00000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:16 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:16 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:16 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:16 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 390.682472] binder: 10487:10491 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 390.682482] binder: 10487:10491 Release 1 refcount change on invalid ref 0 ret -22 [ 390.694222] binder: BINDER_SET_CONTEXT_MGR already set [ 390.694231] binder: 10488:10497 ioctl 40046207 0 returned -16 [ 390.694337] binder_alloc: 7943: binder_alloc_buf, no vma [ 390.694356] binder: 10488:10497 transaction failed 29189/-3, size 72-24 line 3136 03:53:16 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:16 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:16 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 390.717781] binder: 10499:10505 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 390.717790] binder: 10499:10505 BC_INCREFS_DONE u0000000000000003 no match ** 2 printk messages dropped ** [ 390.717815] binder: 10499:10505 Release 1 refcount change on invalid ref 0 ret -22 [ 390.733487] binder: BINDER_SET_CONTEXT_MGR already set [ 390.733494] binder: 10507:10508 ioctl 40046207 0 returned -16 [ 390.733573] binder_alloc: 7943: binder_alloc_buf, no vma [ 390.733588] binder: 10507:10508 transaction failed 29189/-3, size 72-24 line 3136 [ 390.794040] binder: 10515:10519 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 390.794051] binder: 10515:10519 BC_INCREFS_DONE u0000000000000003 no match [ 390.794057] binder: 10515:10519 ERROR: BC_REGISTER_LOOPER called without request [ 390.794066] binder: 10515:10519 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:16 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:16 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:16 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:16 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 390.794075] binder: 10515:10519 Release 1 refcount change on invalid ref 0 ret -22 [ 390.927202] binder: BINDER_SET_CONTEXT_MGR already set [ 390.927209] binder: 10532:10534 ioctl 40046207 0 returned -16 [ 390.927385] binder_alloc: 7943: binder_alloc_buf, no vma [ 390.927402] binder: 10532:10534 transaction failed 29189/-3, size 72-24 line 3136 [ 390.966445] binder: BINDER_SET_CONTEXT_MGR already set [ 390.966453] binder: 10546:10549 ioctl 40046207 0 returned -16 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 390.966549] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 390.966625] binder: 10546:10549 transaction failed 29189/-3, size 72-24 line 3136 [ 390.983507] binder: 10535:10541 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 390.983516] binder: 10535:10541 BC_INCREFS_DONE u0000000000000003 no match [ 390.983523] binder: 10535:10541 ERROR: BC_REGISTER_LOOPER called without request [ 390.983530] binder: 10535:10541 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 390.983540] binder: 10535:10541 Release 1 refcount change on invalid ref 0 ret -22 03:53:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 391.032306] binder: BINDER_SET_CONTEXT_MGR already set [ 391.032315] binder: 10564:10565 ioctl 40046207 0 returned -16 [ 391.032411] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.032430] binder: 10564:10565 transaction failed 29189/-3, size 72-24 line 3136 [ 391.182580] binder: BINDER_SET_CONTEXT_MGR already set [ 391.182589] binder: 10576:10581 ioctl 40046207 0 returned -16 [ 391.182777] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.182963] binder: 10576:10581 transaction failed 29189/-3, size 72-24 line 3136 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 391.187340] binder: 10574:10582 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.187350] binder: 10574:10582 BC_INCREFS_DONE u0000000000000003 no match [ 391.187355] binder: 10574:10582 ERROR: BC_REGISTER_LOOPER called without request 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 391.187363] binder: 10574:10582 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 391.187372] binder: 10574:10582 Release 1 refcount change on invalid ref 0 ret -22 [ 391.253634] binder: BINDER_SET_CONTEXT_MGR already set [ 391.253643] binder: 10593:10595 ioctl 40046207 0 returned -16 [ 391.256117] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.256135] binder: 10593:10595 transaction failed 29189/-3, size 72-24 line 3136 [ 391.262353] binder: 10596:10604 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.262369] binder: 10596:10604 BC_INCREFS_DONE u0000000000000003 no match [ 391.262374] binder: 10596:10604 ERROR: BC_REGISTER_LOOPER called without request [ 391.262383] binder: 10596:10604 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 391.262393] binder: 10596:10604 Release 1 refcount change on invalid ref 0 ret -22 [ 391.441136] binder: 10622:10625 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.441146] binder: 10622:10625 BC_INCREFS_DONE u0000000000000003 no match [ 391.441152] binder: 10622:10625 ERROR: BC_REGISTER_LOOPER called without request [ 391.441161] binder: 10622:10625 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 391.441170] binder: 10622:10625 Release 1 refcount change on invalid ref 0 ret -22 [ 391.442924] binder: BINDER_SET_CONTEXT_MGR already set [ 391.442935] binder: 10621:10624 ioctl 40046207 0 returned -16 [ 391.443341] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 391.443362] binder: 10621:10624 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 391.487037] binder: 10633:10638 Release 1 refcount change on invalid ref 0 ret -22 [ 391.492436] binder: BINDER_SET_CONTEXT_MGR already set [ 391.492444] binder: 10635:10639 ioctl 40046207 0 returned -16 [ 391.492534] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.492552] binder: 10635:10639 transaction failed 29189/-3, size 72-24 line 3136 [ 391.687836] binder: BINDER_SET_CONTEXT_MGR already set [ 391.687845] binder: 10659:10665 ioctl 40046207 0 returned -16 [ 391.687937] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.687957] binder: 10659:10665 transaction failed 29189/-3, size 72-24 line 3136 03:53:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 391.696741] binder: 10662:10667 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.696750] binder: 10662:10667 BC_INCREFS_DONE u0000000000000003 no match [ 391.696755] binder: 10662:10667 ERROR: BC_REGISTER_LOOPER called without request [ 391.696763] binder: 10662:10667 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 391.696774] binder: 10662:10667 Release 1 refcount change on invalid ref 0 ret -22 [ 391.732295] binder: BINDER_SET_CONTEXT_MGR already set [ 391.732304] binder: 10671:10677 ioctl 40046207 0 returned -16 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 391.732408] binder_alloc: 7943: binder_alloc_buf, no vma [ 391.732426] binder: 10671:10677 transaction failed 29189/-3, size 72-24 line 3136 ** 1 printk messages dropped ** [ 391.737068] binder: 10674:10678 BC_INCREFS_DONE u0000000000000003 no match [ 391.737074] binder: 10674:10678 ERROR: BC_REGISTER_LOOPER called without request 03:53:17 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:17 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:17 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 391.737082] binder: 10674:10678 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 391.737091] binder: 10674:10678 Release 1 refcount change on invalid ref 0 ret -22 [ 391.753262] binder: BINDER_SET_CONTEXT_MGR already set [ 391.753271] binder: 10683:10686 ioctl 40046207 0 returned -16 [ 391.753361] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 391.753380] binder: 10683:10686 transaction failed 29189/-3, size 72-24 line 3136 [ 391.929382] binder: 10700:10707 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 391.929392] binder: 10700:10707 BC_INCREFS_DONE u0000000000000003 no match 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 391.929398] binder: 10700:10707 ERROR: BC_REGISTER_LOOPER called without request ** 7 printk messages dropped ** [ 391.962309] binder: 10715:10716 BC_INCREFS_DONE u0000000000000003 no match [ 391.962315] binder: 10715:10716 ERROR: BC_REGISTER_LOOPER called without request [ 391.962323] binder: 10715:10716 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 391.962335] binder: 10715:10716 Release 1 refcount change on invalid ref 0 ret -22 [ 392.008691] binder: 10721:10725 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.008701] binder: 10721:10725 BC_INCREFS_DONE u0000000000000003 no match [ 392.008706] binder: 10721:10725 ERROR: BC_REGISTER_LOOPER called without request [ 392.008715] binder: 10721:10725 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.008726] binder: 10721:10725 Release 1 refcount change on invalid ref 0 ret -22 [ 392.014297] binder: BINDER_SET_CONTEXT_MGR already set [ 392.014306] binder: 10726:10729 ioctl 40046207 0 returned -16 03:53:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 392.014401] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.014417] binder: 10726:10729 transaction failed 29189/-3, size 72-24 line 3136 [ 392.173303] binder: 10742:10744 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.173312] binder: 10742:10744 BC_INCREFS_DONE u0000000000000003 no match 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 392.173318] binder: 10742:10744 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 392.186142] binder: 10743:10748 transaction failed 29189/-3, size 72-24 line 3136 [ 392.238118] binder: BINDER_SET_CONTEXT_MGR already set [ 392.238127] binder: 10752:10756 ioctl 40046207 0 returned -16 [ 392.238242] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.238259] binder: 10752:10756 transaction failed 29189/-3, size 72-24 line 3136 [ 392.242779] binder: 10753:10758 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.242789] binder: 10753:10758 BC_INCREFS_DONE u0000000000000003 no match [ 392.242794] binder: 10753:10758 ERROR: BC_REGISTER_LOOPER called without request 03:53:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 392.242802] binder: 10753:10758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.242811] binder: 10753:10758 Release 1 refcount change on invalid ref 0 ret -22 [ 392.269381] binder: BINDER_SET_CONTEXT_MGR already set [ 392.269391] binder: 10763:10767 ioctl 40046207 0 returned -16 [ 392.269712] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.269731] binder: 10763:10767 transaction failed 29189/-3, size 72-24 line 3136 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 392.273658] binder: 10765:10768 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.273668] binder: 10765:10768 BC_INCREFS_DONE u0000000000000003 no match [ 392.273674] binder: 10765:10768 ERROR: BC_REGISTER_LOOPER called without request [ 392.273681] binder: 10765:10768 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.273694] binder: 10765:10768 Release 1 refcount change on invalid ref 0 ret -22 [ 392.426572] binder: 10781:10784 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.426581] binder: 10781:10784 BC_INCREFS_DONE u0000000000000003 no match [ 392.426588] binder: 10781:10784 ERROR: BC_REGISTER_LOOPER called without request [ 392.426601] binder: 10781:10784 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.426882] binder: 10781:10784 Release 1 refcount change on invalid ref 0 ret -22 [ 392.458742] binder: BINDER_SET_CONTEXT_MGR already set [ 392.458753] binder: 10778:10786 ioctl 40046207 0 returned -16 [ 392.459457] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.459475] binder: 10778:10786 transaction failed 29189/-3, size 72-24 line 3136 [ 392.492108] binder: BINDER_SET_CONTEXT_MGR already set 03:53:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 392.492116] binder: 10798:10801 ioctl 40046207 0 returned -16 [ 392.498509] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.498534] binder: 10798:10801 transaction failed 29189/-3, size 72-24 line 3136 [ 392.524747] binder: BINDER_SET_CONTEXT_MGR already set 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 392.524756] binder: 10803:10805 ioctl 40046207 0 returned -16 ** 3 printk messages dropped ** [ 392.547032] binder: 10797:10809 BC_INCREFS_DONE u0000000000000003 no match ** 4 printk messages dropped ** [ 392.705791] binder: 10818:10822 ioctl 40046207 0 returned -16 [ 392.705886] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.705905] binder: 10818:10822 transaction failed 29189/-3, size 72-24 line 3136 [ 392.724248] binder: 10820:10824 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.724258] binder: 10820:10824 BC_INCREFS_DONE u0000000000000003 no match 03:53:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:18 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:18 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:18 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 392.724263] binder: 10820:10824 ERROR: BC_REGISTER_LOOPER called without request [ 392.724271] binder: 10820:10824 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 392.724281] binder: 10820:10824 Release 1 refcount change on invalid ref 0 ret -22 [ 392.739375] binder: BINDER_SET_CONTEXT_MGR already set [ 392.739383] binder: 10828:10832 ioctl 40046207 0 returned -16 [ 392.739489] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 392.739508] binder: 10828:10832 transaction failed 29189/-3, size 72-24 line 3136 [ 392.801974] binder: 10844:10846 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) ** 2 printk messages dropped ** [ 392.802000] binder: 10844:10846 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 2 printk messages dropped ** [ 392.810442] binder: 10841:10843 ioctl 40046207 0 returned -16 [ 392.810528] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.810547] binder: 10841:10843 transaction failed 29189/-3, size 72-24 line 3136 [ 392.969891] binder: BINDER_SET_CONTEXT_MGR already set [ 392.969900] binder: 10865:10869 ioctl 40046207 0 returned -16 [ 392.969994] binder_alloc: 7943: binder_alloc_buf, no vma [ 392.970013] binder: 10865:10869 transaction failed 29189/-3, size 72-24 line 3136 [ 392.989329] binder: 10867:10870 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 392.989338] binder: 10867:10870 BC_INCREFS_DONE u0000000000000003 no match [ 392.989344] binder: 10867:10870 ERROR: BC_REGISTER_LOOPER called without request [ 392.989352] binder: 10867:10870 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 392.989362] binder: 10867:10870 Release 1 refcount change on invalid ref 0 ret -22 [ 393.020536] binder: BINDER_SET_CONTEXT_MGR already set [ 393.020546] binder: 10876:10880 ioctl 40046207 0 returned -16 [ 393.020636] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.020656] binder: 10876:10880 transaction failed 29189/-3, size 72-24 line 3136 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 393.048666] binder: 10882:10892 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.048675] binder: 10882:10892 BC_INCREFS_DONE u0000000000000003 no match ** 1 printk messages dropped ** [ 393.048697] binder: 10882:10892 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.048706] binder: 10882:10892 Release 1 refcount change on invalid ref 0 ret -22 [ 393.061527] binder: BINDER_SET_CONTEXT_MGR already set [ 393.061537] binder: 10886:10893 ioctl 40046207 0 returned -16 [ 393.061644] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.061663] binder: 10886:10893 transaction failed 29189/-3, size 72-24 line 3136 [ 393.215610] binder: BINDER_SET_CONTEXT_MGR already set [ 393.215618] binder: 10911:10916 ioctl 40046207 0 returned -16 [ 393.218593] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 393.218610] binder: 10911:10916 transaction failed 29189/-3, size 72-24 line 3136 [ 393.222791] binder: 10909:10912 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.222800] binder: 10909:10912 BC_INCREFS_DONE u0000000000000003 no match [ 393.222806] binder: 10909:10912 ERROR: BC_REGISTER_LOOPER called without request [ 393.222813] binder: 10909:10912 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.222821] binder: 10909:10912 Release 1 refcount change on invalid ref 0 ret -22 [ 393.265618] binder: 10922:10926 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.265628] binder: 10922:10926 BC_INCREFS_DONE u0000000000000003 no match ** 1 printk messages dropped ** [ 393.265642] binder: 10922:10926 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.265651] binder: 10922:10926 Release 1 refcount change on invalid ref 0 ret -22 [ 393.269960] binder: BINDER_SET_CONTEXT_MGR already set 03:53:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.269968] binder: 10923:10927 ioctl 40046207 0 returned -16 [ 393.270070] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.270089] binder: 10923:10927 transaction failed 29189/-3, size 72-24 line 3136 [ 393.304709] binder: 10929:10938 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.304719] binder: 10929:10938 BC_INCREFS_DONE u0000000000000003 no match [ 393.304724] binder: 10929:10938 ERROR: BC_REGISTER_LOOPER called without request 03:53:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:19 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:19 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.304732] binder: 10929:10938 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.304743] binder: 10929:10938 Release 1 refcount change on invalid ref 0 ret -22 03:53:19 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) ** 1 printk messages dropped ** [ 393.456984] binder: 10948:10952 BC_INCREFS_DONE u0000000000000003 no match ** 4 printk messages dropped ** [ 393.458331] binder: 10946:10954 ioctl 40046207 0 returned -16 [ 393.458437] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.458457] binder: 10946:10954 transaction failed 29189/-3, size 72-24 line 3136 [ 393.505214] binder: 10964:10966 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.505224] binder: 10964:10966 BC_INCREFS_DONE u0000000000000003 no match [ 393.505229] binder: 10964:10966 ERROR: BC_REGISTER_LOOPER called without request [ 393.505237] binder: 10964:10966 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.505246] binder: 10964:10966 Release 1 refcount change on invalid ref 0 ret -22 [ 393.520435] binder: BINDER_SET_CONTEXT_MGR already set [ 393.520442] binder: 10970:10971 ioctl 40046207 0 returned -16 [ 393.520529] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.520543] binder: 10970:10971 transaction failed 29189/-3, size 72-24 line 3136 03:53:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 393.562238] binder: 10973:10980 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.562247] binder: 10973:10980 BC_INCREFS_DONE u0000000000000003 no match [ 393.562253] binder: 10973:10980 ERROR: BC_REGISTER_LOOPER called without request [ 393.562261] binder: 10973:10980 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 393.562272] binder: 10973:10980 Release 1 refcount change on invalid ref 0 ret -22 [ 393.720902] binder: BINDER_SET_CONTEXT_MGR already set [ 393.720911] binder: 10991:10993 ioctl 40046207 0 returned -16 [ 393.721003] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.721021] binder: 10991:10993 transaction failed 29189/-3, size 72-24 line 3136 [ 393.738592] binder: 10994:11000 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.738602] binder: 10994:11000 BC_INCREFS_DONE u0000000000000003 no match [ 393.738607] binder: 10994:11000 ERROR: BC_REGISTER_LOOPER called without request [ 393.738615] binder: 10994:11000 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.738626] binder: 10994:11000 Release 1 refcount change on invalid ref 0 ret -22 [ 393.767940] binder: BINDER_SET_CONTEXT_MGR already set [ 393.767947] binder: 11003:11005 ioctl 40046207 0 returned -16 [ 393.768060] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.768074] binder: 11003:11005 transaction failed 29189/-3, size 72-24 line 3136 [ 393.813317] binder: 11013:11016 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.813326] binder: 11013:11016 BC_INCREFS_DONE u0000000000000003 no match [ 393.813346] binder: 11013:11016 ERROR: BC_REGISTER_LOOPER called without request 03:53:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 393.813354] binder: 11013:11016 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.813364] binder: 11013:11016 Release 1 refcount change on invalid ref 0 ret -22 [ 393.836536] binder: BINDER_SET_CONTEXT_MGR already set [ 393.836544] binder: 11019:11022 ioctl 40046207 0 returned -16 [ 393.836710] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 393.836728] binder: 11019:11022 transaction failed 29189/-3, size 72-24 line 3136 [ 393.975675] binder: BINDER_SET_CONTEXT_MGR already set [ 393.975683] binder: 11036:11040 ioctl 40046207 0 returned -16 [ 393.975781] binder_alloc: 7943: binder_alloc_buf, no vma [ 393.975800] binder: 11036:11040 transaction failed 29189/-3, size 72-24 line 3136 [ 393.995152] binder: 11034:11042 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 393.995161] binder: 11034:11042 BC_INCREFS_DONE u0000000000000003 no match [ 393.995167] binder: 11034:11042 ERROR: BC_REGISTER_LOOPER called without request [ 393.995175] binder: 11034:11042 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 393.995197] binder: 11034:11042 Release 1 refcount change on invalid ref 0 ret -22 [ 394.015913] binder: BINDER_SET_CONTEXT_MGR already set [ 394.015924] binder: 11045:11048 ioctl 40046207 0 returned -16 [ 394.016019] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 394.016038] binder: 11045:11048 transaction failed 29189/-3, size 72-24 line 3136 [ 394.028035] binder: 11050:11054 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.028044] binder: 11050:11054 BC_INCREFS_DONE u0000000000000003 no match [ 394.028050] binder: 11050:11054 ERROR: BC_REGISTER_LOOPER called without request [ 394.028058] binder: 11050:11054 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.028068] binder: 11050:11054 Release 1 refcount change on invalid ref 0 ret -22 [ 394.047049] binder: BINDER_SET_CONTEXT_MGR already set 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 394.047058] binder: 11055:11057 ioctl 40046207 0 returned -16 [ 394.047148] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.047164] binder: 11055:11057 transaction failed 29189/-3, size 72-24 line 3136 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 394.059485] binder: 11059:11061 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.059494] binder: 11059:11061 BC_INCREFS_DONE u0000000000000003 no match ** 1 printk messages dropped ** [ 394.059507] binder: 11059:11061 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.059517] binder: 11059:11061 Release 1 refcount change on invalid ref 0 ret -22 [ 394.202451] binder: BINDER_SET_CONTEXT_MGR already set [ 394.202460] binder: 11072:11074 ioctl 40046207 0 returned -16 [ 394.202550] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.202568] binder: 11072:11074 transaction failed 29189/-3, size 72-24 line 3136 [ 394.217633] binder: 11075:11080 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.217642] binder: 11075:11080 BC_INCREFS_DONE u0000000000000003 no match [ 394.217647] binder: 11075:11080 ERROR: BC_REGISTER_LOOPER called without request [ 394.217654] binder: 11075:11080 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:20 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 394.217680] binder: 11075:11080 Release 1 refcount change on invalid ref 0 ret -22 [ 394.280836] binder: BINDER_SET_CONTEXT_MGR