: 16126:16134 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.843865] binder: 16126:16134 BC_INCREFS_DONE u0000000000000003 no match [ 423.843870] binder: 16126:16134 ERROR: BC_REGISTER_LOOPER called without request [ 423.843878] binder: 16126:16134 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.843889] binder: 16126:16134 Release 1 refcount change on invalid ref 0 ret -22 [ 423.882792] binder: 16141:16144 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.882801] binder: 16141:16144 BC_INCREFS_DONE u0000000000000003 no match [ 423.882807] binder: 16141:16144 ERROR: BC_REGISTER_LOOPER called without request [ 423.882815] binder: 16141:16144 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.882823] binder: 16141:16144 Release 1 refcount change on invalid ref 0 ret -22 [ 423.921683] binder: BINDER_SET_CONTEXT_MGR already set [ 423.921692] binder: 16142:16151 ioctl 40046207 0 returned -16 [ 423.921795] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.921814] binder: 16142:16151 transaction failed 29189/-3, size 72-24 line 3136 [ 423.927362] binder: 16148:16153 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.927371] binder: 16148:16153 BC_INCREFS_DONE u0000000000000003 no match [ 423.927377] binder: 16148:16153 ERROR: BC_REGISTER_LOOPER called without request [ 423.927400] binder: 16148:16153 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.927408] binder: 16148:16153 Release 1 refcount change on invalid ref 0 ret -22 [ 424.090251] binder: 16168:16173 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.090260] binder: 16168:16173 BC_INCREFS_DONE u0000000000000003 no match [ 424.090266] binder: 16168:16173 ERROR: BC_REGISTER_LOOPER called without request [ 424.090274] binder: 16168:16173 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.090283] binder: 16168:16173 Release 1 refcount change on invalid ref 0 ret -22 [ 424.141840] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.141859] binder: 16166:16175 transaction failed 29189/-3, size 72-24 line 3136 [ 424.141939] binder: 16180:16186 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.141947] binder: 16180:16186 BC_INCREFS_DONE u0000000000000003 no match [ 424.141953] binder: 16180:16186 ERROR: BC_REGISTER_LOOPER called without request [ 424.141961] binder: 16180:16186 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.141972] binder: 16180:16186 Release 1 refcount change on invalid ref 0 ret -22 [ 424.189181] binder: 16192:16196 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.189200] binder: 16192:16196 BC_INCREFS_DONE u0000000000000003 no match [ 424.189205] binder: 16192:16196 ERROR: BC_REGISTER_LOOPER called without request [ 424.189213] binder: 16192:16196 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.189223] binder: 16192:16196 Release 1 refcount change on invalid ref 0 ret -22 [ 424.330320] binder: BINDER_SET_CONTEXT_MGR already set [ 424.330329] binder: 16211:16214 ioctl 40046207 0 returned -16 [ 424.334228] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.334247] binder: 16211:16214 transaction failed 29189/-3, size 72-24 line 3136 [ 424.337768] binder: 16213:16217 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.337777] binder: 16213:16217 BC_INCREFS_DONE u0000000000000003 no match [ 424.337783] binder: 16213:16217 ERROR: BC_REGISTER_LOOPER called without request [ 424.337791] binder: 16213:16217 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.337800] binder: 16213:16217 Release 1 refcount change on invalid ref 0 ret -22 [ 424.357972] binder: 16222:16224 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.357983] binder: 16222:16224 BC_INCREFS_DONE u0000000000000003 no match [ 424.357989] binder: 16222:16224 ERROR: BC_REGISTER_LOOPER called without request [ 424.357997] binder: 16222:16224 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.358007] binder: 16222:16224 Release 1 refcount change on invalid ref 0 ret -22 [ 424.381838] binder: 16225:16228 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.381847] binder: 16225:16228 BC_INCREFS_DONE u0000000000000003 no match [ 424.381853] binder: 16225:16228 ERROR: BC_REGISTER_LOOPER called without request [ 424.381861] binder: 16225:16228 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.381872] binder: 16225:16228 Release 1 refcount change on invalid ref 0 ret -22 [ 424.420599] binder: BINDER_SET_CONTEXT_MGR already set [ 424.420607] binder: 16231:16237 ioctl 40046207 0 returned -16 [ 424.420697] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.420715] binder: 16231:16237 transaction failed 29189/-3, size 72-24 line 3136 [ 424.584128] binder: 16248:16254 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.584138] binder: 16248:16254 BC_INCREFS_DONE u0000000000000003 no match [ 424.584143] binder: 16248:16254 ERROR: BC_REGISTER_LOOPER called without request [ 424.584152] binder: 16248:16254 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.584161] binder: 16248:16254 Release 1 refcount change on invalid ref 0 ret -22 [ 424.593849] binder: BINDER_SET_CONTEXT_MGR already set [ 424.593858] binder: 16251:16253 ioctl 40046207 0 returned -16 [ 424.593954] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.593972] binder: 16251:16253 transaction failed 29189/-3, size 72-24 line 3136 [ 424.638908] binder: BINDER_SET_CONTEXT_MGR already set [ 424.638917] binder: 16266:16268 ioctl 40046207 0 returned -16 [ 424.639021] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.639040] binder: 16266:16268 transaction failed 29189/-3, size 72-24 line 3136 [ 424.651308] binder: 16263:16267 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.651318] binder: 16263:16267 BC_INCREFS_DONE u0000000000000003 no match [ 424.651323] binder: 16263:16267 ERROR: BC_REGISTER_LOOPER called without request [ 424.651332] binder: 16263:16267 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.651341] binder: 16263:16267 Release 1 refcount change on invalid ref 0 ret -22 [ 424.828903] binder: BINDER_SET_CONTEXT_MGR already set [ 424.828912] binder: 16289:16295 ioctl 40046207 0 returned -16 [ 424.829007] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.829025] binder: 16289:16295 transaction failed 29189/-3, size 72-24 line 3136 [ 424.829355] binder: 16291:16297 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.829364] binder: 16291:16297 BC_INCREFS_DONE u0000000000000003 no match [ 424.829370] binder: 16291:16297 ERROR: BC_REGISTER_LOOPER called without request [ 424.829378] binder: 16291:16297 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.829387] binder: 16291:16297 Release 1 refcount change on invalid ref 0 ret -22 [ 424.901650] binder: 16310:16317 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.901659] binder: 16310:16317 BC_INCREFS_DONE u0000000000000003 no match [ 424.901664] binder: 16310:16317 ERROR: BC_REGISTER_LOOPER called without request [ 424.901672] binder: 16310:16317 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.901682] binder: 16310:16317 Release 1 refcount change on invalid ref 0 ret -22 [ 424.912456] binder: BINDER_SET_CONTEXT_MGR already set [ 424.912466] binder: 16313:16320 ioctl 40046207 0 returned -16 [ 424.912569] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.912590] binder: 16313:16320 transaction failed 29189/-3, size 72-24 line 3136 [ 425.086154] binder: 16336:16343 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.086164] binder: 16336:16343 BC_INCREFS_DONE u0000000000000003 no match [ 425.086169] binder: 16336:16343 ERROR: BC_REGISTER_LOOPER called without request [ 425.086177] binder: 16336:16343 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.086194] binder: 16336:16343 Release 1 refcount change on invalid ref 0 ret -22 [ 425.090467] binder: BINDER_SET_CONTEXT_MGR already set [ 425.090476] binder: 16337:16340 ioctl 40046207 0 returned -16 [ 425.090603] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.090622] binder: 16337:16340 transaction failed 29189/-3, size 72-24 line 3136 [ 425.144069] binder: 16352:16354 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.144079] binder: 16352:16354 BC_INCREFS_DONE u0000000000000003 no match [ 425.144085] binder: 16352:16354 ERROR: BC_REGISTER_LOOPER called without request [ 425.144093] binder: 16352:16354 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.144103] binder: 16352:16354 Release 1 refcount change on invalid ref 0 ret -22 [ 425.183174] binder: BINDER_SET_CONTEXT_MGR already set [ 425.183184] binder: 16359:16367 ioctl 40046207 0 returned -16 [ 425.183798] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.183820] binder: 16359:16367 transaction failed 29189/-3, size 72-24 line 3136 [ 425.228515] binder: 16365:16374 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.228524] binder: 16365:16374 BC_INCREFS_DONE u0000000000000003 no match [ 425.228529] binder: 16365:16374 ERROR: BC_REGISTER_LOOPER called without request [ 425.228537] binder: 16365:16374 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.228546] binder: 16365:16374 Release 1 refcount change on invalid ref 0 ret -22 [ 425.338145] binder: BINDER_SET_CONTEXT_MGR already set [ 425.338155] binder: 16387:16390 ioctl 40046207 0 returned -16 [ 425.338252] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.338271] binder: 16387:16390 transaction failed 29189/-3, size 72-24 line 3136 [ 425.342782] binder: 16388:16389 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.342791] binder: 16388:16389 BC_INCREFS_DONE u0000000000000003 no match [ 425.342797] binder: 16388:16389 ERROR: BC_REGISTER_LOOPER called without request [ 425.342805] binder: 16388:16389 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.342815] binder: 16388:16389 Release 1 refcount change on invalid ref 0 ret -22 [ 425.392855] binder: 16396:16404 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.392865] binder: 16396:16404 BC_INCREFS_DONE u0000000000000003 no match [ 425.392870] binder: 16396:16404 ERROR: BC_REGISTER_LOOPER called without request [ 425.392878] binder: 16396:16404 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.392889] binder: 16396:16404 Release 1 refcount change on invalid ref 0 ret -22 [ 425.395121] binder: BINDER_SET_CONTEXT_MGR already set [ 425.395129] binder: 16397:16405 ioctl 40046207 0 returned -16 [ 425.395238] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.395257] binder: 16397:16405 transaction failed 29189/-3, size 72-24 line 3136 [ 425.442561] binder: 16411:16416 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.442570] binder: 16411:16416 BC_INCREFS_DONE u0000000000000003 no match [ 425.442576] binder: 16411:16416 ERROR: BC_REGISTER_LOOPER called without request [ 425.442584] binder: 16411:16416 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.442593] binder: 16411:16416 Release 1 refcount change on invalid ref 0 ret -22 [ 425.586762] binder: BINDER_SET_CONTEXT_MGR already set [ 425.586771] binder: 16428:16432 ioctl 40046207 0 returned -16 [ 425.589979] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.589999] binder: 16428:16432 transaction failed 29189/-3, size 72-24 line 3136 [ 425.595450] binder: 16429:16434 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.595459] binder: 16429:16434 BC_INCREFS_DONE u0000000000000003 no match [ 425.595464] binder: 16429:16434 ERROR: BC_REGISTER_LOOPER called without request [ 425.595472] binder: 16429:16434 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.595480] binder: 16429:16434 Release 1 refcount change on invalid ref 0 ret -22 [ 425.645991] binder: 16444:16446 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.646001] binder: 16444:16446 BC_INCREFS_DONE u0000000000000003 no match [ 425.646006] binder: 16444:16446 ERROR: BC_REGISTER_LOOPER called without request [ 425.646015] binder: 16444:16446 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.646024] binder: 16444:16446 Release 1 refcount change on invalid ref 0 ret -22 [ 425.669883] binder: BINDER_SET_CONTEXT_MGR already set [ 425.669900] binder: 16443:16450 ioctl 40046207 0 returned -16 [ 425.671210] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.671232] binder: 16443:16450 transaction failed 29189/-3, size 72-24 line 3136 [ 425.835804] binder: BINDER_SET_CONTEXT_MGR already set [ 425.835813] binder: 16473:16475 ioctl 40046207 0 returned -16 [ 425.835903] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.835922] binder: 16473:16475 transaction failed 29189/-3, size 72-24 line 3136 [ 425.861299] binder: 16471:16478 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.861308] binder: 16471:16478 BC_INCREFS_DONE u0000000000000003 no match [ 425.861313] binder: 16471:16478 ERROR: BC_REGISTER_LOOPER called without