already set [ 394.280844] binder: 11084:11092 ioctl 40046207 0 returned -16 [ 394.280951] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.280970] binder: 11084:11092 transaction failed 29189/-3, size 72-24 line 3136 03:53:20 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 394.313133] binder: 11088:11103 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 2 printk messages dropped ** [ 394.313157] binder: 11088:11103 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 4 printk messages dropped ** [ 394.342808] binder: 11102:11106 transaction failed 29189/-3, size 72-24 line 3136 [ 394.490515] binder: 11121:11123 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.490525] binder: 11121:11123 BC_INCREFS_DONE u0000000000000003 no match [ 394.490530] binder: 11121:11123 ERROR: BC_REGISTER_LOOPER called without request 03:53:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 394.490538] binder: 11121:11123 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.490547] binder: 11121:11123 Release 1 refcount change on invalid ref 0 ret -22 [ 394.501435] binder: BINDER_SET_CONTEXT_MGR already set [ 394.501445] binder: 11122:11124 ioctl 40046207 0 returned -16 [ 394.501537] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.501556] binder: 11122:11124 transaction failed 29189/-3, size 72-24 line 3136 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 394.568285] binder: 11134:11144 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.568296] binder: 11134:11144 BC_INCREFS_DONE u0000000000000003 no match [ 394.568301] binder: 11134:11144 ERROR: BC_REGISTER_LOOPER called without request 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 394.568310] binder: 11134:11144 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.568320] binder: 11134:11144 Release 1 refcount change on invalid ref 0 ret -22 [ 394.590169] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 394.590340] binder: 11142:11146 transaction failed 29189/-3, size 72-24 line 3136 [ 394.728963] binder: 11162:11168 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 394.728972] binder: 11162:11168 BC_INCREFS_DONE u0000000000000003 no match [ 394.728978] binder: 11162:11168 ERROR: BC_REGISTER_LOOPER called without request [ 394.728986] binder: 11162:11168 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 394.728997] binder: 11162:11168 Release 1 refcount change on invalid ref 0 ret -22 [ 394.733670] binder: BINDER_SET_CONTEXT_MGR already set [ 394.733679] binder: 11165:11172 ioctl 40046207 0 returned -16 [ 394.733775] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.733794] binder: 11165:11172 transaction failed 29189/-3, size 72-24 line 3136 [ 394.801325] binder: BINDER_SET_CONTEXT_MGR already set [ 394.801334] binder: 11180:11187 ioctl 40046207 0 returned -16 03:53:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 394.801444] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.801461] binder: 11180:11187 transaction failed 29189/-3, size 72-24 line 3136 [ 394.811249] binder: 11181:11185 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 394.811258] binder: 11181:11185 BC_INCREFS_DONE u0000000000000003 no match [ 394.811264] binder: 11181:11185 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 394.865319] binder: 11200:11202 transaction failed 29189/-3, size 72-24 line 3136 [ 394.974172] binder: BINDER_SET_CONTEXT_MGR already set [ 394.974191] binder: 11208:11212 ioctl 40046207 0 returned -16 [ 394.974289] binder_alloc: 7943: binder_alloc_buf, no vma [ 394.974308] binder: 11208:11212 transaction failed 29189/-3, size 72-24 line 3136 [ 395.014018] binder: BINDER_SET_CONTEXT_MGR already set [ 395.014026] binder: 11223:11224 ioctl 40046207 0 returned -16 [ 395.014118] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.014137] binder: 11223:11224 transaction failed 29189/-3, size 72-24 line 3136 [ 395.017972] binder: 11209:11218 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 395.017981] binder: 11209:11218 BC_INCREFS_DONE u0000000000000003 no match [ 395.017986] binder: 11209:11218 ERROR: BC_REGISTER_LOOPER called without request [ 395.017994] binder: 11209:11218 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.018004] binder: 11209:11218 Release 1 refcount change on invalid ref 0 ret -22 [ 395.068889] binder: BINDER_SET_CONTEXT_MGR already set [ 395.068897] binder: 11231:11232 ioctl 40046207 0 returned -16 [ 395.071641] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 395.071658] binder: 11231:11232 transaction failed 29189/-3, size 72-24 line 3136 [ 395.089065] binder: 11238:11244 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.089075] binder: 11238:11244 BC_INCREFS_DONE u0000000000000003 no match 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 395.089081] binder: 11238:11244 ERROR: BC_REGISTER_LOOPER called without request 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.089089] binder: 11238:11244 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 2 printk messages dropped ** [ 395.207234] binder: 11256:11259 BC_INCREFS_DONE u0000000000000003 no match [ 395.207240] binder: 11256:11259 ERROR: BC_REGISTER_LOOPER called without request [ 395.207249] binder: 11256:11259 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.207258] binder: 11256:11259 Release 1 refcount change on invalid ref 0 ret -22 [ 395.221062] binder: BINDER_SET_CONTEXT_MGR already set [ 395.221070] binder: 11254:11258 ioctl 40046207 0 returned -16 [ 395.221163] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.221182] binder: 11254:11258 transaction failed 29189/-3, size 72-24 line 3136 [ 395.265472] binder: BINDER_SET_CONTEXT_MGR already set [ 395.265480] binder: 11270:11273 ioctl 40046207 0 returned -16 03:53:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.265568] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.265586] binder: 11270:11273 transaction failed 29189/-3, size 72-24 line 3136 [ 395.268576] binder: 11263:11271 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.268586] binder: 11263:11271 BC_INCREFS_DONE u0000000000000003 no match [ 395.268592] binder: 11263:11271 ERROR: BC_REGISTER_LOOPER called without request [ 395.268601] binder: 11263:11271 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:21 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.268612] binder: 11263:11271 Release 1 refcount change on invalid ref 0 ret -22 [ 395.474360] binder: BINDER_SET_CONTEXT_MGR already set 03:53:21 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 395.474368] binder: 11296:11305 ioctl 40046207 0 returned -16 [ 395.474512] binder_alloc: 7943: binder_alloc_buf, no vma ** 2 printk messages dropped ** [ 395.494288] binder: 11297:11302 BC_INCREFS_DONE u0000000000000003 no match [ 395.494294] binder: 11297:11302 ERROR: BC_REGISTER_LOOPER called without request [ 395.494303] binder: 11297:11302 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.494314] binder: 11297:11302 Release 1 refcount change on invalid ref 0 ret -22 [ 395.521050] binder: BINDER_SET_CONTEXT_MGR already set [ 395.521058] binder: 11312:11315 ioctl 40046207 0 returned -16 [ 395.521158] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.521175] binder: 11312:11315 transaction failed 29189/-3, size 72-24 line 3136 03:53:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 395.552519] binder: 11322:11325 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.552529] binder: 11322:11325 BC_INCREFS_DONE u0000000000000003 no match [ 395.552535] binder: 11322:11325 ERROR: BC_REGISTER_LOOPER called without request [ 395.552543] binder: 11322:11325 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.552553] binder: 11322:11325 Release 1 refcount change on invalid ref 0 ret -22 [ 395.586461] binder: BINDER_SET_CONTEXT_MGR already set 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 395.586469] binder: 11326:11330 ioctl 40046207 0 returned -16 [ 395.586572] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.586590] binder: 11326:11330 transaction failed 29189/-3, size 72-24 line 3136 [ 395.716699] binder: 11338:11345 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.716708] binder: 11338:11345 BC_INCREFS_DONE u0000000000000003 no match ** 4 printk messages dropped ** [ 395.728530] binder: 11342:11349 ioctl 40046207 0 returned -16 [ 395.728824] binder_alloc: 7943: binder_alloc_buf, no vma [ 395.728843] binder: 11342:11349 transaction failed 29189/-3, size 72-24 line 3136 [ 395.744299] binder: 11352:11354 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.744309] binder: 11352:11354 BC_INCREFS_DONE u0000000000000003 no match [ 395.744315] binder: 11352:11354 ERROR: BC_REGISTER_LOOPER called without request [ 395.744323] binder: 11352:11354 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.744333] binder: 11352:11354 Release 1 refcount change on invalid ref 0 ret -22 03:53:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 395.766360] binder: 11357:11358 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 395.766369] binder: 11357:11358 BC_INCREFS_DONE u0000000000000003 no match [ 395.766374] binder: 11357:11358 ERROR: BC_REGISTER_LOOPER called without request [ 395.766383] binder: 11357:11358 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 395.766392] binder: 11357:11358 Release 1 refcount change on invalid ref 0 ret -22 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.012660] binder: 11380:11381 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.012670] binder: 11380:11381 BC_INCREFS_DONE u0000000000000003 no match 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 396.012676] binder: 11380:11381 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 396.022845] binder: 11383:11389 transaction failed 29189/-3, size 72-24 line 3136 [ 396.050042] binder: 11393:11395 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.050052] binder: 11393:11395 BC_INCREFS_DONE u0000000000000003 no match [ 396.050058] binder: 11393:11395 ERROR: BC_REGISTER_LOOPER called without request [ 396.050066] binder: 11393:11395 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.050077] binder: 11393:11395 Release 1 refcount change on invalid ref 0 ret -22 [ 396.056695] binder: BINDER_SET_CONTEXT_MGR already set [ 396.056703] binder: 11394:11398 ioctl 40046207 0 returned -16 [ 396.056809] binder_alloc: 7943: binder_alloc_buf, no vma [ 396.056830] binder: 11394:11398 transaction failed 29189/-3, size 72-24 line 3136 03:53:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 396.114286] binder: 11402:11409 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.114295] binder: 11402:11409 BC_INCREFS_DONE u0000000000000003 no match [ 396.114301] binder: 11402:11409 ERROR: BC_REGISTER_LOOPER called without request [ 396.114310] binder: 11402:11409 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.114319] binder: 11402:11409 Release 1 refcount change on invalid ref 0 ret -22 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 396.131292] binder: BINDER_SET_CONTEXT_MGR already set [ 396.131301] binder: 11407:11412 ioctl 40046207 0 returned -16 [ 396.131402] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 396.131419] binder: 11407:11412 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 396.260919] binder: 11425:11426 Release 1 refcount change on invalid ref 0 ret -22 [ 396.311778] binder: BINDER_SET_CONTEXT_MGR already set [ 396.311788] binder: 11423:11432 ioctl 40046207 0 returned -16 [ 396.312040] binder_alloc: 7943: binder_alloc_buf, no vma [ 396.312059] binder: 11423:11432 transaction failed 29189/-3, size 72-24 line 3136 03:53:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:22 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:22 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.318721] binder: 11440:11444 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.318730] binder: 11440:11444 BC_INCREFS_DONE u0000000000000003 no match [ 396.318736] binder: 11440:11444 ERROR: BC_REGISTER_LOOPER called without request [ 396.318744] binder: 11440:11444 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.318754] binder: 11440:11444 Release 1 refcount change on invalid ref 0 ret -22 [ 396.363600] binder: 11448:11451 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:22 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.363609] binder: 11448:11451 BC_INCREFS_DONE u0000000000000003 no match [ 396.363615] binder: 11448:11451 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 396.511529] binder: 11465:11469 transaction failed 29189/-3, size 72-24 line 3136 [ 396.546538] binder: 11474:11477 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.546549] binder: 11474:11477 BC_INCREFS_DONE u0000000000000003 no match [ 396.546555] binder: 11474:11477 ERROR: BC_REGISTER_LOOPER called without request [ 396.546563] binder: 11474:11477 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.546575] binder: 11474:11477 Release 1 refcount change on invalid ref 0 ret -22 [ 396.592919] binder: BINDER_SET_CONTEXT_MGR already set [ 396.592928] binder: 11480:11485 ioctl 40046207 0 returned -16 [ 396.593917] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.593935] binder: 11480:11485 transaction failed 29189/-3, size 72-24 line 3136 [ 396.625632] binder: 11487:11490 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 396.625642] binder: 11487:11490 BC_INCREFS_DONE u0000000000000003 no match [ 396.625648] binder: 11487:11490 ERROR: BC_REGISTER_LOOPER called without request 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 396.625656] binder: 11487:11490 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.625666] binder: 11487:11490 Release 1 refcount change on invalid ref 0 ret -22 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) ** 3 printk messages dropped ** [ 396.784001] binder: 11509:11515 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 4 printk messages dropped ** [ 396.803388] binder: 11508:11514 transaction failed 29189/-3, size 72-24 line 3136 [ 396.871048] binder: 11521:11532 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 396.871059] binder: 11521:11532 BC_INCREFS_DONE u0000000000000003 no match [ 396.871064] binder: 11521:11532 ERROR: BC_REGISTER_LOOPER called without request [ 396.871073] binder: 11521:11532 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 396.871084] binder: 11521:11532 Release 1 refcount change on invalid ref 0 ret -22 [ 396.871409] binder: BINDER_SET_CONTEXT_MGR already set 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 396.871417] binder: 11525:11530 ioctl 40046207 0 returned -16 [ 396.871532] binder_alloc: 7943: binder_alloc_buf, no vma [ 396.871550] binder: 11525:11530 transaction failed 29189/-3, size 72-24 line 3136 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) ** 3 printk messages dropped ** [ 396.913055] binder: 11538:11543 transaction failed 29189/-3, size 72-24 line 3136 ** 8 printk messages dropped ** [ 397.071230] binder: 11553:11563 Release 1 refcount change on invalid ref 0 ret -22 [ 397.120140] binder: 11574:11579 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.120150] binder: 11574:11579 BC_INCREFS_DONE u0000000000000003 no match [ 397.120156] binder: 11574:11579 ERROR: BC_REGISTER_LOOPER called without request [ 397.120164] binder: 11574:11579 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 397.120176] binder: 11574:11579 Release 1 refcount change on invalid ref 0 ret -22 [ 397.145247] binder: BINDER_SET_CONTEXT_MGR already set [ 397.145256] binder: 11569:11573 ioctl 40046207 0 returned -16 [ 397.145365] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 397.145382] binder: 11569:11573 transaction failed 29189/-3, size 72-24 line 3136 [ 397.308770] binder: 11597:11606 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.308780] binder: 11597:11606 BC_INCREFS_DONE u0000000000000003 no match [ 397.308785] binder: 11597:11606 ERROR: BC_REGISTER_LOOPER called without request [ 397.308793] binder: 11597:11606 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 397.308803] binder: 11597:11606 Release 1 refcount change on invalid ref 0 ret -22 [ 397.315004] binder: BINDER_SET_CONTEXT_MGR already set [ 397.315013] binder: 11602:11605 ioctl 40046207 0 returned -16 [ 397.315114] binder_alloc: 7943: binder_alloc_buf, no vma [ 397.315132] binder: 11602:11605 transaction failed 29189/-3, size 72-24 line 3136 ** 3 printk messages dropped ** [ 397.376904] binder: 11618:11624 transaction failed 29189/-3, size 72-24 line 3136 [ 397.407269] binder: 11625:11628 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.407279] binder: 11625:11628 BC_INCREFS_DONE u0000000000000003 no match [ 397.407284] binder: 11625:11628 ERROR: BC_REGISTER_LOOPER called without request [ 397.407292] binder: 11625:11628 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:23 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:23 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 397.407304] binder: 11625:11628 Release 1 refcount change on invalid ref 0 ret -22 [ 397.558905] binder: BINDER_SET_CONTEXT_MGR already set [ 397.558914] binder: 11644:11649 ioctl 40046207 0 returned -16 [ 397.559020] binder_alloc: 7943: binder_alloc_buf, no vma [ 397.559039] binder: 11644:11649 transaction failed 29189/-3, size 72-24 line 3136 [ 397.560669] binder: 11645:11651 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.560686] binder: 11645:11651 BC_INCREFS_DONE u0000000000000003 no match 03:53:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 397.560692] binder: 11645:11651 ERROR: BC_REGISTER_LOOPER called without request [ 397.560700] binder: 11645:11651 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 397.560710] binder: 11645:11651 Release 1 refcount change on invalid ref 0 ret -22 [ 397.588247] binder: BINDER_SET_CONTEXT_MGR already set 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 397.588255] binder: 11657:11660 ioctl 40046207 0 returned -16 [ 397.588348] binder_alloc: 7943: binder_alloc_buf, no vma [ 397.588367] binder: 11657:11660 transaction failed 29189/-3, size 72-24 line 3136 [ 397.643741] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 397.646002] binder: 11668:11675 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 397.687037] binder: 11665:11672 Release 1 refcount change on invalid ref 0 ret -22 [ 397.791152] binder: BINDER_SET_CONTEXT_MGR already set [ 397.791161] binder: 11690:11691 ioctl 40046207 0 returned -16 [ 397.791263] binder_alloc: 7943: binder_alloc_buf, no vma [ 397.791284] binder: 11690:11691 transaction failed 29189/-3, size 72-24 line 3136 [ 397.798498] binder: 11694:11697 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.798506] binder: 11694:11697 BC_INCREFS_DONE u0000000000000003 no match [ 397.798510] binder: 11694:11697 ERROR: BC_REGISTER_LOOPER called without request [ 397.798517] binder: 11694:11697 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 397.798525] binder: 11694:11697 Release 1 refcount change on invalid ref 0 ret -22 [ 397.864092] binder: 11706:11712 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 397.864101] binder: 11706:11712 BC_INCREFS_DONE u0000000000000003 no match 03:53:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 397.864107] binder: 11706:11712 ERROR: BC_REGISTER_LOOPER called without request [ 397.864115] binder: 11706:11712 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 397.864124] binder: 11706:11712 Release 1 refcount change on invalid ref 0 ret -22 [ 397.864524] binder: BINDER_SET_CONTEXT_MGR already set [ 397.864533] binder: 11702:11711 ioctl 40046207 0 returned -16 [ 397.867344] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 397.867364] binder: 11702:11711 transaction failed 29189/-3, size 72-24 line 3136 [ 398.037252] binder: 11735:11737 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 398.037261] binder: 11735:11737 BC_INCREFS_DONE u0000000000000003 no match [ 398.037267] binder: 11735:11737 ERROR: BC_REGISTER_LOOPER called without request [ 398.037276] binder: 11735:11737 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.037285] binder: 11735:11737 Release 1 refcount change on invalid ref 0 ret -22 [ 398.054637] binder: BINDER_SET_CONTEXT_MGR already set [ 398.054648] binder: 11736:11740 ioctl 40046207 0 returned -16 [ 398.054843] binder_alloc: 7943: binder_alloc_buf, no vma [ 398.054864] binder: 11736:11740 transaction failed 29189/-3, size 72-24 line 3136 [ 398.102651] binder: 11749:11758 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 398.102660] binder: 11749:11758 BC_INCREFS_DONE u0000000000000003 no match [ 398.102665] binder: 11749:11758 ERROR: BC_REGISTER_LOOPER called without request [ 398.102673] binder: 11749:11758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.102693] binder: 11749:11758 Release 1 refcount change on invalid ref 0 ret -22 [ 398.128093] binder: BINDER_SET_CONTEXT_MGR already set 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 398.128102] binder: 11753:11760 ioctl 40046207 0 returned -16 [ 398.128207] binder_alloc: 7943: binder_alloc_buf, no vma ** 2 printk messages dropped ** [ 398.294701] binder: 11781:11782 BC_INCREFS_DONE u0000000000000003 no match ** 8 printk messages dropped ** [ 398.321737] binder: 11790:11792 BC_INCREFS_DONE u0000000000000003 no match [ 398.321743] binder: 11790:11792 ERROR: BC_REGISTER_LOOPER called without request [ 398.321752] binder: 11790:11792 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.321762] binder: 11790:11792 Release 1 refcount change on invalid ref 0 ret -22 [ 398.364296] binder: BINDER_SET_CONTEXT_MGR already set [ 398.364305] binder: 11795:11801 ioctl 40046207 0 returned -16 03:53:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 398.364405] binder_alloc: 7943: binder_alloc_buf, no vma [ 398.364424] binder: 11795:11801 transaction failed 29189/-3, size 72-24 line 3136 [ 398.379735] binder: 11799:11806 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 398.379745] binder: 11799:11806 BC_INCREFS_DONE u0000000000000003 no match [ 398.379751] binder: 11799:11806 ERROR: BC_REGISTER_LOOPER called without request [ 398.379759] binder: 11799:11806 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.379770] binder: 11799:11806 Release 1 refcount change on invalid ref 0 ret -22 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 398.539553] binder: BINDER_SET_CONTEXT_MGR already set [ 398.539561] binder: 11814:11823 ioctl 40046207 0 returned -16 [ 398.539654] binder_alloc: 7943: binder_alloc_buf, no vma [ 398.539673] binder: 11814:11823 transaction failed 29189/-3, size 72-24 line 3136 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 398.557192] binder: 11817:11824 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 398.557232] binder: 11817:11824 Release 1 refcount change on invalid ref 0 ret -22 ** 9 printk messages dropped ** [ 398.649628] binder: 11839:11844 BC_INCREFS_DONE u0000000000000003 no match [ 398.649634] binder: 11839:11844 ERROR: BC_REGISTER_LOOPER called without request [ 398.649643] binder: 11839:11844 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.649653] binder: 11839:11844 Release 1 refcount change on invalid ref 0 ret -22 [ 398.764093] binder: 11853:11863 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 398.764103] binder: 11853:11863 BC_INCREFS_DONE u0000000000000003 no match 03:53:24 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:24 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:24 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:24 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 398.764109] binder: 11853:11863 ERROR: BC_REGISTER_LOOPER called without request [ 398.764117] binder: 11853:11863 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 398.764127] binder: 11853:11863 Release 1 refcount change on invalid ref 0 ret -22 [ 398.781636] binder: BINDER_SET_CONTEXT_MGR already set [ 398.781643] binder: 11858:11862 ioctl 40046207 0 returned -16 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 398.781753] binder_alloc: 7943: binder_alloc_buf, no vma [ 398.781769] binder: 11858:11862 transaction failed 29189/-3, size 72-24 line 3136 ** 3 printk messages dropped ** [ 398.835546] binder: 11878:11880 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 398.836946] binder: 11870:11872 Release 1 refcount change on invalid ref 0 ret -22 [ 399.003631] binder: BINDER_SET_CONTEXT_MGR already set [ 399.003639] binder: 11902:11906 ioctl 40046207 0 returned -16 [ 399.003748] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.003768] binder: 11902:11906 transaction failed 29189/-3, size 72-24 line 3136 [ 399.004965] binder: 11901:11905 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.004976] binder: 11901:11905 BC_INCREFS_DONE u0000000000000003 no match [ 399.004982] binder: 11901:11905 ERROR: BC_REGISTER_LOOPER called without request [ 399.004991] binder: 11901:11905 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.005000] binder: 11901:11905 Release 1 refcount change on invalid ref 0 ret -22 [ 399.054063] binder: BINDER_SET_CONTEXT_MGR already set [ 399.054073] binder: 11911:11915 ioctl 40046207 0 returned -16 [ 399.054192] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.054212] binder: 11911:11915 transaction failed 29189/-3, size 72-24 line 3136 03:53:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 399.080679] binder: BINDER_SET_CONTEXT_MGR already set [ 399.080687] binder: 11921:11925 ioctl 40046207 0 returned -16 [ 399.080805] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.080824] binder: 11921:11925 transaction failed 29189/-3, size 72-24 line 3136 [ 399.084970] binder: 11917:11929 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 399.084980] binder: 11917:11929 BC_INCREFS_DONE u0000000000000003 no match [ 399.084986] binder: 11917:11929 ERROR: BC_REGISTER_LOOPER called without request 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) ** 1 printk messages dropped ** [ 399.085003] binder: 11917:11929 Release 1 refcount change on invalid ref 0 ret -22 [ 399.247521] binder: BINDER_SET_CONTEXT_MGR already set [ 399.247530] binder: 11940:11947 ioctl 40046207 0 returned -16 [ 399.247620] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.247640] binder: 11940:11947 transaction failed 29189/-3, size 72-24 line 3136 [ 399.247862] binder: 11941:11948 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.247871] binder: 11941:11948 BC_INCREFS_DONE u0000000000000003 no match [ 399.247876] binder: 11941:11948 ERROR: BC_REGISTER_LOOPER called without request [ 399.247884] binder: 11941:11948 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.247893] binder: 11941:11948 Release 1 refcount change on invalid ref 0 ret -22 [ 399.274689] binder: BINDER_SET_CONTEXT_MGR already set 03:53:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.274697] binder: 11953:11956 ioctl 40046207 0 returned -16 [ 399.274802] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.274820] binder: 11953:11956 transaction failed 29189/-3, size 72-24 line 3136 [ 399.333952] binder: BINDER_SET_CONTEXT_MGR already set 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.333961] binder: 11966:11972 ioctl 40046207 0 returned -16 [ 399.334067] binder_alloc: 7943: binder_alloc_buf, no vma ** 2 printk messages dropped ** [ 399.347259] binder: 11964:11969 BC_INCREFS_DONE u0000000000000003 no match [ 399.347265] binder: 11964:11969 ERROR: BC_REGISTER_LOOPER called without request [ 399.347272] binder: 11964:11969 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.347284] binder: 11964:11969 Release 1 refcount change on invalid ref 0 ret -22 [ 399.495900] binder: 11987:11991 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.495911] binder: 11987:11991 BC_INCREFS_DONE u0000000000000003 no match [ 399.495917] binder: 11987:11991 ERROR: BC_REGISTER_LOOPER called without request 03:53:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 399.495925] binder: 11987:11991 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.495936] binder: 11987:11991 Release 1 refcount change on invalid ref 0 ret -22 [ 399.525945] binder: BINDER_SET_CONTEXT_MGR already set [ 399.525954] binder: 11985:11994 ioctl 40046207 0 returned -16 [ 399.526046] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.526067] binder: 11985:11994 transaction failed 29189/-3, size 72-24 line 3136 03:53:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:25 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:25 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.534681] binder: 11998:12002 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 399.534714] binder: 11998:12002 Release 1 refcount change on invalid ref 0 ret -22 [ 399.572987] binder: 12006:12013 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.572997] binder: 12006:12013 BC_INCREFS_DONE u0000000000000003 no match [ 399.573003] binder: 12006:12013 ERROR: BC_REGISTER_LOOPER called without request [ 399.573011] binder: 12006:12013 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.573023] binder: 12006:12013 Release 1 refcount change on invalid ref 0 ret -22 [ 399.582345] binder: BINDER_SET_CONTEXT_MGR already set [ 399.582354] binder: 12011:12014 ioctl 40046207 0 returned -16 03:53:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.582456] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.582476] binder: 12011:12014 transaction failed 29189/-3, size 72-24 line 3136 [ 399.598689] binder: 12017:12018 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.598699] binder: 12017:12018 BC_INCREFS_DONE u0000000000000003 no match [ 399.598705] binder: 12017:12018 ERROR: BC_REGISTER_LOOPER called without request 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 399.598713] binder: 12017:12018 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.598724] binder: 12017:12018 Release 1 refcount change on invalid ref 0 ret -22 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.635897] binder: BINDER_SET_CONTEXT_MGR already set [ 399.635906] binder: 12022:12027 ioctl 40046207 0 returned -16 [ 399.636061] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.636080] binder: 12022:12027 transaction failed 29189/-3, size 72-24 line 3136 [ 399.752588] binder: 12034:12037 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.752597] binder: 12034:12037 BC_INCREFS_DONE u0000000000000003 no match [ 399.752603] binder: 12034:12037 ERROR: BC_REGISTER_LOOPER called without request [ 399.752612] binder: 12034:12037 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 399.752620] binder: 12034:12037 Release 1 refcount change on invalid ref 0 ret -22 [ 399.759891] binder: BINDER_SET_CONTEXT_MGR already set [ 399.759901] binder: 12032:12042 ioctl 40046207 0 returned -16 [ 399.759992] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.760012] binder: 12032:12042 transaction failed 29189/-3, size 72-24 line 3136 [ 399.810925] binder: 12049:12056 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.810935] binder: 12049:12056 BC_INCREFS_DONE u0000000000000003 no match 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 399.810941] binder: 12049:12056 ERROR: BC_REGISTER_LOOPER called without request [ 399.810949] binder: 12049:12056 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.810960] binder: 12049:12056 Release 1 refcount change on invalid ref 0 ret -22 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 399.821331] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 399.821739] binder: 12055:12059 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 399.870005] binder: 12062:12066 Release 1 refcount change on invalid ref 0 ret -22 [ 399.998571] binder: BINDER_SET_CONTEXT_MGR already set [ 399.998580] binder: 12077:12087 ioctl 40046207 0 returned -16 [ 399.998671] binder_alloc: 7943: binder_alloc_buf, no vma [ 399.998700] binder: 12077:12087 transaction failed 29189/-3, size 72-24 line 3136 [ 399.999957] binder: 12078:12084 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 399.999966] binder: 12078:12084 BC_INCREFS_DONE u0000000000000003 no match [ 399.999973] binder: 12078:12084 ERROR: BC_REGISTER_LOOPER called without request [ 399.999981] binder: 12078:12084 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 399.999993] binder: 12078:12084 Release 1 refcount change on invalid ref 0 ret -22 03:53:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.046747] binder: 12092:12098 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.046756] binder: 12092:12098 BC_INCREFS_DONE u0000000000000003 no match [ 400.046761] binder: 12092:12098 ERROR: BC_REGISTER_LOOPER called without request [ 400.046769] binder: 12092:12098 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 400.046779] binder: 12092:12098 Release 1 refcount change on invalid ref 0 ret -22 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 400.076255] binder: BINDER_SET_CONTEXT_MGR already set 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 400.076264] binder: 12094:12101 ioctl 40046207 0 returned -16 ** 1 printk messages dropped ** [ 400.078326] binder: 12094:12101 transaction failed 29189/-3, size 72-24 line 3136 [ 400.101978] binder: 12107:12110 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.101988] binder: 12107:12110 BC_INCREFS_DONE u0000000000000003 no match [ 400.101994] binder: 12107:12110 ERROR: BC_REGISTER_LOOPER called without request [ 400.102003] binder: 12107:12110 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:26 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 400.102012] binder: 12107:12110 Release 1 refcount change on invalid ref 0 ret -22 [ 400.237888] binder: 12122:12126 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.237898] binder: 12122:12126 BC_INCREFS_DONE u0000000000000003 no match [ 400.237904] binder: 12122:12126 ERROR: BC_REGISTER_LOOPER called without request [ 400.237912] binder: 12122:12126 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 400.237922] binder: 12122:12126 Release 1 refcount change on invalid ref 0 ret -22 [ 400.259670] binder: BINDER_SET_CONTEXT_MGR already set [ 400.259687] binder: 12120:12130 ioctl 40046207 0 returned -16 [ 400.259786] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:26 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.259810] binder: 12120:12130 transaction failed 29189/-3, size 72-24 line 3136 ** 6 printk messages dropped ** [ 400.281917] binder: 12140:12141 BC_INCREFS_DONE u0000000000000003 no match ** 4 printk messages dropped ** [ 400.313442] binder: 12146:12150 ioctl 40046207 0 returned -16 [ 400.313550] binder_alloc: 7943: binder_alloc_buf, no vma [ 400.313568] binder: 12146:12150 transaction failed 29189/-3, size 72-24 line 3136 [ 400.474848] binder: BINDER_SET_CONTEXT_MGR already set [ 400.474857] binder: 12162:12168 ioctl 40046207 0 returned -16 03:53:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.474949] binder_alloc: 7943: binder_alloc_buf, no vma [ 400.474968] binder: 12162:12168 transaction failed 29189/-3, size 72-24 line 3136 [ 400.480392] binder: 12159:12169 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.480400] binder: 12159:12169 BC_INCREFS_DONE u0000000000000003 no match [ 400.480405] binder: 12159:12169 ERROR: BC_REGISTER_LOOPER called without request [ 400.480411] binder: 12159:12169 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 400.480421] binder: 12159:12169 Release 1 refcount change on invalid ref 0 ret -22 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.549514] binder: BINDER_SET_CONTEXT_MGR already set [ 400.549524] binder: 12183:12186 ioctl 40046207 0 returned -16 [ 400.549630] binder_alloc: 7943: binder_alloc_buf, no vma [ 400.549649] binder: 12183:12186 transaction failed 29189/-3, size 72-24 line 3136 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 400.712846] binder: 12203:12209 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.712856] binder: 12203:12209 BC_INCREFS_DONE u0000000000000003 no match [ 400.712861] binder: 12203:12209 ERROR: BC_REGISTER_LOOPER called without request [ 400.712870] binder: 12203:12209 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 7 printk messages dropped ** [ 400.782652] binder: 12230:12231 BC_INCREFS_DONE u0000000000000003 no match [ 400.782658] binder: 12230:12231 ERROR: BC_REGISTER_LOOPER called without request [ 400.782666] binder: 12230:12231 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 400.782675] binder: 12230:12231 Release 1 refcount change on invalid ref 0 ret -22 [ 400.948667] binder: 12250:12253 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 400.948677] binder: 12250:12253 BC_INCREFS_DONE u0000000000000003 no match [ 400.948682] binder: 12250:12253 ERROR: BC_REGISTER_LOOPER called without request [ 400.948691] binder: 12250:12253 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 400.948701] binder: 12250:12253 Release 1 refcount change on invalid ref 0 ret -22 [ 400.958441] binder: BINDER_SET_CONTEXT_MGR already set [ 400.958450] binder: 12252:12256 ioctl 40046207 0 returned -16 03:53:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 400.958551] binder_alloc: 7943: binder_alloc_buf, no vma [ 400.958569] binder: 12252:12256 transaction failed 29189/-3, size 72-24 line 3136 [ 401.020081] binder: 12264:12271 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 401.020091] binder: 12264:12271 BC_INCREFS_DONE u0000000000000003 no match [ 401.020097] binder: 12264:12271 ERROR: BC_REGISTER_LOOPER called without request [ 401.020105] binder: 12264:12271 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.020115] binder: 12264:12271 Release 1 refcount change on invalid ref 0 ret -22 [ 401.023349] binder: BINDER_SET_CONTEXT_MGR already set [ 401.023359] binder: 12265:12272 ioctl 40046207 0 returned -16 [ 401.023450] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.023468] binder: 12265:12272 transaction failed 29189/-3, size 72-24 line 3136 [ 401.234959] binder: 12292:12302 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.234971] binder: 12292:12302 BC_INCREFS_DONE u0000000000000003 no match [ 401.234977] binder: 12292:12302 ERROR: BC_REGISTER_LOOPER called without request [ 401.234986] binder: 12292:12302 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.234998] binder: 12292:12302 Release 1 refcount change on invalid ref 0 ret -22 [ 401.265601] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.265620] binder: 12293:12299 transaction failed 29189/-3, size 72-24 line 3136 [ 401.269475] binder: 12309:12311 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 401.269484] binder: 12309:12311 BC_INCREFS_DONE u0000000000000003 no match [ 401.269489] binder: 12309:12311 ERROR: BC_REGISTER_LOOPER called without request [ 401.269498] binder: 12309:12311 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 401.269509] binder: 12309:12311 Release 1 refcount change on invalid ref 0 ret -22 [ 401.311289] binder: BINDER_SET_CONTEXT_MGR already set [ 401.311298] binder: 12318:12322 ioctl 40046207 0 returned -16 [ 401.311437] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.311456] binder: 12318:12322 transaction failed 29189/-3, size 72-24 line 3136 [ 401.321954] binder: 12323:12324 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.321964] binder: 12323:12324 BC_INCREFS_DONE u0000000000000003 no match [ 401.321969] binder: 12323:12324 ERROR: BC_REGISTER_LOOPER called without request [ 401.321977] binder: 12323:12324 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.321988] binder: 12323:12324 Release 1 refcount change on invalid ref 0 ret -22 [ 401.458188] binder: BINDER_SET_CONTEXT_MGR already set [ 401.458197] binder: 12334:12340 ioctl 40046207 0 returned -16 [ 401.458289] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 401.458307] binder: 12334:12340 transaction failed 29189/-3, size 72-24 line 3136 [ 401.480003] binder: 12339:12343 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.480012] binder: 12339:12343 BC_INCREFS_DONE u0000000000000003 no match 03:53:27 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 401.480018] binder: 12339:12343 ERROR: BC_REGISTER_LOOPER called without request 03:53:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:27 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:27 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 401.480027] binder: 12339:12343 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 ** 7 printk messages dropped ** [ 401.530488] binder: 12358:12363 ERROR: BC_REGISTER_LOOPER called without request [ 401.530496] binder: 12358:12363 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.530506] binder: 12358:12363 Release 1 refcount change on invalid ref 0 ret -22 [ 401.707477] binder: BINDER_SET_CONTEXT_MGR already set [ 401.707486] binder: 12378:12386 ioctl 40046207 0 returned -16 [ 401.707581] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.707600] binder: 12378:12386 transaction failed 29189/-3, size 72-24 line 3136 03:53:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 401.755457] binder: 12380:12382 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 401.755466] binder: 12380:12382 BC_INCREFS_DONE u0000000000000003 no match [ 401.755472] binder: 12380:12382 ERROR: BC_REGISTER_LOOPER called without request [ 401.755480] binder: 12380:12382 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.755491] binder: 12380:12382 Release 1 refcount change on invalid ref 0 ret -22 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 401.765378] binder: BINDER_SET_CONTEXT_MGR already set [ 401.765389] binder: 12393:12400 ioctl 40046207 0 returned -16 [ 401.765620] binder_alloc: 7943: binder_alloc_buf, no vma [ 401.765640] binder: 12393:12400 transaction failed 29189/-3, size 72-24 line 3136 ** 2 printk messages dropped ** [ 401.800068] binder: 12405:12407 ERROR: BC_REGISTER_LOOPER called without request [ 401.800076] binder: 12405:12407 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 401.800087] binder: 12405:12407 Release 1 refcount change on invalid ref 0 ret -22 03:53:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 402.010519] binder: 12425:12428 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.010529] binder: 12425:12428 BC_INCREFS_DONE u0000000000000003 no match [ 402.010534] binder: 12425:12428 ERROR: BC_REGISTER_LOOPER called without request [ 402.010542] binder: 12425:12428 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.010551] binder: 12425:12428 Release 1 refcount change on invalid ref 0 ret -22 [ 402.015722] binder: BINDER_SET_CONTEXT_MGR already set [ 402.015731] binder: 12423:12432 ioctl 40046207 0 returned -16 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 402.015823] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.015842] binder: 12423:12432 transaction failed 29189/-3, size 72-24 line 3136 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 402.079061] binder: 12447:12451 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 1 printk messages dropped ** [ 402.079075] binder: 12447:12451 ERROR: BC_REGISTER_LOOPER called without request ** 2 printk messages dropped ** [ 402.246425] binder: BINDER_SET_CONTEXT_MGR already set [ 402.246434] binder: 12467:12473 ioctl 40046207 0 returned -16 [ 402.246534] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.246554] binder: 12467:12473 transaction failed 29189/-3, size 72-24 line 3136 [ 402.251516] binder: 12469:12474 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 402.251526] binder: 12469:12474 BC_INCREFS_DONE u0000000000000003 no match [ 402.251532] binder: 12469:12474 ERROR: BC_REGISTER_LOOPER called without request [ 402.251540] binder: 12469:12474 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.251549] binder: 12469:12474 Release 1 refcount change on invalid ref 0 ret -22 [ 402.279001] binder: BINDER_SET_CONTEXT_MGR already set [ 402.279010] binder: 12478:12481 ioctl 40046207 0 returned -16 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 402.279111] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 402.279130] binder: 12478:12481 transaction failed 29189/-3, size 72-24 line 3136 [ 402.302097] binder: 12480:12483 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 402.302129] binder: 12480:12483 Release 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 402.339361] binder: 12488:12494 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.339372] binder: 12488:12494 BC_INCREFS_DONE u0000000000000003 no match [ 402.339378] binder: 12488:12494 ERROR: BC_REGISTER_LOOPER called without request 03:53:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:28 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 402.339386] binder: 12488:12494 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.339397] binder: 12488:12494 Release 1 refcount change on invalid ref 0 ret -22 [ 402.500977] binder: 12508:12513 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.500988] binder: 12508:12513 BC_INCREFS_DONE u0000000000000003 no match [ 402.500994] binder: 12508:12513 ERROR: BC_REGISTER_LOOPER called without request [ 402.501002] binder: 12508:12513 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:28 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 402.501011] binder: 12508:12513 Release 1 refcount change on invalid ref 0 ret -22 [ 402.518043] binder: BINDER_SET_CONTEXT_MGR already set [ 402.518051] binder: 12507:12515 ioctl 40046207 0 returned -16 03:53:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) ** 2 printk messages dropped ** [ 402.568423] binder: 12521:12522 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 8 printk messages dropped ** [ 402.740936] binder: 12546:12550 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.740946] binder: 12546:12550 BC_INCREFS_DONE u0000000000000003 no match [ 402.740952] binder: 12546:12550 ERROR: BC_REGISTER_LOOPER called without request [ 402.740960] binder: 12546:12550 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.740969] binder: 12546:12550 Release 1 refcount change on invalid ref 0 ret -22 [ 402.747779] binder: BINDER_SET_CONTEXT_MGR already set [ 402.747789] binder: 12547:12551 ioctl 40046207 0 returned -16 [ 402.747883] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.747902] binder: 12547:12551 transaction failed 29189/-3, size 72-24 line 3136 [ 402.787805] binder: BINDER_SET_CONTEXT_MGR already set [ 402.787814] binder: 12558:12562 ioctl 40046207 0 returned -16 [ 402.787919] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.787937] binder: 12558:12562 transaction failed 29189/-3, size 72-24 line 3136 [ 402.815550] binder: 12556:12563 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.815559] binder: 12556:12563 BC_INCREFS_DONE u0000000000000003 no match 03:53:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 402.815564] binder: 12556:12563 ERROR: BC_REGISTER_LOOPER called without request [ 402.815572] binder: 12556:12563 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.815582] binder: 12556:12563 Release 1 refcount change on invalid ref 0 ret -22 [ 402.819759] binder: BINDER_SET_CONTEXT_MGR already set 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 402.819767] binder: 12567:12568 ioctl 40046207 0 returned -16 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 