request [ 425.861321] binder: 16471:16478 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.861348] binder: 16471:16478 Release 1 refcount change on invalid ref 0 ret -22 [ 425.871669] binder: BINDER_SET_CONTEXT_MGR already set [ 425.871677] binder: 16483:16485 ioctl 40046207 0 returned -16 [ 425.871786] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.871805] binder: 16483:16485 transaction failed 29189/-3, size 72-24 line 3136 [ 425.919153] binder: BINDER_SET_CONTEXT_MGR already set [ 425.919162] binder: 16494:16498 ioctl 40046207 0 returned -16 [ 425.919385] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.919402] binder: 16494:16498 transaction failed 29189/-3, size 72-24 line 3136 [ 425.936284] binder: 16495:16499 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.936294] binder: 16495:16499 BC_INCREFS_DONE u0000000000000003 no match [ 425.936299] binder: 16495:16499 ERROR: BC_REGISTER_LOOPER called without request [ 425.936307] binder: 16495:16499 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.936316] binder: 16495:16499 Release 1 refcount change on invalid ref 0 ret -22 [ 426.082793] binder: BINDER_SET_CONTEXT_MGR already set [ 426.082802] binder: 16514:16516 ioctl 40046207 0 returned -16 [ 426.082897] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.082916] binder: 16514:16516 transaction failed 29189/-3, size 72-24 line 3136 [ 426.112446] binder: 16512:16518 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.112456] binder: 16512:16518 BC_INCREFS_DONE u0000000000000003 no match [ 426.112461] binder: 16512:16518 ERROR: BC_REGISTER_LOOPER called without request [ 426.112469] binder: 16512:16518 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.112479] binder: 16512:16518 Release 1 refcount change on invalid ref 0 ret -22 [ 426.137503] binder: BINDER_SET_CONTEXT_MGR already set [ 426.137511] binder: 16527:16533 ioctl 40046207 0 returned -16 [ 426.137617] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.137635] binder: 16527:16533 transaction failed 29189/-3, size 72-24 line 3136 [ 426.168011] binder: BINDER_SET_CONTEXT_MGR already set [ 426.168021] binder: 16537:16540 ioctl 40046207 0 returned -16 [ 426.168125] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.168143] binder: 16537:16540 transaction failed 29189/-3, size 72-24 line 3136 [ 426.172225] binder: 16539:16542 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.172234] binder: 16539:16542 BC_INCREFS_DONE u0000000000000003 no match [ 426.172239] binder: 16539:16542 ERROR: BC_REGISTER_LOOPER called without request [ 426.172247] binder: 16539:16542 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.172256] binder: 16539:16542 Release 1 refcount change on invalid ref 0 ret -22 [ 426.323530] binder: BINDER_SET_CONTEXT_MGR already set [ 426.323538] binder: 16554:16559 ioctl 40046207 0 returned -16 [ 426.324072] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.324093] binder: 16554:16559 transaction failed 29189/-3, size 72-24 line 3136 [ 426.344199] binder: 16555:16560 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.344213] binder: 16555:16560 BC_INCREFS_DONE u0000000000000003 no match [ 426.344219] binder: 16555:16560 ERROR: BC_REGISTER_LOOPER called without request [ 426.344228] binder: 16555:16560 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.344237] binder: 16555:16560 Release 1 refcount change on invalid ref 0 ret -22 [ 426.393568] binder: 16567:16576 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.393577] binder: 16567:16576 BC_INCREFS_DONE u0000000000000003 no match [ 426.393583] binder: 16567:16576 ERROR: BC_REGISTER_LOOPER called without request [ 426.393591] binder: 16567:16576 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.393600] binder: 16567:16576 Release 1 refcount change on invalid ref 0 ret -22 [ 426.410451] binder: BINDER_SET_CONTEXT_MGR already set [ 426.410460] binder: 16569:16571 ioctl 40046207 0 returned -16 [ 426.410557] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.410576] binder: 16569:16571 transaction failed 29189/-3, size 72-24 line 3136 [ 426.434073] binder: 16581:16584 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.434082] binder: 16581:16584 BC_INCREFS_DONE u0000000000000003 no match [ 426.434087] binder: 16581:16584 ERROR: BC_REGISTER_LOOPER called without request [ 426.434095] binder: 16581:16584 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.434107] binder: 16581:16584 Release 1 refcount change on invalid ref 0 ret -22 [ 426.548599] binder: 16595:16599 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.548609] binder: 16595:16599 BC_INCREFS_DONE u0000000000000003 no match [ 426.548614] binder: 16595:16599 ERROR: BC_REGISTER_LOOPER called without request [ 426.548622] binder: 16595:16599 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.548632] binder: 16595:16599 Release 1 refcount change on invalid ref 0 ret -22 [ 426.555812] binder: BINDER_SET_CONTEXT_MGR already set [ 426.555821] binder: 16592:16598 ioctl 40046207 0 returned -16 [ 426.555951] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.555970] binder: 16592:16598 transaction failed 29189/-3, size 72-24 line 3136 [ 426.630240] binder: BINDER_SET_CONTEXT_MGR already set [ 426.630250] binder: 16609:16616 ioctl 40046207 0 returned -16 [ 426.630358] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.630378] binder: 16609:16616 transaction failed 29189/-3, size 72-24 line 3136 [ 426.667250] binder: 16615:16618 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.667259] binder: 16615:16618 BC_INCREFS_DONE u0000000000000003 no match [ 426.667264] binder: 16615:16618 ERROR: BC_REGISTER_LOOPER called without request [ 426.667273] binder: 16615:16618 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.667284] binder: 16615:16618 Release 1 refcount change on invalid ref 0 ret -22 [ 426.697655] binder: BINDER_SET_CONTEXT_MGR already set [ 426.697870] binder: 16627:16633 ioctl 40046207 0 returned -16 [ 426.697973] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.697992] binder: 16627:16633 transaction failed 29189/-3, size 72-24 line 3136 [ 426.818378] binder: BINDER_SET_CONTEXT_MGR already set [ 426.818387] binder: 16644:16647 ioctl 40046207 0 returned -16 [ 426.818480] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.818498] binder: 16644:16647 transaction failed 29189/-3, size 72-24 line 3136 [ 426.823708] binder: 16639:16648 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.823717] binder: 16639:16648 BC_INCREFS_DONE u0000000000000003 no match [ 426.823723] binder: 16639:16648 ERROR: BC_REGISTER_LOOPER called without request [ 426.823731] binder: 16639:16648 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.823740] binder: 16639:16648 Release 1 refcount change on invalid ref 0 ret -22 [ 426.872560] binder: BINDER_SET_CONTEXT_MGR already set [ 426.872569] binder: 16651:16657 ioctl 40046207 0 returned -16 [ 426.872663] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.872682] binder: 16651:16657 transaction failed 29189/-3, size 72-24 line 3136 [ 426.906011] binder: 16661:16665 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.906020] binder: 16661:16665 BC_INCREFS_DONE u0000000000000003 no match [ 426.906026] binder: 16661:16665 ERROR: BC_REGISTER_LOOPER called without request [ 426.906034] binder: 16661:16665 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.906044] binder: 16661:16665 Release 1 refcount change on invalid ref 0 ret -22 [ 427.066171] binder: BINDER_SET_CONTEXT_MGR already set [ 427.066179] binder: 16679:16682 ioctl 40046207 0 returned -16 [ 427.066269] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.066287] binder: 16679:16682 transaction failed 29189/-3, size 72-24 line 3136 [ 427.069443] binder: 16678:16686 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.069454] binder: 16678:16686 BC_INCREFS_DONE u0000000000000003 no match [ 427.069461] binder: 16678:16686 ERROR: BC_REGISTER_LOOPER called without request [ 427.069470] binder: 16678:16686 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.069480] binder: 16678:16686 Release 1 refcount change on invalid ref 0 ret -22 [ 427.134670] binder: 16696:16698 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.134680] binder: 16696:16698 BC_INCREFS_DONE u0000000000000003 no match [ 427.134685] binder: 16696:16698 ERROR: BC_REGISTER_LOOPER called without request [ 427.134693] binder: 16696:16698 