402.819858] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.819875] binder: 12567:12568 transaction failed 29189/-3, size 72-24 line 3136 [ 402.864210] binder: 12575:12577 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 402.864219] binder: 12575:12577 BC_INCREFS_DONE u0000000000000003 no match [ 402.864225] binder: 12575:12577 ERROR: BC_REGISTER_LOOPER called without request [ 402.864233] binder: 12575:12577 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 402.864242] binder: 12575:12577 Release 1 refcount change on invalid ref 0 ret -22 [ 402.998019] binder: BINDER_SET_CONTEXT_MGR already set [ 402.998028] binder: 12591:12594 ioctl 40046207 0 returned -16 [ 402.998117] binder_alloc: 7943: binder_alloc_buf, no vma [ 402.998137] binder: 12591:12594 transaction failed 29189/-3, size 72-24 line 3136 03:53:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 403.007240] binder: 12589:12597 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.007249] binder: 12589:12597 BC_INCREFS_DONE u0000000000000003 no match [ 403.007255] binder: 12589:12597 ERROR: BC_REGISTER_LOOPER called without request [ 403.007263] binder: 12589:12597 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.007273] binder: 12589:12597 Release 1 refcount change on invalid ref 0 ret -22 [ 403.034078] binder: 12601:12602 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 403.034087] binder: 12601:12602 BC_INCREFS_DONE u0000000000000003 no match [ 403.034093] binder: 12601:12602 ERROR: BC_REGISTER_LOOPER called without request [ 403.034102] binder: 12601:12602 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 403.034111] binder: 12601:12602 Release 1 refcount change on invalid ref 0 ret -22 [ 403.067863] binder: 12603:12606 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 403.067895] binder: 12603:12606 Release 1 refcount change on invalid ref 0 ret -22 [ 403.075461] binder: BINDER_SET_CONTEXT_MGR already set [ 403.075469] binder: 12609:12613 ioctl 40046207 0 returned -16 [ 403.075570] binder_alloc: 7943: binder_alloc_buf, no vma [ 403.075588] binder: 12609:12613 transaction failed 29189/-3, size 72-24 line 3136 [ 403.237617] binder: 12626:12628 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.237627] binder: 12626:12628 BC_INCREFS_DONE u0000000000000003 no match [ 403.237632] binder: 12626:12628 ERROR: BC_REGISTER_LOOPER called without request [ 403.237641] binder: 12626:12628 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.237651] binder: 12626:12628 Release 1 refcount change on invalid ref 0 ret -22 [ 403.262201] binder: 12638:12639 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.262211] binder: 12638:12639 BC_INCREFS_DONE u0000000000000003 no match 03:53:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 403.262217] binder: 12638:12639 ERROR: BC_REGISTER_LOOPER called without request [ 403.262224] binder: 12638:12639 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.262234] binder: 12638:12639 Release 1 refcount change on invalid ref 0 ret -22 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 403.283163] binder: BINDER_SET_CONTEXT_MGR already set 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 403.283174] binder: 12627:12641 ioctl 40046207 0 returned -16 [ 403.283326] binder_alloc: 7943: binder_alloc_buf, no vma [ 403.283359] binder: 12627:12641 transaction failed 29189/-3, size 72-24 line 3136 ** 4 printk messages dropped ** [ 403.350683] binder: 12653:12660 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.350692] binder: 12653:12660 BC_INCREFS_DONE u0000000000000003 no match [ 403.350697] binder: 12653:12660 ERROR: BC_REGISTER_LOOPER called without request [ 403.350705] binder: 12653:12660 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.350715] binder: 12653:12660 Release 1 refcount change on invalid ref 0 ret -22 [ 403.515431] binder: BINDER_SET_CONTEXT_MGR already set [ 403.515439] binder: 12668:12677 ioctl 40046207 0 returned -16 [ 403.516244] binder_alloc: 7943: binder_alloc_buf, no vma [ 403.516264] binder: 12668:12677 transaction failed 29189/-3, size 72-24 line 3136 [ 403.531514] binder: 12674:12679 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.531523] binder: 12674:12679 BC_INCREFS_DONE u0000000000000003 no match 03:53:29 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:29 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:29 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 403.531529] binder: 12674:12679 ERROR: BC_REGISTER_LOOPER called without request [ 403.531537] binder: 12674:12679 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.531548] binder: 12674:12679 Release 1 refcount change on invalid ref 0 ret -22 [ 403.575561] binder: BINDER_SET_CONTEXT_MGR already set [ 403.575571] binder: 12688:12689 ioctl 40046207 0 returned -16 [ 403.575662] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 403.575681] binder: 12688:12689 transaction failed 29189/-3, size 72-24 line 3136 [ 403.597058] binder: 12696:12700 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.597067] binder: 12696:12700 BC_INCREFS_DONE u0000000000000003 no match [ 403.597072] binder: 12696:12700 ERROR: BC_REGISTER_LOOPER called without request [ 403.597079] binder: 12696:12700 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.597090] binder: 12696:12700 Release 1 refcount change on invalid ref 0 ret -22 [ 403.771027] binder: 12713:12720 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 403.771037] binder: 12713:12720 BC_INCREFS_DONE u0000000000000003 no match [ 403.771042] binder: 12713:12720 ERROR: BC_REGISTER_LOOPER called without request [ 403.771050] binder: 12713:12720 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 403.771061] binder: 12713:12720 Release 1 refcount change on invalid ref 0 ret -22 [ 403.775754] binder: BINDER_SET_CONTEXT_MGR already set [ 403.775764] binder: 12710:12718 ioctl 40046207 0 returned -16 [ 403.775856] binder_alloc: 7943: binder_alloc_buf, no vma [ 403.775875] binder: 12710:12718 transaction failed 29189/-3, size 72-24 line 3136 [ 403.823692] binder: 12724:12727 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 403.823702] binder: 12724:12727 BC_INCREFS_DONE u0000000000000003 no match [ 403.823707] binder: 12724:12727 ERROR: BC_REGISTER_LOOPER called without request ** 3 printk messages dropped ** [ 403.861358] binder: 12733:12735 ioctl 40046207 0 returned -16 ** 3 printk messages dropped ** [ 403.876448] binder: 12738:12741 BC_INCREFS_DONE u0000000000000003 no match [ 403.876454] binder: 12738:12741 ERROR: BC_REGISTER_LOOPER called without request [ 403.876463] binder: 12738:12741 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 403.876474] binder: 12738:12741 Release 1 refcount change on invalid ref 0 ret -22 [ 404.041617] binder: 12756:12758 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.041629] binder: 12756:12758 BC_INCREFS_DONE u0000000000000003 no match 03:53:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 404.041635] binder: 12756:12758 ERROR: BC_REGISTER_LOOPER called without request [ 404.041643] binder: 12756:12758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 404.041653] binder: 12756:12758 Release 1 refcount change on invalid ref 0 ret -22 [ 404.046887] binder: BINDER_SET_CONTEXT_MGR already set [ 404.046895] binder: 12754:12762 ioctl 40046207 0 returned -16 [ 404.047189] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 404.047210] binder: 12754:12762 transaction failed 29189/-3, size 72-24 line 3136 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 404.115246] binder: 12770:12776 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 3 printk messages dropped ** [ 404.115281] binder: 12770:12776 Release 1 refcount change on invalid ref 0 ret -22 [ 404.164810] binder: BINDER_SET_CONTEXT_MGR already set [ 404.164819] binder: 12774:12783 ioctl 40046207 0 returned -16 [ 404.164930] binder_alloc: 7943: binder_alloc_buf, no vma [ 404.164950] binder: 12774:12783 transaction failed 29189/-3, size 72-24 line 3136 [ 404.286337] binder: 12795:12800 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.286347] binder: 12795:12800 BC_INCREFS_DONE u0000000000000003 no match [ 404.286353] binder: 12795:12800 ERROR: BC_REGISTER_LOOPER called without request 03:53:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 404.286360] binder: 12795:12800 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 404.286372] binder: 12795:12800 Release 1 refcount change on invalid ref 0 ret -22 [ 404.321928] binder: 12808:12813 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.321937] binder: 12808:12813 BC_INCREFS_DONE u0000000000000003 no match 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 404.321943] binder: 12808:12813 ERROR: BC_REGISTER_LOOPER called without request ** 4 printk messages dropped ** [ 404.376627] binder: 12821:12824 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.376636] binder: 12821:12824 BC_INCREFS_DONE u0000000000000003 no match [ 404.376641] binder: 12821:12824 ERROR: BC_REGISTER_LOOPER called without request [ 404.376649] binder: 12821:12824 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 404.376660] binder: 12821:12824 Release 1 refcount change on invalid ref 0 ret -22 [ 404.513829] binder: BINDER_SET_CONTEXT_MGR already set [ 404.513838] binder: 12835:12839 ioctl 40046207 0 returned -16 [ 404.513933] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:30 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:30 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 404.513951] binder: 12835:12839 transaction failed 29189/-3, size 72-24 line 3136 [ 404.524164] binder: 12838:12840 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.524173] binder: 12838:12840 BC_INCREFS_DONE u0000000000000003 no match [ 404.524179] binder: 12838:12840 ERROR: BC_REGISTER_LOOPER called without request [ 404.524186] binder: 12838:12840 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 404.524197] binder: 12838:12840 Release 1 refcount change on invalid ref 0 ret -22 03:53:30 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 404.583648] binder: BINDER_SET_CONTEXT_MGR already set 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 404.583655] binder: 12850:12855 ioctl 40046207 0 returned -16 [ 404.583781] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 404.583800] binder: 12850:12855 transaction failed 29189/-3, size 72-24 line 3136 [ 404.612501] binder: 12848:12853 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 4 printk messages dropped ** [ 404.643381] binder: BINDER_SET_CONTEXT_MGR already set 03:53:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 404.643390] binder: 12865:12868 ioctl 40046207 0 returned -16 [ 404.643561] binder_alloc: 7943: binder_alloc_buf, no vma [ 404.643580] binder: 12865:12868 transaction failed 29189/-3, size 72-24 line 3136 [ 404.776906] binder: 12876:12883 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 404.776917] binder: 12876:12883 BC_INCREFS_DONE u0000000000000003 no match [ 404.776923] binder: 12876:12883 ERROR: BC_REGISTER_LOOPER called without request [ 404.776933] binder: 12876:12883 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 404.776943] binder: 12876:12883 Release 1 refcount change on invalid ref 0 ret -22 [ 404.779651] binder: BINDER_SET_CONTEXT_MGR already set 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) ** 9 printk messages dropped ** [ 404.855812] binder: 12895:12900 ERROR: BC_REGISTER_LOOPER called without request ** 5 printk messages dropped ** [ 404.866293] binder: 12904:12906 transaction failed 29189/-3, size 72-24 line 3136 [ 405.033762] binder: BINDER_SET_CONTEXT_MGR already set [ 405.033771] binder: 12922:12925 ioctl 40046207 0 returned -16 [ 405.033864] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.033883] binder: 12922:12925 transaction failed 29189/-3, size 72-24 line 3136 [ 405.042097] binder: 12919:12927 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 405.042107] binder: 12919:12927 BC_INCREFS_DONE u0000000000000003 no match [ 405.042113] binder: 12919:12927 ERROR: BC_REGISTER_LOOPER called without request [ 405.042121] binder: 12919:12927 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.042131] binder: 12919:12927 Release 1 refcount change on invalid ref 0 ret -22 03:53:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 405.128307] binder: 12946:12952 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 405.128317] binder: 12946:12952 BC_INCREFS_DONE u0000000000000003 no match 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) ** 2 printk messages dropped ** [ 405.128342] binder: 12946:12952 Release 1 refcount change on invalid ref 0 ret -22 ** 3 printk messages dropped ** [ 405.177356] binder: 12950:12961 transaction failed 29189/-3, size 72-24 line 3136 [ 405.278176] binder: BINDER_SET_CONTEXT_MGR already set [ 405.278185] binder: 12968:12970 ioctl 40046207 0 returned -16 [ 405.278285] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.278304] binder: 12968:12970 transaction failed 29189/-3, size 72-24 line 3136 [ 405.289248] binder: 12964:12973 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 405.289257] binder: 12964:12973 BC_INCREFS_DONE u0000000000000003 no match [ 405.289263] binder: 12964:12973 ERROR: BC_REGISTER_LOOPER called without request [ 405.289271] binder: 12964:12973 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.289280] binder: 12964:12973 Release 1 refcount change on invalid ref 0 ret -22 03:53:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 405.355582] binder: BINDER_SET_CONTEXT_MGR already set [ 405.355591] binder: 12985:12989 ioctl 40046207 0 returned -16 [ 405.355783] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.355802] binder: 12985:12989 transaction failed 29189/-3, size 72-24 line 3136 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 405.359250] binder: 12982:12991 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 1 printk messages dropped ** [ 405.359266] binder: 12982:12991 ERROR: BC_REGISTER_LOOPER called without request ** 4 printk messages dropped ** [ 405.544837] binder: 13006:13009 ERROR: BC_REGISTER_LOOPER called without request [ 405.544845] binder: 13006:13009 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.544854] binder: 13006:13009 Release 1 refcount change on invalid ref 0 ret -22 [ 405.577142] binder: BINDER_SET_CONTEXT_MGR already set [ 405.577153] binder: 13004:13011 ioctl 40046207 0 returned -16 [ 405.577295] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.577317] binder: 13004:13011 transaction failed 29189/-3, size 72-24 line 3136 03:53:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:31 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 405.617941] binder: 13017:13021 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 405.617952] binder: 13017:13021 BC_INCREFS_DONE u0000000000000003 no match [ 405.617958] binder: 13017:13021 ERROR: BC_REGISTER_LOOPER called without request [ 405.617966] binder: 13017:13021 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.617977] binder: 13017:13021 Release 1 refcount change on invalid ref 0 ret -22 [ 405.619270] binder: BINDER_SET_CONTEXT_MGR already set [ 405.619279] binder: 13018:13023 ioctl 40046207 0 returned -16 03:53:31 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 405.619701] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.619720] binder: 13018:13023 transaction failed 29189/-3, size 72-24 line 3136 [ 405.712557] binder: BINDER_SET_CONTEXT_MGR already set [ 405.712566] binder: 13044:13047 ioctl 40046207 0 returned -16 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 405.712783] binder_alloc: 7943: binder_alloc_buf, no vma ** 3 printk messages dropped ** [ 405.723400] binder: 13038:13046 ERROR: BC_REGISTER_LOOPER called without request [ 405.723408] binder: 13038:13046 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.723418] binder: 13038:13046 Release 1 refcount change on invalid ref 0 ret -22 [ 405.864096] binder: BINDER_SET_CONTEXT_MGR already set [ 405.864104] binder: 13063:13068 ioctl 40046207 0 returned -16 [ 405.864196] binder_alloc: 7943: binder_alloc_buf, no vma [ 405.864215] binder: 13063:13068 transaction failed 29189/-3, size 72-24 line 3136 [ 405.881173] binder: 13064:13074 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 405.881182] binder: 13064:13074 BC_INCREFS_DONE u0000000000000003 no match 03:53:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 405.881188] binder: 13064:13074 ERROR: BC_REGISTER_LOOPER called without request [ 405.881196] binder: 13064:13074 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 405.881207] binder: 13064:13074 Release 1 refcount change on invalid ref 0 ret -22 [ 405.956067] binder: BINDER_SET_CONTEXT_MGR already set [ 405.956076] binder: 13082:13090 ioctl 40046207 0 returned -16 [ 405.956169] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 405.956186] binder: 13082:13090 transaction failed 29189/-3, size 72-24 line 3136 [ 405.960104] binder: 13088:13091 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 405.960113] binder: 13088:13091 BC_INCREFS_DONE u0000000000000003 no match ** 6 printk messages dropped ** [ 406.088295] binder: 13107:13113 transaction failed 29189/-3, size 72-24 line 3136 [ 406.092677] binder: 13108:13115 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.092695] binder: 13108:13115 BC_INCREFS_DONE u0000000000000003 no match 03:53:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 406.092701] binder: 13108:13115 ERROR: BC_REGISTER_LOOPER called without request [ 406.092710] binder: 13108:13115 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.092719] binder: 13108:13115 Release 1 refcount change on invalid ref 0 ret -22 [ 406.172044] binder: BINDER_SET_CONTEXT_MGR already set 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) ** 2 printk messages dropped ** [ 406.172177] binder: 13132:13138 transaction failed 29189/-3, size 72-24 line 3136 [ 406.182512] binder: 13121:13142 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) ** 1 printk messages dropped ** [ 406.182527] binder: 13121:13142 ERROR: BC_REGISTER_LOOPER called without request ** 8 printk messages dropped ** [ 406.342148] binder: 13155:13163 ERROR: BC_REGISTER_LOOPER called without request [ 406.342154] binder: 13155:13163 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.342162] binder: 13155:13163 Release 1 refcount change on invalid ref 0 ret -22 [ 406.386243] binder: 13169:13172 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 406.386252] binder: 13169:13172 BC_INCREFS_DONE u0000000000000003 no match [ 406.386258] binder: 13169:13172 ERROR: BC_REGISTER_LOOPER called without request [ 406.386266] binder: 13169:13172 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.386277] binder: 13169:13172 Release 1 refcount change on invalid ref 0 ret -22 [ 406.398456] binder: BINDER_SET_CONTEXT_MGR already set [ 406.398465] binder: 13171:13173 ioctl 40046207 0 returned -16 [ 406.398561] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 406.398581] binder: 13171:13173 transaction failed 29189/-3, size 72-24 line 3136 [ 406.444235] binder: 13182:13185 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.444245] binder: 13182:13185 BC_INCREFS_DONE u0000000000000003 no match ** 3 printk messages dropped ** [ 406.593065] binder: BINDER_SET_CONTEXT_MGR already set [ 406.593074] binder: 13193:13204 ioctl 40046207 0 returned -16 [ 406.593168] binder_alloc: 7943: binder_alloc_buf, no vma [ 406.593186] binder: 13193:13204 transaction failed 29189/-3, size 72-24 line 3136 [ 406.606871] binder: 13197:13207 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.606880] binder: 13197:13207 BC_INCREFS_DONE u0000000000000003 no match 03:53:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:32 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 406.606885] binder: 13197:13207 ERROR: BC_REGISTER_LOOPER called without request [ 406.606893] binder: 13197:13207 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.606905] binder: 13197:13207 Release 1 refcount change on invalid ref 0 ret -22 [ 406.653648] binder: BINDER_SET_CONTEXT_MGR already set [ 406.653657] binder: 13218:13222 ioctl 40046207 0 returned -16 [ 406.653764] binder_alloc: 7943: binder_alloc_buf, no vma [ 406.653784] binder: 13218:13222 transaction failed 29189/-3, size 72-24 line 3136 03:53:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 406.663925] binder: 13219:13224 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 406.663934] binder: 13219:13224 BC_INCREFS_DONE u0000000000000003 no match ** 3 printk messages dropped ** [ 406.808299] binder: BINDER_SET_CONTEXT_MGR already set ** 5 printk messages dropped ** [ 406.816636] binder: 13242:13244 ERROR: BC_REGISTER_LOOPER called without request [ 406.816643] binder: 13242:13244 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.816651] binder: 13242:13244 Release 1 refcount change on invalid ref 0 ret -22 [ 406.862269] binder: 13248:13252 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.862277] binder: 13248:13252 BC_INCREFS_DONE u0000000000000003 no match [ 406.862281] binder: 13248:13252 ERROR: BC_REGISTER_LOOPER called without request [ 406.862288] binder: 13248:13252 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.862355] binder: 13248:13252 Release 1 refcount change on invalid ref 0 ret -22 03:53:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 406.864148] binder: BINDER_SET_CONTEXT_MGR already set [ 406.864159] binder: 13251:13253 ioctl 40046207 0 returned -16 [ 406.864286] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 406.864306] binder: 13251:13253 transaction failed 29189/-3, size 72-24 line 3136 ** 6 printk messages dropped ** [ 406.935248] binder: 13259:13266 ERROR: BC_REGISTER_LOOPER called without request [ 406.935256] binder: 13259:13266 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 406.935265] binder: 13259:13266 Release 1 refcount change on invalid ref 0 ret -22 [ 406.975400] binder: BINDER_SET_CONTEXT_MGR already set [ 406.975410] binder: 13273:13281 ioctl 40046207 0 returned -16 [ 406.975522] binder_alloc: 7943: binder_alloc_buf, no vma [ 406.975541] binder: 13273:13281 transaction failed 29189/-3, size 72-24 line 3136 03:53:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 406.993790] binder: 13278:13285 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 406.993799] binder: 13278:13285 BC_INCREFS_DONE u0000000000000003 no match [ 406.993805] binder: 13278:13285 ERROR: BC_REGISTER_LOOPER called without request [ 406.993813] binder: 13278:13285 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 406.993824] binder: 13278:13285 Release 1 refcount change on invalid ref 0 ret -22 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 407.112808] binder: BINDER_SET_CONTEXT_MGR already set ** 2 printk messages dropped ** [ 407.112967] binder: 13292:13296 transaction failed 29189/-3, size 72-24 line 3136 ** 2 printk messages dropped ** [ 407.117080] binder: 13297:13303 ERROR: BC_REGISTER_LOOPER called without request [ 407.117089] binder: 13297:13303 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.117098] binder: 13297:13303 Release 1 refcount change on invalid ref 0 ret -22 [ 407.165859] binder: BINDER_SET_CONTEXT_MGR already set [ 407.165868] binder: 13307:13311 ioctl 40046207 0 returned -16 [ 407.165971] binder_alloc: 7943: binder_alloc_buf, no vma [ 407.165989] binder: 13307:13311 transaction failed 29189/-3, size 72-24 line 3136 03:53:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 407.197906] binder: BINDER_SET_CONTEXT_MGR already set [ 407.197916] binder: 13320:13326 ioctl 40046207 0 returned -16 [ 407.198020] binder_alloc: 7943: binder_alloc_buf, no vma [ 407.198039] binder: 13320:13326 transaction failed 29189/-3, size 72-24 line 3136 [ 407.212181] binder: 13317:13325 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 407.212196] binder: 13317:13325 BC_INCREFS_DONE u0000000000000003 no match 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 407.212281] binder: 13317:13325 ERROR: BC_REGISTER_LOOPER called without request [ 407.212291] binder: 13317:13325 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.212304] binder: 13317:13325 Release 1 refcount change on invalid ref 0 ret -22 ** 3 printk messages dropped ** [ 407.344308] binder: 13338:13344 transaction failed 29189/-3, size 72-24 line 3136 [ 407.345736] binder: 13339:13345 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 407.345745] binder: 13339:13345 BC_INCREFS_DONE u0000000000000003 no match [ 407.345750] binder: 13339:13345 ERROR: BC_REGISTER_LOOPER called without request [ 407.345758] binder: 13339:13345 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.345767] binder: 13339:13345 Release 1 refcount change on invalid ref 0 ret -22 [ 407.397773] binder: BINDER_SET_CONTEXT_MGR already set [ 407.397781] binder: 13349:13358 ioctl 40046207 0 returned -16 [ 407.397887] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 407.397905] binder: 13349:13358 transaction failed 29189/-3, size 72-24 line 3136 [ 407.408842] binder: 13353:13362 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:33 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:33 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:33 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 407.408852] binder: 13353:13362 BC_INCREFS_DONE u0000000000000003 no match ** 2 printk messages dropped ** [ 407.408879] binder: 13353:13362 Release 1 refcount change on invalid ref 0 ret -22 ** 4 printk messages dropped ** [ 407.574065] binder: 13383:13392 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 407.577454] binder: 13383:13392 BC_INCREFS_DONE u0000000000000003 no match [ 407.577460] binder: 13383:13392 ERROR: BC_REGISTER_LOOPER called without request [ 407.577469] binder: 13383:13392 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.577481] binder: 13383:13392 Release 1 refcount change on invalid ref 0 ret -22 [ 407.584691] binder: BINDER_SET_CONTEXT_MGR already set [ 407.584699] binder: 13379:13385 ioctl 40046207 0 returned -16 [ 407.584822] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 407.584842] binder: 13379:13385 transaction failed 29189/-3, size 72-24 line 3136 [ 407.642975] binder: BINDER_SET_CONTEXT_MGR already set [ 407.642984] binder: 13397:13406 ioctl 40046207 0 returned -16 [ 407.643553] binder_alloc: 7943: binder_alloc_buf, no vma [ 407.643570] binder: 13397:13406 transaction failed 29189/-3, size 72-24 line 3136 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 407.650441] binder: 13398:13408 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 4 printk messages dropped ** [ 407.683999] binder: 13415:13417 DecRefs 0 refcount change on invalid ref 1 ret -22 ** 8 printk messages dropped ** [ 407.844022] binder: 13430:13436 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 407.844032] binder: 13430:13436 BC_INCREFS_DONE u0000000000000003 no match [ 407.844038] binder: 13430:13436 ERROR: BC_REGISTER_LOOPER called without request [ 407.844046] binder: 13430:13436 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.844057] binder: 13430:13436 Release 1 refcount change on invalid ref 0 ret -22 [ 407.877979] binder: BINDER_SET_CONTEXT_MGR already set 03:53:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 407.877988] binder: 13440:13447 ioctl 40046207 0 returned -16 [ 407.878096] binder_alloc: 7943: binder_alloc_buf, no vma [ 407.878116] binder: 13440:13447 transaction failed 29189/-3, size 72-24 line 3136 [ 407.907828] binder: 13454:13462 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 407.907838] binder: 13454:13462 BC_INCREFS_DONE u0000000000000003 no match [ 407.907844] binder: 13454:13462 ERROR: BC_REGISTER_LOOPER called without request 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 407.907852] binder: 13454:13462 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 407.907864] binder: 13454:13462 Release 1 refcount change on invalid ref 0 ret -22 [ 408.037300] binder: BINDER_SET_CONTEXT_MGR already set 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 408.037309] binder: 13471:13474 ioctl 40046207 0 returned -16 ** 2 printk messages dropped ** [ 408.045992] binder: 13469:13475 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 408.046000] binder: 13469:13475 BC_INCREFS_DONE u0000000000000003 no match [ 408.046004] binder: 13469:13475 ERROR: BC_REGISTER_LOOPER called without request [ 408.046011] binder: 13469:13475 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 408.046018] binder: 13469:13475 Release 1 refcount change on invalid ref 0 ret -22 [ 408.071515] binder: 13481:13482 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 408.071524] binder: 13481:13482 BC_INCREFS_DONE u0000000000000003 no match [ 408.071530] binder: 13481:13482 ERROR: BC_REGISTER_LOOPER called without request [ 408.071537] binder: 13481:13482 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 03:53:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) [ 408.071547] binder: 13481:13482 Release 1 refcount change on invalid ref 0 ret -22 [ 408.123388] binder: BINDER_SET_CONTEXT_MGR already set [ 408.123398] binder: 13493:13496 ioctl 40046207 0 returned -16 [ 408.123505] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) [ 408.123524] binder: 13493:13496 transaction failed 29189/-3, size 72-24 line 3136 [ 408.130133] binder: 13499:13502 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) ** 3 printk messages dropped ** [ 408.130166] binder: 13499:13502 Release 1 refcount change on invalid ref 0 ret -22 ** 2 printk messages dropped ** [ 408.286623] binder: 13516:13519 ERROR: BC_REGISTER_LOOPER called without request [ 408.286631] binder: 13516:13519 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 408.286640] binder: 13516:13519 Release 1 refcount change on invalid ref 0 ret -22 [ 408.294589] binder: BINDER_SET_CONTEXT_MGR already set [ 408.294597] binder: 13515:13518 ioctl 40046207 0 returned -16 [ 408.294689] binder_alloc: 7943: binder_alloc_buf, no vma 03:53:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x0, 0x300) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0x4003ff) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000180)) lseek(r2, 0x0, 0x4) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f00000000c0)) fstat(r2, &(0x7f00000001c0)) close(r1) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)={0x80000000}) 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 408.294708] binder: 13515:13518 transaction failed 29189/-3, size 72-24 line 3136 [ 408.354275] binder: BINDER_SET_CONTEXT_MGR already set [ 408.354284] binder: 13524:13532 ioctl 40046207 0 returned -16 [ 408.354392] binder_alloc: 7943: binder_alloc_buf, no vma [ 408.354411] binder: 13524:13532 transaction failed 29189/-3, size 72-24 line 3136 03:53:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x38, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x1}, @increfs_done={0x40106308, 0x3}, @register_looper, @clear_death={0x400c630f, 0x1}, @release], 0xd, 0x0, &(0x7f0000000100)="ba0d0bb4611bbd660d716e5ce8"}) 03:53:34 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x8}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) 03:53:34 executing program 3: setxattr$security_smack_transmute(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x3) pipe2(&(0x7f0000000a40)={0xffffffffffffffff}, 0x2000000000083ffc) accept4$packet(0xffffffffffffff9c, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000004c0)=0x14, 0x800) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000005c0)={@ipv4={[], [], @rand_addr=0x4d402332}, @remote, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x100000001, 0x8bfd, 0xd0, 0x400, 0x7, 0x40, r1}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$evdev(&(0x7f0000000240)='/dev/input/event#\x00', 0xc000000000, 0x40001) r5 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000800)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, r5) fadvise64(r2, 0x0, 0xae2, 0x5) keyctl$revoke(0x3, r5) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101080, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000740)={0x0, @empty}, &(0x7f0000000780)=0xc) setsockopt$inet6_mreq(r6, 0x29, 0x0, &(0x7f00000007c0)={@loopback, r7}, 0x14) write$P9_RREADLINK(r6, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000003c0)=0x5) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$random(0xffffffffffffff9c, &(0x7f0000000580)='/dev/urandom\x00', 0x1, 0x0) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000640)="66272eaa06a51a7d7226b96c2afb86ce08ef206b217688545660d86fe1f9c065e14cd72ace015de136876bff95ab12204af3a19a121cafc578add591ed5cdf36debdfe982b958c73b950c20791a2518c94a6d94d38e8093c3fae17f19015d49732509ed467082e75cc9ad0410509b6461a9ede4dee14f906c34252e8639cb99db404843e87bc912683adedae11e4a4462eff26c24152cbba49c3168b5bc240c1032280b3af260175f3bd341e1fdb74f3c60d51a252adb9dd5d410f36b4bf", 0xbe}], 0x1) ioctl$EVIOCSKEYCODE_V2(r4, 0x40284504, &(0x7f0000000340)={0x29, 0x3, 0x7f, 0xfffffff, "0000e1d1ea0000000000000000afa68a69da0000000000000000000800"}) ioctl$EVIOCGSW(r4, 0x8040451b, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) mmap(&(0x7f0000320000/0x3000)=nil, 0x3000, 0x0, 0x8031, r2, 0x3) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000000180), 0xf0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) r9 = dup2(r2, r2) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000500)={0x0, 0x148, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYRESOCT=0x0], 0x1}}, 0x0) write$cgroup_type(r9, &(0x7f0000000140)='threaded\x00', 0xfffffebd) 03:53:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a62730000000000000000000000000000000000000000852a62730000000000000000000000000000000000000000852a627300"/72], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000400000000000018000000000000003000000000000000f4a17d714ca0f815f68e78305c7dbec1c2b94ebdfea897c2825e107712a4df10cd3908000000000000003ad7313c0d16f2c205b4130537aecb0b3640383345f566f0f20203c28dede1ea4ec800ed255da66a0063c0cdaa5eeff27c1dd282bdbd8bcb71497140c78bfc157d07c0958de8a5456aba03323f2c028af7ea40d5a185b099850f55"]], 0x0, 0x0, 0x0}) [ 408.357162] binder: 13527:13533 DecRefs 0 refcount change on invalid ref 1 ret -22 03:53:34 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(0xffffffffffffffff, r0) ppoll(&(0x7f0000000240)=[{r1, 0x5a1}, {r2}, {0xffffffffffffffff, 0x8000}, {0xffffffffffffffff, 0x1108}, {r2, 0x100}, {r0, 0x40}, {r0}], 0x7, &(0x7f0000000280), &(0x7f00000002c0)={0x8}, 0x8) [ 408.357171] binder: 13527:13533 BC_INCREFS_DONE u0000000000000003 no match ** 5 printk messages dropped ** [ 408.559217] binder: 13556:13566 ERROR: BC_REGISTER_LOOPER called without request [ 408.559224] binder: 13556:13566 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 408.559231] binder: 13556:13566 Release 1 refcount change on invalid ref 0 ret -22 [ 408.574915] binder: BINDER_SET_CONTEXT_MGR already set [ 408.574925] binder: 13557:13561 ioctl 40046207 0 returned -16 [ 408.575020] binder_alloc: 7943: binder_alloc_buf, no vma [ 408.575038] binder: 13557:13561 transaction failed 29189/-3, size 72-24 line 3136 [ 408.607828] binder: BINDER_SET_CONTEXT_MGR already set ** 146 printk messages dropped ** [ 410.397365] binder: 13886:13888 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.397377] binder: 13886:13888 Release 1 refcount change on invalid ref 0 ret -22 [ 410.398119] binder: BINDER_SET_CONTEXT_MGR already set [ 410.398129] binder: 13879:13884 ioctl 40046207 0 returned -16 [ 410.398224] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.398244] binder: 13879:13884 transaction failed 29189/-3, size 72-24 line 3136 [ 410.459888] binder: 13901:13902 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.459898] binder: 13901:13902 BC_INCREFS_DONE u0000000000000003 no match [ 410.459904] binder: 13901:13902 ERROR: BC_REGISTER_LOOPER called without request [ 410.459912] binder: 13901:13902 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.459922] binder: 13901:13902 Release 1 refcount change on invalid ref 0 ret -22 [ 410.606018] binder: BINDER_SET_CONTEXT_MGR already set [ 410.606027] binder: 13912:13917 ioctl 40046207 0 returned -16 [ 410.607005] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.607131] binder: 13912:13917 transaction failed 29189/-3, size 72-24 line 3136 [ 410.610473] binder: 13914:13918 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.610483] binder: 13914:13918 BC_INCREFS_DONE u0000000000000003 no match [ 410.610489] binder: 13914:13918 ERROR: BC_REGISTER_LOOPER called without request [ 410.610497] binder: 13914:13918 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.610508] binder: 13914:13918 Release 1 refcount change on invalid ref 0 ret -22 [ 410.662000] binder: 13931:13933 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.662010] binder: 13931:13933 BC_INCREFS_DONE u0000000000000003 no match [ 410.662015] binder: 13931:13933 ERROR: BC_REGISTER_LOOPER called without request [ 410.662023] binder: 13931:13933 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.662032] binder: 13931:13933 Release 1 refcount change on invalid ref 0 ret -22 [ 410.701885] binder: BINDER_SET_CONTEXT_MGR already set [ 410.701894] binder: 13930:13939 ioctl 40046207 0 returned -16 [ 410.702111] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.702132] binder: 13930:13939 transaction failed 29189/-3, size 72-24 line 3136 [ 410.725902] binder: 13940:13943 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.725971] binder: 13940:13943 BC_INCREFS_DONE u0000000000000003 no match [ 410.725977] binder: 13940:13943 ERROR: BC_REGISTER_LOOPER called without request [ 410.726037] binder: 13940:13943 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.726048] binder: 13940:13943 Release 1 refcount change on invalid ref 0 ret -22 [ 410.856416] binder: BINDER_SET_CONTEXT_MGR already set [ 410.856425] binder: 13955:13962 ioctl 40046207 0 returned -16 [ 410.856529] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.856549] binder: 13955:13962 transaction failed 29189/-3, size 72-24 line 3136 [ 410.889814] binder: 13957:13963 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 410.889824] binder: 13957:13963 BC_INCREFS_DONE u0000000000000003 no match [ 410.889830] binder: 13957:13963 ERROR: BC_REGISTER_LOOPER called without request [ 410.889838] binder: 13957:13963 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 410.889848] binder: 13957:13963 Release 1 refcount change on invalid ref 0 ret -22 [ 410.902832] binder: BINDER_SET_CONTEXT_MGR already set [ 410.902841] binder: 13970:13975 ioctl 40046207 0 returned -16 [ 410.902946] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.902964] binder: 13970:13975 transaction failed 29189/-3, size 72-24 line 3136 [ 410.946461] binder: BINDER_SET_CONTEXT_MGR already set [ 410.946470] binder: 13979:13985 ioctl 40046207 0 returned -16 [ 410.946637] binder_alloc: 7943: binder_alloc_buf, no vma [ 410.946657] binder: 13979:13985 transaction failed 29189/-3, size 72-24 line 3136 [ 411.101651] binder: 14000:14007 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.101661] binder: 14000:14007 BC_INCREFS_DONE u0000000000000003 no match [ 411.101667] binder: 14000:14007 ERROR: BC_REGISTER_LOOPER called without request [ 411.101677] binder: 14000:14007 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.101694] binder: 14000:14007 Release 1 refcount change on invalid ref 0 ret -22 [ 411.117034] binder: BINDER_SET_CONTEXT_MGR already set [ 411.117042] binder: 14003:14010 ioctl 40046207 0 returned -16 [ 411.117137] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.117157] binder: 14003:14010 transaction failed 29189/-3, size 72-24 line 3136 [ 411.175490] binder: BINDER_SET_CONTEXT_MGR already set [ 411.175499] binder: 14021:14025 ioctl 40046207 0 returned -16 [ 411.175601] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.175620] binder: 14021:14025 transaction failed 29189/-3, size 72-24 line 3136 [ 411.337756] binder: BINDER_SET_CONTEXT_MGR already set [ 411.337765] binder: 14045:14051 ioctl 40046207 0 returned -16 [ 411.337857] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.337876] binder: 14045:14051 transaction failed 29189/-3, size 72-24 line 3136 [ 411.352945] binder: 14042:14043 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.352955] binder: 14042:14043 BC_INCREFS_DONE u0000000000000003 no match [ 411.352961] binder: 14042:14043 ERROR: BC_REGISTER_LOOPER called without request [ 411.352969] binder: 14042:14043 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.352978] binder: 14042:14043 Release 1 refcount change on invalid ref 0 ret -22 [ 411.393948] binder: 14055:14067 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.393957] binder: 14055:14067 BC_INCREFS_DONE u0000000000000003 no match [ 411.393963] binder: 14055:14067 ERROR: BC_REGISTER_LOOPER called without request [ 411.393972] binder: 14055:14067 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.393983] binder: 14055:14067 Release 1 refcount change on invalid ref 0 ret -22 [ 411.421999] binder: BINDER_SET_CONTEXT_MGR already set [ 411.422008] binder: 14071:14074 ioctl 40046207 0 returned -16 [ 411.422107] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.422126] binder: 14071:14074 transaction failed 29189/-3, size 72-24 line 3136 [ 411.465781] binder: 14080:14083 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.465791] binder: 14080:14083 BC_INCREFS_DONE u0000000000000003 no match [ 411.465797] binder: 14080:14083 ERROR: BC_REGISTER_LOOPER called without request [ 411.465805] binder: 14080:14083 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.465816] binder: 14080:14083 Release 1 refcount change on invalid ref 0 ret -22 [ 411.607474] binder: BINDER_SET_CONTEXT_MGR already set [ 411.607482] binder: 14096:14098 ioctl 40046207 0 returned -16 [ 411.607604] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.607622] binder: 14096:14098 transaction failed 29189/-3, size 72-24 line 3136 [ 411.620281] binder: 14100:14103 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.620858] binder: 14100:14103 BC_INCREFS_DONE u0000000000000003 no match [ 411.620863] binder: 14100:14103 ERROR: BC_REGISTER_LOOPER called without request [ 411.620872] binder: 14100:14103 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.620881] binder: 14100:14103 Release 1 refcount change on invalid ref 0 ret -22 [ 411.633780] binder: BINDER_SET_CONTEXT_MGR already set [ 411.633788] binder: 14106:14108 ioctl 40046207 0 returned -16 [ 411.633881] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.633900] binder: 14106:14108 transaction failed 29189/-3, size 72-24 line 3136 [ 411.682397] binder: 14111:14113 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.682419] binder: 14111:14113 BC_INCREFS_DONE u0000000000000003 no match [ 411.682424] binder: 14111:14113 ERROR: BC_REGISTER_LOOPER called without request [ 411.682432] binder: 14111:14113 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.682443] binder: 14111:14113 Release 1 refcount change on invalid ref 0 ret -22 [ 411.712540] binder: BINDER_SET_CONTEXT_MGR already set [ 411.712549] binder: 14121:14126 ioctl 40046207 0 returned -16 [ 411.712660] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.712680] binder: 14121:14126 transaction failed 29189/-3, size 72-24 line 3136 [ 411.878603] binder: BINDER_SET_CONTEXT_MGR already set [ 411.878611] binder: 14144:14147 ioctl 40046207 0 returned -16 [ 411.878704] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.878723] binder: 14144:14147 transaction failed 29189/-3, size 72-24 line 3136 [ 411.898439] binder: 14139:14149 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.898448] binder: 14139:14149 BC_INCREFS_DONE u0000000000000003 no match [ 411.898453] binder: 14139:14149 ERROR: BC_REGISTER_LOOPER called without request [ 411.898461] binder: 14139:14149 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.898471] binder: 14139:14149 Release 1 refcount change on invalid ref 0 ret -22 [ 411.954142] binder: BINDER_SET_CONTEXT_MGR already set [ 411.954154] binder: 14158:14161 ioctl 40046207 0 returned -16 [ 411.954276] binder_alloc: 7943: binder_alloc_buf, no vma [ 411.954293] binder: 14158:14161 transaction failed 29189/-3, size 72-24 line 3136 [ 411.995099] binder: 14165:14169 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 411.995109] binder: 14165:14169 BC_INCREFS_DONE u0000000000000003 no match [ 411.995115] binder: 14165:14169 ERROR: BC_REGISTER_LOOPER called without request [ 411.995131] binder: 14165:14169 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 411.995249] binder: 14165:14169 Release 1 refcount change on invalid ref 0 ret -22 [ 412.127118] binder: 14188:14192 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.127128] binder: 14188:14192 BC_INCREFS_DONE u0000000000000003 no match [ 412.127133] binder: 14188:14192 ERROR: BC_REGISTER_LOOPER called without request [ 412.127142] binder: 14188:14192 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.127153] binder: 14188:14192 Release 1 refcount change on invalid ref 0 ret -22 [ 412.138792] binder: BINDER_SET_CONTEXT_MGR already set [ 412.138801] binder: 14187:14195 ioctl 40046207 0 returned -16 [ 412.138904] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.138923] binder: 14187:14195 transaction failed 29189/-3, size 72-24 line 3136 [ 412.186021] binder: 14198:14201 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.186031] binder: 14198:14201 BC_INCREFS_DONE u0000000000000003 no match [ 412.186036] binder: 14198:14201 ERROR: BC_REGISTER_LOOPER called without request [ 412.186045] binder: 14198:14201 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.186055] binder: 14198:14201 Release 1 refcount change on invalid ref 0 ret -22 [ 412.209744] binder: BINDER_SET_CONTEXT_MGR already set [ 412.209753] binder: 14199:14203 ioctl 40046207 0 returned -16 [ 412.209853] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.209871] binder: 14199:14203 transaction failed 29189/-3, size 72-24 line 3136 [ 412.390246] binder: BINDER_SET_CONTEXT_MGR already set [ 412.390255] binder: 14229:14233 ioctl 40046207 0 returned -16 [ 412.390349] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.390370] binder: 14229:14233 transaction failed 29189/-3, size 72-24 line 3136 [ 412.412194] binder: 14228:14236 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.412204] binder: 14228:14236 BC_INCREFS_DONE u0000000000000003 no match [ 412.412209] binder: 14228:14236 ERROR: BC_REGISTER_LOOPER called without request [ 412.412217] binder: 14228:14236 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.412310] binder: 14228:14236 Release 1 refcount change on invalid ref 0 ret -22 [ 412.420818] binder: BINDER_SET_CONTEXT_MGR already set [ 412.420829] binder: 14241:14242 ioctl 40046207 0 returned -16 [ 412.420938] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.420960] binder: 14241:14242 transaction failed 29189/-3, size 72-24 line 3136 [ 412.452783] binder: BINDER_SET_CONTEXT_MGR already set [ 412.452792] binder: 14246:14253 ioctl 40046207 0 