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.134705] binder: 16696:16698 Release 1 refcount change on invalid ref 0 ret -22 [ 427.159489] binder: BINDER_SET_CONTEXT_MGR already set [ 427.159498] binder: 16699:16703 ioctl 40046207 0 returned -16 [ 427.159591] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.159610] binder: 16699:16703 transaction failed 29189/-3, size 72-24 line 3136 [ 427.178934] binder: 16709:16711 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.178944] binder: 16709:16711 BC_INCREFS_DONE u0000000000000003 no match [ 427.178950] binder: 16709:16711 ERROR: BC_REGISTER_LOOPER called without request [ 427.178958] binder: 16709:16711 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.178968] binder: 16709:16711 Release 1 refcount change on invalid ref 0 ret -22 [ 427.301972] binder: BINDER_SET_CONTEXT_MGR already set [ 427.301983] binder: 16720:16724 ioctl 40046207 0 returned -16 [ 427.302191] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.302212] binder: 16720:16724 transaction failed 29189/-3, size 72-24 line 3136 [ 427.304390] binder: 16721:16726 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.304399] binder: 16721:16726 BC_INCREFS_DONE u0000000000000003 no match [ 427.304405] binder: 16721:16726 ERROR: BC_REGISTER_LOOPER called without request [ 427.304413] binder: 16721:16726 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.304422] binder: 16721:16726 Release 1 refcount change on invalid ref 0 ret -22 [ 427.358013] binder: BINDER_SET_CONTEXT_MGR already set [ 427.358022] binder: 16736:16740 ioctl 40046207 0 returned -16 [ 427.361377] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.361398] binder: 16736:16740 transaction failed 29189/-3, size 72-24 line 3136 [ 427.375123] binder: 16739:16746 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.375133] binder: 16739:16746 BC_INCREFS_DONE u0000000000000003 no match [ 427.375139] binder: 16739:16746 ERROR: BC_REGISTER_LOOPER called without request [ 427.375147] binder: 16739:16746 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.375158] binder: 16739:16746 Release 1 refcount change on invalid ref 0 ret -22 [ 427.540474] binder: 16762:16771 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.540484] binder: 16762:16771 BC_INCREFS_DONE u0000000000000003 no match [ 427.540489] binder: 16762:16771 ERROR: BC_REGISTER_LOOPER called without request [ 427.540497] binder: 16762:16771 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.540508] binder: 16762:16771 Release 1 refcount change on invalid ref 0 ret -22 [ 427.576606] binder: BINDER_SET_CONTEXT_MGR already set [ 427.576614] binder: 16764:16774 ioctl 40046207 0 returned -16 [ 427.576770] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.576790] binder: 16764:16774 transaction failed 29189/-3, size 72-24 line 3136 [ 427.601063] binder: 16782:16787 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.601073] binder: 16782:16787 BC_INCREFS_DONE u0000000000000003 no match [ 427.601079] binder: 16782:16787 ERROR: BC_REGISTER_LOOPER called without request [ 427.601087] binder: 16782:16787 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.601098] binder: 16782:16787 Release 1 refcount change on invalid ref 0 ret -22 [ 427.641317] binder: BINDER_SET_CONTEXT_MGR already set [ 427.641326] binder: 16791:16792 ioctl 40046207 0 returned -16 [ 427.641416] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.641435] binder: 16791:16792 transaction failed 29189/-3, size 72-24 line 3136 [ 427.779462] binder: BINDER_SET_CONTEXT_MGR already set [ 427.779471] binder: 16809:16814 ioctl 40046207 0 returned -16 [ 427.779573] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.779592] binder: 16809:16814 transaction failed 29189/-3, size 72-24 line 3136 [ 427.806748] binder: 16806:16812 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.806758] binder: 16806:16812 BC_INCREFS_DONE u0000000000000003 no match [ 427.806764] binder: 16806:16812 ERROR: BC_REGISTER_LOOPER called without request [ 427.806772] binder: 16806:16812 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.806782] binder: 16806:16812 Release 1 refcount change on invalid ref 0 ret -22 [ 427.840934] binder: BINDER_SET_CONTEXT_MGR already set [ 427.840942] binder: 