returned -16 [ 412.453025] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.453044] binder: 14246:14253 transaction failed 29189/-3, size 72-24 line 3136 [ 412.467228] binder: 14254:14259 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.467237] binder: 14254:14259 BC_INCREFS_DONE u0000000000000003 no match [ 412.467243] binder: 14254:14259 ERROR: BC_REGISTER_LOOPER called without request [ 412.467251] binder: 14254:14259 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.467261] binder: 14254:14259 Release 1 refcount change on invalid ref 0 ret -22 [ 412.630150] binder: 14274:14277 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.630160] binder: 14274:14277 BC_INCREFS_DONE u0000000000000003 no match [ 412.630166] binder: 14274:14277 ERROR: BC_REGISTER_LOOPER called without request [ 412.630174] binder: 14274:14277 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.630197] binder: 14274:14277 Release 1 refcount change on invalid ref 0 ret -22 [ 412.649516] binder: BINDER_SET_CONTEXT_MGR already set [ 412.649524] binder: 14272:14281 ioctl 40046207 0 returned -16 [ 412.649612] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.649629] binder: 14272:14281 transaction failed 29189/-3, size 72-24 line 3136 [ 412.700986] binder: 14285:14298 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.700995] binder: 14285:14298 BC_INCREFS_DONE u0000000000000003 no match [ 412.701001] binder: 14285:14298 ERROR: BC_REGISTER_LOOPER called without request [ 412.701010] binder: 14285:14298 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.701020] binder: 14285:14298 Release 1 refcount change on invalid ref 0 ret -22 [ 412.721368] binder: BINDER_SET_CONTEXT_MGR already set [ 412.721377] binder: 14295:14301 ioctl 40046207 0 returned -16 [ 412.721475] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.721494] binder: 14295:14301 transaction failed 29189/-3, size 72-24 line 3136 [ 412.892443] binder: 14316:14320 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.892453] binder: 14316:14320 BC_INCREFS_DONE u0000000000000003 no match [ 412.892458] binder: 14316:14320 ERROR: BC_REGISTER_LOOPER called without request [ 412.892466] binder: 14316:14320 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.892475] binder: 14316:14320 Release 1 refcount change on invalid ref 0 ret -22 [ 412.896942] binder: BINDER_SET_CONTEXT_MGR already set [ 412.896950] binder: 14318:14321 ioctl 40046207 0 returned -16 [ 412.897657] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.897676] binder: 14318:14321 transaction failed 29189/-3, size 72-24 line 3136 [ 412.944225] binder: 14325:14331 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.944235] binder: 14325:14331 BC_INCREFS_DONE u0000000000000003 no match [ 412.944240] binder: 14325:14331 ERROR: BC_REGISTER_LOOPER called without request [ 412.944249] binder: 14325:14331 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.944261] binder: 14325:14331 Release 1 refcount change on invalid ref 0 ret -22 [ 412.952047] binder: BINDER_SET_CONTEXT_MGR already set [ 412.952056] binder: 14329:14330 ioctl 40046207 0 returned -16 [ 412.952162] binder_alloc: 7943: binder_alloc_buf, no vma [ 412.952192] binder: 14329:14330 transaction failed 29189/-3, size 72-24 line 3136 [ 412.981539] binder: 14338:14339 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 412.981548] binder: 14338:14339 BC_INCREFS_DONE u0000000000000003 no match [ 412.981554] binder: 14338:14339 ERROR: BC_REGISTER_LOOPER called without request [ 412.981562] binder: 14338:14339 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 412.981571] binder: 14338:14339 Release 1 refcount change on invalid ref 0 ret -22 [ 413.131986] binder: BINDER_SET_CONTEXT_MGR already set [ 413.131994] binder: 14355:14363 ioctl 40046207 0 returned -16 [ 413.138006] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.138029] binder: 14355:14363 transaction failed 29189/-3, size 72-24 line 3136 [ 413.145395] binder: 14358:14362 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.145404] binder: 14358:14362 BC_INCREFS_DONE u0000000000000003 no match [ 413.145410] binder: 14358:14362 ERROR: BC_REGISTER_LOOPER called without request [ 413.145418] binder: 14358:14362 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.145429] binder: 14358:14362 Release 1 refcount change on invalid ref 0 ret -22 [ 413.181436] binder: 14371:14372 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.181446] binder: 14371:14372 BC_INCREFS_DONE u0000000000000003 no match [ 413.181451] binder: 14371:14372 ERROR: BC_REGISTER_LOOPER called without request [ 413.181459] binder: 14371:14372 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.181469] binder: 14371:14372 Release 1 refcount change on invalid ref 0 ret -22 [ 413.200199] binder: BINDER_SET_CONTEXT_MGR already set [ 413.200209] binder: 14375:14378 ioctl 40046207 0 returned -16 [ 413.200302] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.200320] binder: 14375:14378 transaction failed 29189/-3, size 72-24 line 3136 [ 413.402305] binder: BINDER_SET_CONTEXT_MGR already set [ 413.402313] binder: 14404:14406 ioctl 40046207 0 returned -16 [ 413.402415] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.402433] binder: 14404:14406 transaction failed 29189/-3, size 72-24 line 3136 [ 413.407583] binder: 14399:14407 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.407594] binder: 14399:14407 BC_INCREFS_DONE u0000000000000003 no match [ 413.407600] binder: 14399:14407 ERROR: BC_REGISTER_LOOPER called without request [ 413.407673] binder: 14399:14407 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.407693] binder: 14399:14407 Release 1 refcount change on invalid ref 0 ret -22 [ 413.466920] binder: BINDER_SET_CONTEXT_MGR already set [ 413.466928] binder: 14415:14417 ioctl 40046207 0 returned -16 [ 413.467019] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.467039] binder: 14415:14417 transaction failed 29189/-3, size 72-24 line 3136 [ 413.493552] binder: 14420:14427 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.493562] binder: 14420:14427 BC_INCREFS_DONE u0000000000000003 no match [ 413.493568] binder: 14420:14427 ERROR: BC_REGISTER_LOOPER called without request [ 413.493576] binder: 14420:14427 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.493585] binder: 14420:14427 Release 1 refcount change on invalid ref 0 ret -22 [ 413.669910] binder: BINDER_SET_CONTEXT_MGR already set [ 413.669920] binder: 14440:14450 ioctl 40046207 0 returned -16 [ 413.670009] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.670029] binder: 14440:14450 transaction failed 29189/-3, size 72-24 line 3136 [ 413.674583] binder: 14443:14448 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.674593] binder: 14443:14448 BC_INCREFS_DONE u0000000000000003 no match [ 413.674598] binder: 14443:14448 ERROR: BC_REGISTER_LOOPER called without request [ 413.674608] binder: 14443:14448 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.674618] binder: 14443:14448 Release 1 refcount change on invalid ref 0 ret -22 [ 413.728835] binder: BINDER_SET_CONTEXT_MGR already set [ 413.728844] binder: 14454:14464 ioctl 40046207 0 returned -16 [ 413.736373] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.736393] binder: 14454:14464 transaction failed 29189/-3, size 72-24 line 3136 [ 413.754013] binder: 14457:14465 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.754024] binder: 14457:14465 BC_INCREFS_DONE u0000000000000003 no match [ 413.754030] binder: 14457:14465 ERROR: BC_REGISTER_LOOPER called without request [ 413.754038] binder: 14457:14465 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.754049] binder: 14457:14465 Release 1 refcount change on invalid ref 0 ret -22 [ 413.882074] binder: BINDER_SET_CONTEXT_MGR already set [ 413.882083] binder: 14485:14490 ioctl 40046207 0 returned -16 [ 413.882241] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.882262] binder: 14485:14490 transaction failed 29189/-3, size 72-24 line 3136 [ 413.903470] binder: 14483:14486 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.903480] binder: 14483:14486 BC_INCREFS_DONE u0000000000000003 no match [ 413.903485] binder: 14483:14486 ERROR: BC_REGISTER_LOOPER called without request [ 413.903494] binder: 14483:14486 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.903506] binder: 14483:14486 Release 1 refcount change on invalid ref 0 ret -22 [ 413.937258] binder: BINDER_SET_CONTEXT_MGR already set [ 413.937267] binder: 14497:14500 ioctl 40046207 0 returned -16 [ 413.937859] binder_alloc: 7943: binder_alloc_buf, no vma [ 413.937878] binder: 14497:14500 transaction failed 29189/-3, size 72-24 line 3136 [ 413.967466] binder: 14504:14508 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 413.967475] binder: 14504:14508 BC_INCREFS_DONE u0000000000000003 no match [ 413.967480] binder: 14504:14508 ERROR: BC_REGISTER_LOOPER called without request [ 413.967486] binder: 14504:14508 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 413.967496] binder: 14504:14508 Release 1 refcount change on invalid ref 0 ret -22 [ 414.163270] binder: BINDER_SET_CONTEXT_MGR already set [ 414.163278] binder: 14528:14532 ioctl 40046207 0 returned -16 [ 414.163481] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.163501] binder: 14528:14532 transaction failed 29189/-3, size 72-24 line 3136 [ 414.168554] binder: 14529:14536 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.168563] binder: 14529:14536 BC_INCREFS_DONE u0000000000000003 no match [ 414.168569] binder: 14529:14536 ERROR: BC_REGISTER_LOOPER called without request [ 414.168577] binder: 14529:14536 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.168586] binder: 14529:14536 Release 1 refcount change on invalid ref 0 ret -22 [ 414.219106] binder: 14548:14551 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.219116] binder: 14548:14551 BC_INCREFS_DONE u0000000000000003 no match [ 414.219122] binder: 14548:14551 ERROR: BC_REGISTER_LOOPER called without request [ 414.219130] binder: 14548:14551 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.219142] binder: 14548:14551 Release 1 refcount change on invalid ref 0 ret -22 [ 414.243515] binder: BINDER_SET_CONTEXT_MGR already set [ 414.243523] binder: 14553:14557 ioctl 40046207 0 returned -16 [ 414.243603] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.243619] binder: 14553:14557 transaction failed 29189/-3, size 72-24 line 3136 [ 414.425830] binder: BINDER_SET_CONTEXT_MGR already set [ 414.425838] binder: 14572:14577 ioctl 40046207 0 returned -16 [ 414.425943] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.425962] binder: 14572:14577 transaction failed 29189/-3, size 72-24 line 3136 [ 414.460751] binder: 14571:14580 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.460761] binder: 14571:14580 BC_INCREFS_DONE u0000000000000003 no match [ 414.460767] binder: 14571:14580 ERROR: BC_REGISTER_LOOPER called without request [ 414.460776] binder: 14571:14580 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.460787] binder: 14571:14580 Release 1 refcount change on invalid ref 0 ret -22 [ 414.480776] binder: BINDER_SET_CONTEXT_MGR already set [ 414.480784] binder: 14584:14588 ioctl 40046207 0 returned -16 [ 414.480933] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.480951] binder: 14584:14588 transaction failed 29189/-3, size 72-24 line 3136 [ 414.513037] binder: 14591:14598 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.513047] binder: 14591:14598 BC_INCREFS_DONE u0000000000000003 no match [ 414.513052] binder: 14591:14598 ERROR: BC_REGISTER_LOOPER called without request [ 414.513059] binder: 14591:14598 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.513069] binder: 14591:14598 Release 1 refcount change on invalid ref 0 ret -22 [ 414.531303] binder: BINDER_SET_CONTEXT_MGR already set [ 414.531312] binder: 14596:14601 ioctl 40046207 0 returned -16 [ 414.531409] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.531428] binder: 14596:14601 transaction failed 29189/-3, size 72-24 line 3136 [ 414.698937] binder: 14617:14620 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.698947] binder: 14617:14620 BC_INCREFS_DONE u0000000000000003 no match [ 414.698952] binder: 14617:14620 ERROR: BC_REGISTER_LOOPER called without request [ 414.698960] binder: 14617:14620 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.698970] binder: 14617:14620 Release 1 refcount change on invalid ref 0 ret -22 [ 414.707807] binder: BINDER_SET_CONTEXT_MGR already set [ 414.707817] binder: 14615:14623 ioctl 40046207 0 returned -16 [ 414.707910] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.707930] binder: 14615:14623 transaction failed 29189/-3, size 72-24 line 3136 [ 414.760555] binder: 14632:14637 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.760565] binder: 14632:14637 BC_INCREFS_DONE u0000000000000003 no match [ 414.760571] binder: 14632:14637 ERROR: BC_REGISTER_LOOPER called without request [ 414.760578] binder: 14632:14637 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.760591] binder: 14632:14637 Release 1 refcount change on invalid ref 0 ret -22 [ 414.774096] binder: BINDER_SET_CONTEXT_MGR already set [ 414.774105] binder: 14629:14633 ioctl 40046207 0 returned -16 [ 414.774195] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.774213] binder: 14629:14633 transaction failed 29189/-3, size 72-24 line 3136 [ 414.825929] binder: 14643:14650 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.825939] binder: 14643:14650 BC_INCREFS_DONE u0000000000000003 no match [ 414.825945] binder: 14643:14650 ERROR: BC_REGISTER_LOOPER called without request [ 414.825953] binder: 14643:14650 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.825962] binder: 14643:14650 Release 1 refcount change on invalid ref 0 ret -22 [ 414.958785] binder: BINDER_SET_CONTEXT_MGR already set [ 414.958794] binder: 14658:14664 ioctl 40046207 0 returned -16 [ 414.958889] binder_alloc: 7943: binder_alloc_buf, no vma [ 414.958907] binder: 14658:14664 transaction failed 29189/-3, size 72-24 line 3136 [ 414.959593] binder: 14661:14665 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 414.959603] binder: 14661:14665 BC_INCREFS_DONE u0000000000000003 no match [ 414.959609] binder: 14661:14665 ERROR: BC_REGISTER_LOOPER called without request [ 414.959617] binder: 14661:14665 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 414.959626] binder: 14661:14665 Release 1 refcount change on invalid ref 0 ret -22 [ 415.023024] binder: 14671:14679 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.023033] binder: 14671:14679 BC_INCREFS_DONE u0000000000000003 no match [ 415.023039] binder: 14671:14679 ERROR: BC_REGISTER_LOOPER called without request [ 415.023047] binder: 14671:14679 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.023055] binder: 14671:14679 Release 1 refcount change on invalid ref 0 ret -22 [ 415.036888] binder: BINDER_SET_CONTEXT_MGR already set [ 415.036897] binder: 14678:14682 ioctl 40046207 0 returned -16 [ 415.046483] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.046504] binder: 14678:14682 transaction failed 29189/-3, size 72-24 line 3136 [ 415.082094] binder: 14684:14690 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.082104] binder: 14684:14690 BC_INCREFS_DONE u0000000000000003 no match [ 415.082109] binder: 14684:14690 ERROR: BC_REGISTER_LOOPER called without request [ 415.082120] binder: 14684:14690 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.082131] binder: 14684:14690 Release 1 refcount change on invalid ref 0 ret -22 [ 415.228533] binder: 14712:14713 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.228541] binder: 14712:14713 BC_INCREFS_DONE u0000000000000003 no match [ 415.228546] binder: 14712:14713 ERROR: BC_REGISTER_LOOPER called without request [ 415.228552] binder: 14712:14713 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.228560] binder: 14712:14713 Release 1 refcount change on invalid ref 0 ret -22 [ 415.228620] binder: BINDER_SET_CONTEXT_MGR already set [ 415.228629] binder: 14706:14715 ioctl 40046207 0 returned -16 [ 415.228732] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.228751] binder: 14706:14715 transaction failed 29189/-3, size 72-24 line 3136 [ 415.297924] binder: 14729:14736 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.297932] binder: 14729:14736 BC_INCREFS_DONE u0000000000000003 no match [ 415.297937] binder: 14729:14736 ERROR: BC_REGISTER_LOOPER called without request [ 415.297943] binder: 14729:14736 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.297954] binder: 14729:14736 Release 1 refcount change on invalid ref 0 ret -22 [ 415.310559] binder: BINDER_SET_CONTEXT_MGR already set [ 415.310567] binder: 14732:14737 ioctl 40046207 0 returned -16 [ 415.310663] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.310681] binder: 14732:14737 transaction failed 29189/-3, size 72-24 line 3136 [ 415.464194] binder: BINDER_SET_CONTEXT_MGR already set [ 415.464204] binder: 14746:14753 ioctl 40046207 0 returned -16 [ 415.464302] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.464321] binder: 14746:14753 transaction failed 29189/-3, size 72-24 line 3136 [ 415.469194] binder: 14749:14756 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.469203] binder: 14749:14756 BC_INCREFS_DONE u0000000000000003 no match [ 415.469209] binder: 14749:14756 ERROR: BC_REGISTER_LOOPER called without request [ 415.469216] binder: 14749:14756 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.469225] binder: 14749:14756 Release 1 refcount change on invalid ref 0 ret -22 [ 415.493633] binder: BINDER_SET_CONTEXT_MGR already set [ 415.493643] binder: 14760:14762 ioctl 40046207 0 returned -16 [ 415.493748] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.493767] binder: 14760:14762 transaction failed 29189/-3, size 72-24 line 3136 [ 415.526927] binder: 14763:14766 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.526936] binder: 14763:14766 BC_INCREFS_DONE u0000000000000003 no match [ 415.526942] binder: 14763:14766 ERROR: BC_REGISTER_LOOPER called without request [ 415.526950] binder: 14763:14766 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.526960] binder: 14763:14766 Release 1 refcount change on invalid ref 0 ret -22 [ 415.536567] binder: BINDER_SET_CONTEXT_MGR already set [ 415.536576] binder: 14768:14774 ioctl 40046207 0 returned -16 [ 415.536682] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.536702] binder: 14768:14774 transaction failed 29189/-3, size 72-24 line 3136 [ 415.730019] binder: 14791:14797 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.730029] binder: 14791:14797 BC_INCREFS_DONE u0000000000000003 no match [ 415.730035] binder: 14791:14797 ERROR: BC_REGISTER_LOOPER called without request [ 415.730043] binder: 14791:14797 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.730053] binder: 14791:14797 Release 1 refcount change on invalid ref 0 ret -22 [ 415.734572] binder: BINDER_SET_CONTEXT_MGR already set [ 415.734582] binder: 14790:14795 ioctl 40046207 0 returned -16 [ 415.734935] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.734955] binder: 14790:14795 transaction failed 29189/-3, size 72-24 line 3136 [ 415.761156] binder: 14802:14804 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.761165] binder: 14802:14804 BC_INCREFS_DONE u0000000000000003 no match [ 415.761171] binder: 14802:14804 ERROR: BC_REGISTER_LOOPER called without request [ 415.761180] binder: 14802:14804 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.761199] binder: 14802:14804 Release 1 refcount change on invalid ref 0 ret -22 [ 415.805675] binder: BINDER_SET_CONTEXT_MGR already set [ 415.805688] binder: 14809:14813 ioctl 40046207 0 returned -16 [ 415.806263] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.806282] binder: 14809:14813 transaction failed 29189/-3, size 72-24 line 3136 [ 415.812347] binder: 14812:14814 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 415.812357] binder: 14812:14814 BC_INCREFS_DONE u0000000000000003 no match [ 415.812362] binder: 14812:14814 ERROR: BC_REGISTER_LOOPER called without request [ 415.812371] binder: 14812:14814 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 415.812380] binder: 14812:14814 Release 1 refcount change on invalid ref 0 ret -22 [ 415.982992] binder: BINDER_SET_CONTEXT_MGR already set [ 415.983002] binder: 14833:14836 ioctl 40046207 0 returned -16 [ 415.983111] binder_alloc: 7943: binder_alloc_buf, no vma [ 415.983130] binder: 14833:14836 transaction failed 29189/-3, size 72-24 line 3136 [ 416.005970] binder: BINDER_SET_CONTEXT_MGR already set [ 416.005978] binder: 14843:14847 ioctl 40046207 0 returned -16 [ 416.006072] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.006091] binder: 14843:14847 transaction failed 29189/-3, size 72-24 line 3136 [ 416.023537] binder: 14835:14842 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.023547] binder: 14835:14842 BC_INCREFS_DONE u0000000000000003 no match [ 416.023553] binder: 14835:14842 ERROR: BC_REGISTER_LOOPER called without request [ 416.023561] binder: 14835:14842 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.023573] binder: 14835:14842 Release 1 refcount change on invalid ref 0 ret -22 [ 416.091282] binder: BINDER_SET_CONTEXT_MGR already set [ 416.091291] binder: 14859:14863 ioctl 40046207 0 returned -16 [ 416.091394] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.091412] binder: 14859:14863 transaction failed 29189/-3, size 72-24 line 3136 [ 416.115902] binder: 14864:14870 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.115912] binder: 14864:14870 BC_INCREFS_DONE u0000000000000003 no match [ 416.115918] binder: 14864:14870 ERROR: BC_REGISTER_LOOPER called without request [ 416.115926] binder: 14864:14870 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.115936] binder: 14864:14870 Release 1 refcount change on invalid ref 0 ret -22 [ 416.254645] binder: 14882:14889 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.254655] binder: 14882:14889 BC_INCREFS_DONE u0000000000000003 no match [ 416.254661] binder: 14882:14889 ERROR: BC_REGISTER_LOOPER called without request [ 416.254669] binder: 14882:14889 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.254679] binder: 14882:14889 Release 1 refcount change on invalid ref 0 ret -22 [ 416.256702] binder: BINDER_SET_CONTEXT_MGR already set [ 416.256712] binder: 14881:14887 ioctl 40046207 0 returned -16 [ 416.257083] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.257106] binder: 14881:14887 transaction failed 29189/-3, size 72-24 line 3136 [ 416.308116] binder: 14893:14901 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.308127] binder: 14893:14901 BC_INCREFS_DONE u0000000000000003 no match [ 416.308133] binder: 14893:14901 ERROR: BC_REGISTER_LOOPER called without request [ 416.308142] binder: 14893:14901 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.308154] binder: 14893:14901 Release 1 refcount change on invalid ref 0 ret -22 [ 416.346622] binder: BINDER_SET_CONTEXT_MGR already set [ 416.346631] binder: 14897:14905 ioctl 40046207 0 returned -16 [ 416.346729] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.346748] binder: 14897:14905 transaction failed 29189/-3, size 72-24 line 3136 [ 416.360415] binder: 14906:14909 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.360425] binder: 14906:14909 BC_INCREFS_DONE u0000000000000003 no match [ 416.360431] binder: 14906:14909 ERROR: BC_REGISTER_LOOPER called without request [ 416.360447] binder: 14906:14909 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.360480] binder: 14906:14909 Release 1 refcount change on invalid ref 0 ret -22 [ 416.515347] binder: BINDER_SET_CONTEXT_MGR already set [ 416.515356] binder: 14924:14925 ioctl 40046207 0 returned -16 [ 416.515449] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.515466] binder: 14924:14925 transaction failed 29189/-3, size 72-24 line 3136 [ 416.532588] binder: 14927:14931 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.532598] binder: 14927:14931 BC_INCREFS_DONE u0000000000000003 no match [ 416.532604] binder: 14927:14931 ERROR: BC_REGISTER_LOOPER called without request [ 416.532612] binder: 14927:14931 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.532624] binder: 14927:14931 Release 1 refcount change on invalid ref 0 ret -22 [ 416.600176] binder: BINDER_SET_CONTEXT_MGR already set [ 416.600184] binder: 14937:14944 ioctl 40046207 0 returned -16 [ 416.600290] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.600309] binder: 14937:14944 transaction failed 29189/-3, size 72-24 line 3136 [ 416.648148] binder: BINDER_SET_CONTEXT_MGR already set [ 416.648156] binder: 14955:14959 ioctl 40046207 0 returned -16 [ 416.648304] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.648321] binder: 14955:14959 transaction failed 29189/-3, size 72-24 line 3136 [ 416.658819] binder: 14942:14957 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.658828] binder: 14942:14957 BC_INCREFS_DONE u0000000000000003 no match [ 416.658834] binder: 14942:14957 ERROR: BC_REGISTER_LOOPER called without request [ 416.658842] binder: 14942:14957 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.658853] binder: 14942:14957 Release 1 refcount change on invalid ref 0 ret -22 [ 416.817137] binder: 14971:14974 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.817146] binder: 14971:14974 BC_INCREFS_DONE u0000000000000003 no match [ 416.817152] binder: 14971:14974 ERROR: BC_REGISTER_LOOPER called without request [ 416.817160] binder: 14971:14974 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.817169] binder: 14971:14974 Release 1 refcount change on invalid ref 0 ret -22 [ 416.824229] binder: BINDER_SET_CONTEXT_MGR already set [ 416.824238] binder: 14970:14973 ioctl 40046207 0 returned -16 [ 416.824328] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.824347] binder: 14970:14973 transaction failed 29189/-3, size 72-24 line 3136 [ 416.894913] binder: BINDER_SET_CONTEXT_MGR already set [ 416.894922] binder: 14991:14996 ioctl 40046207 0 returned -16 [ 416.895091] binder_alloc: 7943: binder_alloc_buf, no vma [ 416.895109] binder: 14991:14996 transaction failed 29189/-3, size 72-24 line 3136 [ 416.898378] binder: 14987:14994 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.898387] binder: 14987:14994 BC_INCREFS_DONE u0000000000000003 no match [ 416.898393] binder: 14987:14994 ERROR: BC_REGISTER_LOOPER called without request [ 416.898401] binder: 14987:14994 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.898411] binder: 14987:14994 Release 1 refcount change on invalid ref 0 ret -22 [ 416.946963] binder: 15001:15007 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 416.946972] binder: 15001:15007 BC_INCREFS_DONE u0000000000000003 no match [ 416.946977] binder: 15001:15007 ERROR: BC_REGISTER_LOOPER called without request [ 416.946985] binder: 15001:15007 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 416.946996] binder: 15001:15007 Release 1 refcount change on invalid ref 0 ret -22 [ 417.091049] binder: BINDER_SET_CONTEXT_MGR already set [ 417.091058] binder: 15014:15023 ioctl 40046207 0 returned -16 [ 417.091129] binder: 15015:15022 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.091138] binder: 15015:15022 BC_INCREFS_DONE u0000000000000003 no match [ 417.091142] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.091146] binder: 15015:15022 ERROR: BC_REGISTER_LOOPER called without request [ 417.091153] binder: 15015:15022 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.091161] binder: 15014:15023 transaction failed 29189/-3, size 72-24 line 3136 [ 417.091169] binder: 15015:15022 Release 1 refcount change on invalid ref 0 ret -22 [ 417.137607] binder: BINDER_SET_CONTEXT_MGR already set [ 417.137617] binder: 15028:15037 ioctl 40046207 0 returned -16 [ 417.137723] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.137742] binder: 15028:15037 transaction failed 29189/-3, size 72-24 line 3136 [ 417.151641] binder: 15039:15041 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.151650] binder: 15039:15041 BC_INCREFS_DONE u0000000000000003 no match [ 417.151655] binder: 15039:15041 ERROR: BC_REGISTER_LOOPER called without request [ 417.151663] binder: 15039:15041 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.151673] binder: 15039:15041 Release 1 refcount change on invalid ref 0 ret -22 [ 417.333597] binder: 15064:15068 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.333607] binder: 15064:15068 BC_INCREFS_DONE u0000000000000003 no match [ 417.333613] binder: 15064:15068 ERROR: BC_REGISTER_LOOPER called without request [ 417.333622] binder: 15064:15068 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.333631] binder: 15064:15068 Release 1 refcount change on invalid ref 0 ret -22 [ 417.339909] binder: BINDER_SET_CONTEXT_MGR already set [ 417.339923] binder: 15063:15067 ioctl 40046207 0 returned -16 [ 417.340022] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.340040] binder: 15063:15067 transaction failed 29189/-3, size 72-24 line 3136 [ 417.382890] binder: BINDER_SET_CONTEXT_MGR already set [ 417.382900] binder: 15076:15079 ioctl 40046207 0 returned -16 [ 417.383005] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.383023] binder: 15076:15079 transaction failed 29189/-3, size 72-24 line 3136 [ 417.393662] binder: 15072:15078 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.393673] binder: 15072:15078 BC_INCREFS_DONE u0000000000000003 no match [ 417.393680] binder: 15072:15078 ERROR: BC_REGISTER_LOOPER called without request [ 417.393717] binder: 15072:15078 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.393729] binder: 15072:15078 Release 1 refcount change on invalid ref 0 ret -22 [ 417.457881] binder: 15091:15098 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.457891] binder: 15091:15098 BC_INCREFS_DONE u0000000000000003 no match [ 417.457897] binder: 15091:15098 ERROR: BC_REGISTER_LOOPER called without request [ 417.457905] binder: 15091:15098 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.457914] binder: 15091:15098 Release 1 refcount change on invalid ref 0 ret -22 [ 417.563377] binder: BINDER_SET_CONTEXT_MGR already set [ 417.563385] binder: 15103:15108 ioctl 40046207 0 returned -16 [ 417.563783] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.563802] binder: 15103:15108 transaction failed 29189/-3, size 72-24 line 3136 [ 417.611360] binder: 15109:15120 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.611369] binder: 15109:15120 BC_INCREFS_DONE u0000000000000003 no match [ 417.611375] binder: 15109:15120 ERROR: BC_REGISTER_LOOPER called without request [ 417.611383] binder: 15109:15120 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.611392] binder: 15109:15120 Release 1 refcount change on invalid ref 0 ret -22 [ 417.615891] binder: BINDER_SET_CONTEXT_MGR already set [ 417.615899] binder: 15118:15123 ioctl 40046207 0 returned -16 [ 417.616006] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.616025] binder: 15118:15123 transaction failed 29189/-3, size 72-24 line 3136 [ 417.642305] binder: 15125:15128 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.642314] binder: 15125:15128 BC_INCREFS_DONE u0000000000000003 no match [ 417.642320] binder: 15125:15128 ERROR: BC_REGISTER_LOOPER called without request [ 417.642327] binder: 15125:15128 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.642337] binder: 15125:15128 Release 1 refcount change on invalid ref 0 ret -22 [ 417.655491] binder: BINDER_SET_CONTEXT_MGR already set [ 417.655499] binder: 15132:15135 ioctl 40046207 0 returned -16 [ 417.655624] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.655640] binder: 15132:15135 transaction failed 29189/-3, size 72-24 line 3136 [ 417.810452] binder: BINDER_SET_CONTEXT_MGR already set [ 417.810460] binder: 15148:15150 ioctl 40046207 0 returned -16 [ 417.810551] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.810571] binder: 15148:15150 transaction failed 29189/-3, size 72-24 line 3136 [ 417.837816] binder: BINDER_SET_CONTEXT_MGR already set [ 417.837824] binder: 15157:15160 ioctl 40046207 0 returned -16 [ 417.837911] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.837929] binder: 15157:15160 transaction failed 29189/-3, size 72-24 line 3136 [ 417.848028] binder: 15147:15158 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.848039] binder: 15147:15158 BC_INCREFS_DONE u0000000000000003 no match [ 417.848045] binder: 15147:15158 ERROR: BC_REGISTER_LOOPER called without request [ 417.848054] binder: 15147:15158 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.848064] binder: 15147:15158 Release 1 refcount change on invalid ref 0 ret -22 [ 417.884123] binder: 15166:15171 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 417.884132] binder: 15166:15171 BC_INCREFS_DONE u0000000000000003 no match [ 417.884137] binder: 15166:15171 ERROR: BC_REGISTER_LOOPER called without request [ 417.884146] binder: 15166:15171 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 417.884154] binder: 15166:15171 Release 1 refcount change on invalid ref 0 ret -22 [ 417.918323] binder: BINDER_SET_CONTEXT_MGR already set [ 417.918332] binder: 15167:15168 ioctl 40046207 0 returned -16 [ 417.918430] binder_alloc: 7943: binder_alloc_buf, no vma [ 417.918449] binder: 15167:15168 transaction failed 29189/-3, size 72-24 line 3136 [ 418.081712] binder: 15188:15196 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.081722] binder: 15188:15196 BC_INCREFS_DONE u0000000000000003 no match [ 418.081728] binder: 15188:15196 ERROR: BC_REGISTER_LOOPER called without request [ 418.081736] binder: 15188:15196 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.081746] binder: 15188:15196 Release 1 refcount change on invalid ref 0 ret -22 [ 418.087154] binder: BINDER_SET_CONTEXT_MGR already set [ 418.087162] binder: 15192:15198 ioctl 40046207 0 returned -16 [ 418.087269] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.087288] binder: 15192:15198 transaction failed 29189/-3, size 72-24 line 3136 [ 418.108069] binder: BINDER_SET_CONTEXT_MGR already set [ 418.108078] binder: 15203:15204 ioctl 40046207 0 returned -16 [ 418.108164] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.108190] binder: 15203:15204 transaction failed 29189/-3, size 72-24 line 3136 [ 418.125753] binder: 15205:15206 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.125763] binder: 15205:15206 BC_INCREFS_DONE u0000000000000003 no match [ 418.125769] binder: 15205:15206 ERROR: BC_REGISTER_LOOPER called without request [ 418.125777] binder: 15205:15206 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.125788] binder: 15205:15206 Release 1 refcount change on invalid ref 0 ret -22 [ 418.152417] binder: BINDER_SET_CONTEXT_MGR already set [ 418.152426] binder: 15208:15216 ioctl 40046207 0 returned -16 [ 418.152519] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.152537] binder: 15208:15216 transaction failed 29189/-3, size 72-24 line 3136 [ 418.180002] binder: 15212:15217 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.180009] binder: 15212:15217 BC_INCREFS_DONE u0000000000000003 no match [ 418.180014] binder: 15212:15217 ERROR: BC_REGISTER_LOOPER called without request [ 418.180021] binder: 15212:15217 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.180030] binder: 15212:15217 Release 1 refcount change on invalid ref 0 ret -22 [ 418.355645] binder: BINDER_SET_CONTEXT_MGR already set [ 418.355654] binder: 15232:15238 ioctl 40046207 0 returned -16 [ 418.355763] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.355782] binder: 15232:15238 transaction failed 29189/-3, size 72-24 line 3136 [ 418.374760] binder: 15235:15236 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.374768] binder: 15235:15236 BC_INCREFS_DONE u0000000000000003 no match [ 418.374773] binder: 15235:15236 ERROR: BC_REGISTER_LOOPER called without request [ 418.374779] binder: 15235:15236 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.374787] binder: 15235:15236 Release 1 refcount change on invalid ref 0 ret -22 [ 418.410825] binder: 15252:15253 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.410835] binder: 15252:15253 BC_INCREFS_DONE u0000000000000003 no match [ 418.410841] binder: 15252:15253 ERROR: BC_REGISTER_LOOPER called without request [ 418.410849] binder: 15252:15253 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.410859] binder: 15252:15253 Release 1 refcount change on invalid ref 0 ret -22 [ 418.421973] binder: BINDER_SET_CONTEXT_MGR already set [ 418.421982] binder: 15247:15255 ioctl 40046207 0 returned -16 [ 418.422081] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.422100] binder: 15247:15255 transaction failed 29189/-3, size 72-24 line 3136 [ 418.458461] binder: 15261:15263 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.458470] binder: 15261:15263 BC_INCREFS_DONE u0000000000000003 no match [ 418.458475] binder: 15261:15263 ERROR: BC_REGISTER_LOOPER called without request [ 418.458497] binder: 15261:15263 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.458507] binder: 15261:15263 Release 1 refcount change on invalid ref 0 ret -22 [ 418.575500] binder: BINDER_SET_CONTEXT_MGR already set [ 418.575509] binder: 15272:15275 ioctl 40046207 0 returned -16 [ 418.575609] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.575630] binder: 15272:15275 transaction failed 29189/-3, size 72-24 line 3136 [ 418.582623] binder: 15276:15279 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.582633] binder: 15276:15279 BC_INCREFS_DONE u0000000000000003 no match [ 418.582639] binder: 15276:15279 ERROR: BC_REGISTER_LOOPER called without request [ 418.582647] binder: 15276:15279 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.582659] binder: 15276:15279 Release 1 refcount change on invalid ref 0 ret -22 [ 418.623207] binder: 15287:15289 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.623217] binder: 15287:15289 BC_INCREFS_DONE u0000000000000003 no match [ 418.623222] binder: 15287:15289 ERROR: BC_REGISTER_LOOPER called without request [ 418.623229] binder: 15287:15289 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.623238] binder: 15287:15289 Release 1 refcount change on invalid ref 0 ret -22 [ 418.657953] binder: BINDER_SET_CONTEXT_MGR already set [ 418.657961] binder: 15286:15291 ioctl 40046207 0 returned -16 [ 418.661170] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.661187] binder: 15286:15291 transaction failed 29189/-3, size 72-24 line 3136 [ 418.664773] binder: 15298:15299 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.664783] binder: 15298:15299 BC_INCREFS_DONE u0000000000000003 no match [ 418.664788] binder: 15298:15299 ERROR: BC_REGISTER_LOOPER called without request [ 418.664796] binder: 15298:15299 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.664806] binder: 15298:15299 Release 1 refcount change on invalid ref 0 ret -22 [ 418.846027] binder: BINDER_SET_CONTEXT_MGR already set [ 418.846035] binder: 15315:15321 ioctl 40046207 0 returned -16 [ 418.846136] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.846155] binder: 15315:15321 transaction failed 29189/-3, size 72-24 line 3136 [ 418.854570] binder: 15317:15322 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.854579] binder: 15317:15322 BC_INCREFS_DONE u0000000000000003 no match [ 418.854584] binder: 15317:15322 ERROR: BC_REGISTER_LOOPER called without request [ 418.854596] binder: 15317:15322 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.854604] binder: 15317:15322 Release 1 refcount change on invalid ref 0 ret -22 [ 418.880061] binder: BINDER_SET_CONTEXT_MGR already set [ 418.880069] binder: 15326:15327 ioctl 40046207 0 returned -16 [ 418.880166] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.880193] binder: 15326:15327 transaction failed 29189/-3, size 72-24 line 3136 [ 418.912429] binder: BINDER_SET_CONTEXT_MGR already set [ 418.912437] binder: 15331:15333 ioctl 40046207 0 returned -16 [ 418.912537] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.912555] binder: 15331:15333 transaction failed 29189/-3, size 72-24 line 3136 [ 418.924767] binder: 15332:15334 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.924777] binder: 15332:15334 BC_INCREFS_DONE u0000000000000003 no match [ 418.924782] binder: 15332:15334 ERROR: BC_REGISTER_LOOPER called without request [ 418.924789] binder: 15332:15334 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.924799] binder: 15332:15334 Release 1 refcount change on invalid ref 0 ret -22 [ 418.961709] binder: BINDER_SET_CONTEXT_MGR already set [ 418.961718] binder: 15340:15343 ioctl 40046207 0 returned -16 [ 418.961823] binder_alloc: 7943: binder_alloc_buf, no vma [ 418.961842] binder: 15340:15343 transaction failed 29189/-3, size 72-24 line 3136 [ 418.966597] binder: 15341:15348 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 418.966608] binder: 15341:15348 BC_INCREFS_DONE u0000000000000003 no match [ 418.966614] binder: 15341:15348 ERROR: BC_REGISTER_LOOPER called without request [ 418.966623] binder: 15341:15348 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 418.966634] binder: 15341:15348 Release 1 refcount change on invalid ref 0 ret -22 [ 419.084029] binder: BINDER_SET_CONTEXT_MGR already set [ 419.084038] binder: 15355:15360 ioctl 40046207 0 returned -16 [ 419.084247] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.084266] binder: 15355:15360 transaction failed 29189/-3, size 72-24 line 3136 [ 419.109426] binder: 15358:15361 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.109435] binder: 15358:15361 BC_INCREFS_DONE u0000000000000003 no match [ 419.109441] binder: 15358:15361 ERROR: BC_REGISTER_LOOPER called without request [ 419.109449] binder: 15358:15361 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.109460] binder: 15358:15361 Release 1 refcount change on invalid ref 0 ret -22 [ 419.127556] binder: BINDER_SET_CONTEXT_MGR already set [ 419.127567] binder: 15365:15370 ioctl 40046207 0 returned -16 [ 419.127673] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.127691] binder: 15365:15370 transaction failed 29189/-3, size 72-24 line 3136 [ 419.167942] binder: BINDER_SET_CONTEXT_MGR already set [ 419.167951] binder: 15377:15383 ioctl 40046207 0 returned -16 [ 419.168040] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.168059] binder: 15377:15383 transaction failed 29189/-3, size 72-24 line 3136 [ 419.198874] binder: 15379:15386 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.198884] binder: 15379:15386 BC_INCREFS_DONE u0000000000000003 no match [ 419.198889] binder: 15379:15386 ERROR: BC_REGISTER_LOOPER called without request [ 419.198898] binder: 15379:15386 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.198910] binder: 15379:15386 Release 1 refcount change on invalid ref 0 ret -22 [ 419.447458] binder: 15395:15400 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.447468] binder: 15395:15400 BC_INCREFS_DONE u0000000000000003 no match [ 419.447474] binder: 15395:15400 ERROR: BC_REGISTER_LOOPER called without request [ 419.447482] binder: 15395:15400 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.447494] binder: 15395:15400 Release 1 refcount change on invalid ref 0 ret -22 [ 419.463613] binder: BINDER_SET_CONTEXT_MGR already set [ 419.463621] binder: 15401:15409 ioctl 40046207 0 returned -16 [ 419.469616] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.469634] binder: 15401:15409 transaction failed 29189/-3, size 72-24 line 3136 [ 419.527014] binder: BINDER_SET_CONTEXT_MGR already set [ 419.527023] binder: 15418:15424 ioctl 40046207 0 returned -16 [ 419.527117] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.527136] binder: 15418:15424 transaction failed 29189/-3, size 72-24 line 3136 [ 419.544842] binder: 15420:15426 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.544852] binder: 15420:15426 BC_INCREFS_DONE u0000000000000003 no match [ 419.544858] binder: 15420:15426 ERROR: BC_REGISTER_LOOPER called without request [ 419.544867] binder: 15420:15426 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.544877] binder: 15420:15426 Release 1 refcount change on invalid ref 0 ret -22 [ 419.552022] binder: BINDER_SET_CONTEXT_MGR already set [ 419.552030] binder: 15430:15432 ioctl 40046207 0 returned -16 [ 419.552118] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.552136] binder: 15430:15432 transaction failed 29189/-3, size 72-24 line 3136 [ 419.694038] binder: 15445:15449 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.694048] binder: 15445:15449 BC_INCREFS_DONE u0000000000000003 no match [ 419.694069] binder: 15445:15449 ERROR: BC_REGISTER_LOOPER called without request [ 419.694095] binder: 15445:15449 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.694105] binder: 15445:15449 Release 1 refcount change on invalid ref 0 ret -22 [ 419.730873] binder: BINDER_SET_CONTEXT_MGR already set [ 419.730882] binder: 15442:15452 ioctl 40046207 0 returned -16 [ 419.730979] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.731005] binder: 15442:15452 transaction failed 29189/-3, size 72-24 line 3136 [ 419.745719] binder: 15454:15460 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.745728] binder: 15454:15460 BC_INCREFS_DONE u0000000000000003 no match [ 419.745734] binder: 15454:15460 ERROR: BC_REGISTER_LOOPER called without request [ 419.745742] binder: 15454:15460 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.745753] binder: 15454:15460 Release 1 refcount change on invalid ref 0 ret -22 [ 419.783869] binder: BINDER_SET_CONTEXT_MGR already set [ 419.783878] binder: 15466:15473 ioctl 40046207 0 returned -16 [ 419.783987] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.784005] binder: 15466:15473 transaction failed 29189/-3, size 72-24 line 3136 [ 419.936294] binder: BINDER_SET_CONTEXT_MGR already set [ 419.936304] binder: 15483:15487 ioctl 40046207 0 returned -16 [ 419.936409] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.936430] binder: 15483:15487 transaction failed 29189/-3, size 72-24 line 3136 [ 419.939910] binder: 15485:15489 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 419.939921] binder: 15485:15489 BC_INCREFS_DONE u0000000000000003 no match [ 419.939927] binder: 15485:15489 ERROR: BC_REGISTER_LOOPER called without request [ 419.939936] binder: 15485:15489 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 419.939946] binder: 15485:15489 Release 1 refcount change on invalid ref 0 ret -22 [ 419.998682] binder: BINDER_SET_CONTEXT_MGR already set [ 419.998691] binder: 15495:15503 ioctl 40046207 0 returned -16 [ 419.998798] binder_alloc: 7943: binder_alloc_buf, no vma [ 419.998818] binder: 15495:15503 transaction failed 29189/-3, size 72-24 line 3136 [ 420.005912] binder: 15501:15506 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.005921] binder: 15501:15506 BC_INCREFS_DONE u0000000000000003 no match [ 420.005927] binder: 15501:15506 ERROR: BC_REGISTER_LOOPER called without request [ 420.005935] binder: 15501:15506 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.005944] binder: 