16828:16832 ioctl 40046207 0 returned -16 [ 427.845669] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.845687] binder: 16828:16832 transaction failed 29189/-3, size 72-24 line 3136 [ 427.873501] binder: 16835:16841 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.873511] binder: 16835:16841 BC_INCREFS_DONE u0000000000000003 no match [ 427.873516] binder: 16835:16841 ERROR: BC_REGISTER_LOOPER called without request [ 427.873525] binder: 16835:16841 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.873536] binder: 16835:16841 Release 1 refcount change on invalid ref 0 ret -22 [ 428.025882] binder: BINDER_SET_CONTEXT_MGR already set [ 428.025891] binder: 16851:16857 ioctl 40046207 0 returned -16 [ 428.026018] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.026037] binder: 16851:16857 transaction failed 29189/-3, size 72-24 line 3136 [ 428.026201] binder: 16854:16861 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.026210] binder: 16854:16861 BC_INCREFS_DONE u0000000000000003 no match [ 428.026216] binder: 16854:16861 ERROR: BC_REGISTER_LOOPER called without request [ 428.026224] binder: 16854:16861 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.026235] binder: 16854:16861 Release 1 refcount change on invalid ref 0 ret -22 [ 428.063471] binder: 16868:16874 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.063481] binder: 16868:16874 BC_INCREFS_DONE u0000000000000003 no match [ 428.063487] binder: 16868:16874 ERROR: BC_REGISTER_LOOPER called without request [ 428.063496] binder: 16868:16874 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.063508] binder: 16868:16874 Release 1 refcount change on invalid ref 0 ret -22 [ 428.116141] binder: 16880:16885 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.116151] binder: 16880:16885 BC_INCREFS_DONE u0000000000000003 no match [ 428.116157] binder: 16880:16885 ERROR: BC_REGISTER_LOOPER called without request [ 428.116164] binder: 16880:16885 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.116173] binder: 16880:16885 Release 1 refcount change on invalid ref 0 ret -22 [ 428.223700] binder: BINDER_SET_CONTEXT_MGR already set [ 428.223709] binder: 16891:16896 ioctl 40046207 0 returned -16 [ 428.223801] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.223820] binder: 16891:16896 transaction failed 29189/-3, size 72-24 line 3136 [ 428.229638] binder: 16897:16899 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.229647] binder: 16897:16899 BC_INCREFS_DONE u0000000000000003 no match [ 428.229654] binder: 16897:16899 ERROR: BC_REGISTER_LOOPER called without request [ 428.229662] binder: 16897:16899 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.229673] binder: 16897:16899 Release 1 refcount change on invalid ref 0 ret -22 [ 428.252256] binder: BINDER_SET_CONTEXT_MGR already set [ 428.252265] binder: 16901:16905 ioctl 40046207 0 returned -16 [ 428.252358] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.252376] binder: 16901:16905 transaction failed 29189/-3, size 72-24 line 3136 [ 428.264990] binder: 16903:16906 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.265000] binder: 16903:16906 BC_INCREFS_DONE u0000000000000003 no match [ 428.265005] binder: 16903:16906 ERROR: BC_REGISTER_LOOPER called without request [ 428.265014] binder: 16903:16906 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.265024] binder: 16903:16906 Release 1 refcount change on invalid ref 0 ret -22 [ 428.301089] binder: 16909:16911 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.301098] binder: 16909:16911 BC_INCREFS_DONE u0000000000000003 no match [ 428.301104] binder: 16909:16911 ERROR: BC_REGISTER_LOOPER called without request [ 428.301112] binder: 16909:16911 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.301123] binder: 16909:16911 Release 1 refcount change on invalid ref 0 ret -22 [ 428.304614] binder: BINDER_SET_CONTEXT_MGR already set [ 428.304623] binder: 16910:16913 ioctl 40046207 0 returned -16 [ 428.304751] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.304768] binder: 16910:16913 transaction failed 29189/-3, size 72-24 line 3136 [ 428.484915] binder: BINDER_SET_CONTEXT_MGR already set [ 428.484931] binder: 16933:16939 ioctl 40046207 0 returned -16 [ 428.487828] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.487850] binder: 16933:16939 transaction failed 29189/-3, size 72-24 line 3136 [ 428.503818] binder: 16934:16941 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.503828] binder: 16934:16941 BC_INCREFS_DONE u0000000000000003 no match [ 428.503834] binder: 16934:16941 ERROR: BC_REGISTER_LOOPER called without request [ 428.503842] binder: 16934:16941 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.503852] binder: 16934:16941 Release 1 refcount change on invalid ref 0 ret -22 [ 428.550778] binder: 16946:16952 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.550788] binder: 16946:16952 BC_INCREFS_DONE u0000000000000003 no match [ 428.550794] binder: 16946:16952 ERROR: BC_REGISTER_LOOPER called without request [ 428.550802] binder: 16946:16952 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.550813] binder: 16946:16952 Release 1 refcount change on invalid ref 0 ret -22 [ 428.569030] binder: BINDER_SET_CONTEXT_MGR already set [ 428.569039] binder: 16948:16957 ioctl 40046207 0 returned -16 [ 428.569151] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.569168] binder: 16948:16957 transaction failed 29189/-3, size 72-24 line 3136 [ 428.756283] binder: BINDER_SET_CONTEXT_MGR already set [ 428.756293] binder: 16976:16981 ioctl 40046207 0 returned -16 [ 428.756390] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.756411] binder: 16976:16981 transaction failed 29189/-3, size 72-24 line 3136 [ 428.758134] binder: 16975:16979 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.758144] binder: 16975:16979 BC_INCREFS_DONE u0000000000000003 no match [ 428.758149] binder: 16975:16979 ERROR: BC_REGISTER_LOOPER called without request [ 428.758158] binder: 16975:16979 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.758167] binder: 16975:16979 Release 1 refcount change on invalid ref 0 ret -22 [ 428.811960] binder: BINDER_SET_CONTEXT_MGR already set [ 428.811969] binder: 16988:16993 ioctl 40046207 0 returned -16 [ 428.812073] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.812092] binder: 16988:16993 transaction failed 29189/-3, size 72-24 line 3136 [ 428.817075] binder: 16991:16996 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.817085] binder: 16991:16996 BC_INCREFS_DONE u0000000000000003 no match [ 428.817090] binder: 16991:16996 ERROR: BC_REGISTER_LOOPER called without request [ 428.817099] binder: 16991:16996 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.817108] binder: 16991:16996 Release 1 refcount change on invalid ref 0 ret -22 [ 428.896845] binder: BINDER_SET_CONTEXT_MGR already set [ 428.896854] binder: 17007:17011 ioctl 40046207 0 returned -16 [ 428.903044] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.903062] binder: 17007:17011 transaction failed 29189/-3, size 72-24 line 3136 [ 429.010643] binder: 17018:17024 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 429.010652] binder: 17018:17024 BC_INCREFS_DONE u0000000000000003 no match [ 429.010658] binder: 17018:17024 ERROR: BC_REGISTER_LOOPER called without request [ 429.010666] binder: 17018:17024 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 429.010676] binder: 17018:17024 Release 1 refcount change on invalid ref 0 ret -22 [ 429.025903] binder: BINDER_SET_CONTEXT_MGR already set [ 429.025912] binder: 17021:17027 ioctl 40046207 0 returned -16 [ 429.026002] binder_alloc: 7943: binder_alloc_buf, no vma [ 429.026021] binder: 17021:17027 transaction failed 29189/-3, size 72-24 line 3136 [ 429.076703] binder: 17030:17040 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 429.076715] binder: 17030:17040 BC_INCREFS_DONE u0000000000000003 no match [ 429.076720] binder: 17030:17040 ERROR: BC_REGISTER_LOOPER called without request [ 429.076730] binder: 17030:17040 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 429.076740] binder: 17030:17040 Release 1 refcount change on invalid ref 0 ret -22 [ 429.096659] binder: BINDER_SET_CONTEXT_MGR already set [ 429.096668] binder: 17042:17044 ioctl 40046207 0 returned -16 [ 429.096760] binder_alloc: 7943: binder_alloc_buf, no vma [ 429.096778] binder: 17042:17044 transaction failed 29189/-3, size 72-24 line 3136