15501:15506 Release 1 refcount change on invalid ref 0 ret -22 [ 420.177610] binder: BINDER_SET_CONTEXT_MGR already set [ 420.177620] binder: 15527:15528 ioctl 40046207 0 returned -16 [ 420.177714] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.177735] binder: 15527:15528 transaction failed 29189/-3, size 72-24 line 3136 [ 420.199941] binder: 15521:15529 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.199951] binder: 15521:15529 BC_INCREFS_DONE u0000000000000003 no match [ 420.199957] binder: 15521:15529 ERROR: BC_REGISTER_LOOPER called without request [ 420.199966] binder: 15521:15529 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.199977] binder: 15521:15529 Release 1 refcount change on invalid ref 0 ret -22 [ 420.214456] binder: BINDER_SET_CONTEXT_MGR already set [ 420.214469] binder: 15534:15539 ioctl 40046207 0 returned -16 [ 420.214885] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.214903] binder: 15534:15539 transaction failed 29189/-3, size 72-24 line 3136 [ 420.238540] binder: BINDER_SET_CONTEXT_MGR already set [ 420.238549] binder: 15543:15544 ioctl 40046207 0 returned -16 [ 420.238639] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.238657] binder: 15543:15544 transaction failed 29189/-3, size 72-24 line 3136 [ 420.390863] binder: 15558:15560 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.390873] binder: 15558:15560 BC_INCREFS_DONE u0000000000000003 no match [ 420.390879] binder: 15558:15560 ERROR: BC_REGISTER_LOOPER called without request [ 420.390887] binder: 15558:15560 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.390896] binder: 15558:15560 Release 1 refcount change on invalid ref 0 ret -22 [ 420.424347] binder: 15571:15573 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.424356] binder: 15571:15573 BC_INCREFS_DONE u0000000000000003 no match [ 420.424362] binder: 15571:15573 ERROR: BC_REGISTER_LOOPER called without request [ 420.424369] binder: 15571:15573 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.424378] binder: 15571:15573 Release 1 refcount change on invalid ref 0 ret -22 [ 420.453328] binder: BINDER_SET_CONTEXT_MGR already set [ 420.453336] binder: 15559:15567 ioctl 40046207 0 returned -16 [ 420.453447] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.453466] binder: 15559:15567 transaction failed 29189/-3, size 72-24 line 3136 [ 420.454447] binder: 15574:15576 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.454456] binder: 15574:15576 BC_INCREFS_DONE u0000000000000003 no match [ 420.454470] binder: 15574:15576 ERROR: BC_REGISTER_LOOPER called without request [ 420.454611] binder: 15574:15576 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.454621] binder: 15574:15576 Release 1 refcount change on invalid ref 0 ret -22 [ 420.504418] binder: 15583:15589 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.504427] binder: 15583:15589 BC_INCREFS_DONE u0000000000000003 no match [ 420.504432] binder: 15583:15589 ERROR: BC_REGISTER_LOOPER called without request [ 420.504439] binder: 15583:15589 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.504448] binder: 15583:15589 Release 1 refcount change on invalid ref 0 ret -22 [ 420.651757] binder: BINDER_SET_CONTEXT_MGR already set [ 420.651768] binder: 15601:15604 ioctl 40046207 0 returned -16 [ 420.651864] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.651885] binder: 15601:15604 transaction failed 29189/-3, size 72-24 line 3136 [ 420.669304] binder: 15600:15607 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.669313] binder: 15600:15607 BC_INCREFS_DONE u0000000000000003 no match [ 420.669319] binder: 15600:15607 ERROR: BC_REGISTER_LOOPER called without request [ 420.669327] binder: 15600:15607 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.669338] binder: 15600:15607 Release 1 refcount change on invalid ref 0 ret -22 [ 420.713863] binder: BINDER_SET_CONTEXT_MGR already set [ 420.713879] binder: 15610:15612 ioctl 40046207 0 returned -16 [ 420.714048] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.714068] binder: 15610:15612 transaction failed 29189/-3, size 72-24 line 3136 [ 420.730904] binder: 15615:15623 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.730915] binder: 15615:15623 BC_INCREFS_DONE u0000000000000003 no match [ 420.730920] binder: 15615:15623 ERROR: BC_REGISTER_LOOPER called without request [ 420.730928] binder: 15615:15623 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.730938] binder: 15615:15623 Release 1 refcount change on invalid ref 0 ret -22 [ 420.890275] binder: 15639:15642 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.890285] binder: 15639:15642 BC_INCREFS_DONE u0000000000000003 no match [ 420.890291] binder: 15639:15642 ERROR: BC_REGISTER_LOOPER called without request [ 420.890300] binder: 15639:15642 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.890309] binder: 15639:15642 Release 1 refcount change on invalid ref 0 ret -22 [ 420.903471] binder: BINDER_SET_CONTEXT_MGR already set [ 420.903479] binder: 15641:15646 ioctl 40046207 0 returned -16 [ 420.903569] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.903589] binder: 15641:15646 transaction failed 29189/-3, size 72-24 line 3136 [ 420.941542] binder: BINDER_SET_CONTEXT_MGR already set [ 420.941550] binder: 15652:15653 ioctl 40046207 0 returned -16 [ 420.941653] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.941672] binder: 15652:15653 transaction failed 29189/-3, size 72-24 line 3136 [ 420.978069] binder: 15657:15660 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 420.978078] binder: 15657:15660 BC_INCREFS_DONE u0000000000000003 no match [ 420.978084] binder: 15657:15660 ERROR: BC_REGISTER_LOOPER called without request [ 420.978092] binder: 15657:15660 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 420.978102] binder: 15657:15660 Release 1 refcount change on invalid ref 0 ret -22 [ 420.991071] binder: BINDER_SET_CONTEXT_MGR already set [ 420.991079] binder: 15662:15664 ioctl 40046207 0 returned -16 [ 420.991167] binder_alloc: 7943: binder_alloc_buf, no vma [ 420.991197] binder: 15662:15664 transaction failed 29189/-3, size 72-24 line 3136 [ 421.055839] binder: 15671:15678 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.055849] binder: 15671:15678 BC_INCREFS_DONE u0000000000000003 no match [ 421.055855] binder: 15671:15678 ERROR: BC_REGISTER_LOOPER called without request [ 421.055863] binder: 15671:15678 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.055873] binder: 15671:15678 Release 1 refcount change on invalid ref 0 ret -22 [ 421.165021] binder: 15682:15685 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.165030] binder: 15682:15685 BC_INCREFS_DONE u0000000000000003 no match [ 421.165035] binder: 15682:15685 ERROR: BC_REGISTER_LOOPER called without request [ 421.165043] binder: 15682:15685 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.165051] binder: 15682:15685 Release 1 refcount change on invalid ref 0 ret -22 [ 421.213813] binder: BINDER_SET_CONTEXT_MGR already set [ 421.213822] binder: 15686:15689 ioctl 40046207 0 returned -16 [ 421.213914] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.213934] binder: 15686:15689 transaction failed 29189/-3, size 72-24 line 3136 [ 421.251968] binder: BINDER_SET_CONTEXT_MGR already set [ 421.251977] binder: 15696:15699 ioctl 40046207 0 returned -16 [ 421.258838] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.258857] binder: 15696:15699 transaction failed 29189/-3, size 72-24 line 3136 [ 421.260333] binder: 15698:15700 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.260343] binder: 15698:15700 BC_INCREFS_DONE u0000000000000003 no match [ 421.260349] binder: 15698:15700 ERROR: BC_REGISTER_LOOPER called without request [ 421.260358] binder: 15698:15700 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.260369] binder: 15698:15700 Release 1 refcount change on invalid ref 0 ret -22 [ 421.310142] binder: BINDER_SET_CONTEXT_MGR already set [ 421.310151] binder: 15708:15714 ioctl 40046207 0 returned -16 [ 421.313669] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.313696] binder: 15708:15714 transaction failed 29189/-3, size 72-24 line 3136 [ 421.314456] binder: 15710:15716 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.314474] binder: 15710:15716 BC_INCREFS_DONE u0000000000000003 no match [ 421.314555] binder: 15710:15716 ERROR: BC_REGISTER_LOOPER called without request [ 421.314564] binder: 15710:15716 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.314574] binder: 15710:15716 Release 1 refcount change on invalid ref 0 ret -22 [ 421.458457] binder: 15729:15731 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.458466] binder: 15729:15731 BC_INCREFS_DONE u0000000000000003 no match [ 421.458472] binder: 15729:15731 ERROR: BC_REGISTER_LOOPER called without request [ 421.458481] binder: 15729:15731 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.458490] binder: 15729:15731 Release 1 refcount change on invalid ref 0 ret -22 [ 421.476614] binder: BINDER_SET_CONTEXT_MGR already set [ 421.476622] binder: 15727:15732 ioctl 40046207 0 returned -16 [ 421.476859] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.476877] binder: 15727:15732 transaction failed 29189/-3, size 72-24 line 3136 [ 421.550159] binder: 15751:15754 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.550170] binder: 15751:15754 BC_INCREFS_DONE u0000000000000003 no match [ 421.550175] binder: 15751:15754 ERROR: BC_REGISTER_LOOPER called without request [ 421.550195] binder: 15751:15754 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.550204] binder: 15751:15754 Release 1 refcount change on invalid ref 0 ret -22 [ 421.694284] binder: 15766:15768 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.694294] binder: 15766:15768 BC_INCREFS_DONE u0000000000000003 no match [ 421.694300] binder: 15766:15768 ERROR: BC_REGISTER_LOOPER called without request [ 421.694311] binder: 15766:15768 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.694323] binder: 15766:15768 Release 1 refcount change on invalid ref 0 ret -22 [ 421.699032] binder: BINDER_SET_CONTEXT_MGR already set [ 421.699042] binder: 15762:15770 ioctl 40046207 0 returned -16 [ 421.699152] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.699174] binder: 15762:15770 transaction failed 29189/-3, size 72-24 line 3136 [ 421.777755] binder: 15781:15786 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.777766] binder: 15781:15786 BC_INCREFS_DONE u0000000000000003 no match [ 421.777772] binder: 15781:15786 ERROR: BC_REGISTER_LOOPER called without request [ 421.777779] binder: 15781:15786 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.777791] binder: 15781:15786 Release 1 refcount change on invalid ref 0 ret -22 [ 421.778150] binder: BINDER_SET_CONTEXT_MGR already set [ 421.778169] binder: 15779:15787 ioctl 40046207 0 returned -16 [ 421.783796] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.783814] binder: 15779:15787 transaction failed 29189/-3, size 72-24 line 3136 [ 421.949810] binder: BINDER_SET_CONTEXT_MGR already set [ 421.949819] binder: 15807:15812 ioctl 40046207 0 returned -16 [ 421.949911] binder_alloc: 7943: binder_alloc_buf, no vma [ 421.949931] binder: 15807:15812 transaction failed 29189/-3, size 72-24 line 3136 [ 421.979060] binder: 15806:15814 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 421.979069] binder: 15806:15814 BC_INCREFS_DONE u0000000000000003 no match [ 421.979075] binder: 15806:15814 ERROR: BC_REGISTER_LOOPER called without request [ 421.979083] binder: 15806:15814 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 421.979093] binder: 15806:15814 Release 1 refcount change on invalid ref 0 ret -22 [ 422.020158] binder: BINDER_SET_CONTEXT_MGR already set [ 422.020167] binder: 15820:15826 ioctl 40046207 0 returned -16 [ 422.020288] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.020307] binder: 15820:15826 transaction failed 29189/-3, size 72-24 line 3136 [ 422.021040] binder: 15822:15829 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.021049] binder: 15822:15829 BC_INCREFS_DONE u0000000000000003 no match [ 422.021054] binder: 15822:15829 ERROR: BC_REGISTER_LOOPER called without request [ 422.021062] binder: 15822:15829 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.021071] binder: 15822:15829 Release 1 refcount change on invalid ref 0 ret -22 [ 422.081393] binder: 15835:15841 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.081403] binder: 15835:15841 BC_INCREFS_DONE u0000000000000003 no match [ 422.081409] binder: 15835:15841 ERROR: BC_REGISTER_LOOPER called without request [ 422.081417] binder: 15835:15841 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.081429] binder: 15835:15841 Release 1 refcount change on invalid ref 0 ret -22 [ 422.101025] binder: BINDER_SET_CONTEXT_MGR already set [ 422.101034] binder: 15833:15845 ioctl 40046207 0 returned -16 [ 422.101123] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.101142] binder: 15833:15845 transaction failed 29189/-3, size 72-24 line 3136 [ 422.257892] binder: BINDER_SET_CONTEXT_MGR already set [ 422.257901] binder: 15867:15871 ioctl 40046207 0 returned -16 [ 422.257991] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.258010] binder: 15867:15871 transaction failed 29189/-3, size 72-24 line 3136 [ 422.286199] binder: 15866:15873 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.286208] binder: 15866:15873 BC_INCREFS_DONE u0000000000000003 no match [ 422.286214] binder: 15866:15873 ERROR: BC_REGISTER_LOOPER called without request [ 422.286223] binder: 15866:15873 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.286234] binder: 15866:15873 Release 1 refcount change on invalid ref 0 ret -22 [ 422.324167] binder: BINDER_SET_CONTEXT_MGR already set [ 422.324177] binder: 15880:15884 ioctl 40046207 0 returned -16 [ 422.324288] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.324308] binder: 15880:15884 transaction failed 29189/-3, size 72-24 line 3136 [ 422.349275] binder: 15886:15893 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.349284] binder: 15886:15893 BC_INCREFS_DONE u0000000000000003 no match [ 422.349290] binder: 15886:15893 ERROR: BC_REGISTER_LOOPER called without request [ 422.349298] binder: 15886:15893 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.349307] binder: 15886:15893 Release 1 refcount change on invalid ref 0 ret -22 [ 422.519143] binder: BINDER_SET_CONTEXT_MGR already set [ 422.519151] binder: 15909:15918 ioctl 40046207 0 returned -16 [ 422.519314] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.519332] binder: 15909:15918 transaction failed 29189/-3, size 72-24 line 3136 [ 422.534084] binder: 15914:15916 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.534095] binder: 15914:15916 BC_INCREFS_DONE u0000000000000003 no match [ 422.534101] binder: 15914:15916 ERROR: BC_REGISTER_LOOPER called without request [ 422.534110] binder: 15914:15916 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.534119] binder: 15914:15916 Release 1 refcount change on invalid ref 0 ret -22 [ 422.586753] binder: 15929:15936 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.586762] binder: 15929:15936 BC_INCREFS_DONE u0000000000000003 no match [ 422.586768] binder: 15929:15936 ERROR: BC_REGISTER_LOOPER called without request [ 422.586775] binder: 15929:15936 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.586786] binder: 15929:15936 Release 1 refcount change on invalid ref 0 ret -22 [ 422.599859] binder: BINDER_SET_CONTEXT_MGR already set [ 422.599868] binder: 15928:15937 ioctl 40046207 0 returned -16 [ 422.599978] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.599999] binder: 15928:15937 transaction failed 29189/-3, size 72-24 line 3136 [ 422.768810] binder: BINDER_SET_CONTEXT_MGR already set [ 422.768919] binder: 15956:15961 ioctl 40046207 0 returned -16 [ 422.769017] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.769038] binder: 15956:15961 transaction failed 29189/-3, size 72-24 line 3136 [ 422.784453] binder: 15954:15963 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.784470] binder: 15954:15963 BC_INCREFS_DONE u0000000000000003 no match [ 422.784506] binder: 15954:15963 ERROR: BC_REGISTER_LOOPER called without request [ 422.784514] binder: 15954:15963 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.784524] binder: 15954:15963 Release 1 refcount change on invalid ref 0 ret -22 [ 422.828226] binder: BINDER_SET_CONTEXT_MGR already set [ 422.828235] binder: 15972:15973 ioctl 40046207 0 returned -16 [ 422.828345] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.828379] binder: 15972:15973 transaction failed 29189/-3, size 72-24 line 3136 [ 422.862346] binder: BINDER_SET_CONTEXT_MGR already set [ 422.862354] binder: 15980:15981 ioctl 40046207 0 returned -16 [ 422.862454] binder_alloc: 7943: binder_alloc_buf, no vma [ 422.862472] binder: 15980:15981 transaction failed 29189/-3, size 72-24 line 3136 [ 422.872093] binder: 15985:15986 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 422.872102] binder: 15985:15986 BC_INCREFS_DONE u0000000000000003 no match [ 422.872108] binder: 15985:15986 ERROR: BC_REGISTER_LOOPER called without request [ 422.872116] binder: 15985:15986 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 422.872127] binder: 15985:15986 Release 1 refcount change on invalid ref 0 ret -22 [ 423.017578] binder: 16000:16003 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.017588] binder: 16000:16003 BC_INCREFS_DONE u0000000000000003 no match [ 423.017594] binder: 16000:16003 ERROR: BC_REGISTER_LOOPER called without request [ 423.017602] binder: 16000:16003 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.017612] binder: 16000:16003 Release 1 refcount change on invalid ref 0 ret -22 [ 423.049755] binder: BINDER_SET_CONTEXT_MGR already set [ 423.049763] binder: 16001:16007 ioctl 40046207 0 returned -16 [ 423.049950] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.049968] binder: 16001:16007 transaction failed 29189/-3, size 72-24 line 3136 [ 423.050072] binder: 16010:16014 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.050082] binder: 16010:16014 BC_INCREFS_DONE u0000000000000003 no match [ 423.050088] binder: 16010:16014 ERROR: BC_REGISTER_LOOPER called without request [ 423.050096] binder: 16010:16014 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.050106] binder: 16010:16014 Release 1 refcount change on invalid ref 0 ret -22 [ 423.098180] binder: BINDER_SET_CONTEXT_MGR already set [ 423.098198] binder: 16018:16021 ioctl 40046207 0 returned -16 [ 423.098305] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.098324] binder: 16018:16021 transaction failed 29189/-3, size 72-24 line 3136 [ 423.123225] binder: 16017:16023 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.123235] binder: 16017:16023 BC_INCREFS_DONE u0000000000000003 no match [ 423.123241] binder: 16017:16023 ERROR: BC_REGISTER_LOOPER called without request [ 423.123249] binder: 16017:16023 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.123260] binder: 16017:16023 Release 1 refcount change on invalid ref 0 ret -22 [ 423.319027] binder: BINDER_SET_CONTEXT_MGR already set [ 423.319035] binder: 16035:16041 ioctl 40046207 0 returned -16 [ 423.319297] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.319315] binder: 16035:16041 transaction failed 29189/-3, size 72-24 line 3136 [ 423.322572] binder: 16038:16044 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.322582] binder: 16038:16044 BC_INCREFS_DONE u0000000000000003 no match [ 423.322587] binder: 16038:16044 ERROR: BC_REGISTER_LOOPER called without request [ 423.322596] binder: 16038:16044 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.322605] binder: 16038:16044 Release 1 refcount change on invalid ref 0 ret -22 [ 423.391160] binder: 16053:16058 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.391170] binder: 16053:16058 BC_INCREFS_DONE u0000000000000003 no match [ 423.391176] binder: 16053:16058 ERROR: BC_REGISTER_LOOPER called without request [ 423.391192] binder: 16053:16058 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.391204] binder: 16053:16058 Release 1 refcount change on invalid ref 0 ret -22 [ 423.402944] binder: BINDER_SET_CONTEXT_MGR already set [ 423.402954] binder: 16060:16064 ioctl 40046207 0 returned -16 [ 423.404015] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.404034] binder: 16060:16064 transaction failed 29189/-3, size 72-24 line 3136 [ 423.590617] binder: BINDER_SET_CONTEXT_MGR already set [ 423.590625] binder: 16083:16089 ioctl 40046207 0 returned -16 [ 423.590804] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.590824] binder: 16083:16089 transaction failed 29189/-3, size 72-24 line 3136 [ 423.597757] binder: 16081:16091 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.597766] binder: 16081:16091 BC_INCREFS_DONE u0000000000000003 no match [ 423.597772] binder: 16081:16091 ERROR: BC_REGISTER_LOOPER called without request [ 423.597781] binder: 16081:16091 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.597792] binder: 16081:16091 Release 1 refcount change on invalid ref 0 ret -22 [ 423.626009] binder: BINDER_SET_CONTEXT_MGR already set [ 423.626018] binder: 16094:16098 ioctl 40046207 0 returned -16 [ 423.626125] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.626160] binder: 16094:16098 transaction failed 29189/-3, size 72-24 line 3136 [ 423.631314] binder: 16097:16100 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.631323] binder: 16097:16100 BC_INCREFS_DONE u0000000000000003 no match [ 423.631329] binder: 16097:16100 ERROR: BC_REGISTER_LOOPER called without request [ 423.631338] binder: 16097:16100 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.631347] binder: 16097:16100 Release 1 refcount change on invalid ref 0 ret -22 [ 423.673321] binder: BINDER_SET_CONTEXT_MGR already set [ 423.673330] binder: 16108:16110 ioctl 40046207 0 returned -16 [ 423.673437] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.673456] binder: 16108:16110 transaction failed 29189/-3, size 72-24 line 3136 [ 423.689531] binder: 16112:16115 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.689541] binder: 16112:16115 BC_INCREFS_DONE u0000000000000003 no match [ 423.689547] binder: 16112:16115 ERROR: BC_REGISTER_LOOPER called without request [ 423.689556] binder: 16112:16115 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.689568] binder: 16112:16115 Release 1 refcount change on invalid ref 0 ret -22 [ 423.837275] binder: BINDER_SET_CONTEXT_MGR already set [ 423.837283] binder: 16125:16129 ioctl 40046207 0 returned -16 [ 423.837386] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.837405] binder: 16125:16129 transaction failed 29189/-3, size 72-24 line 3136 [ 423.843855] binder: 16126:16134 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.843865] binder: 16126:16134 BC_INCREFS_DONE u0000000000000003 no match [ 423.843870] binder: 16126:16134 ERROR: BC_REGISTER_LOOPER called without request [ 423.843878] binder: 16126:16134 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.843889] binder: 16126:16134 Release 1 refcount change on invalid ref 0 ret -22 [ 423.882792] binder: 16141:16144 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.882801] binder: 16141:16144 BC_INCREFS_DONE u0000000000000003 no match [ 423.882807] binder: 16141:16144 ERROR: BC_REGISTER_LOOPER called without request [ 423.882815] binder: 16141:16144 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.882823] binder: 16141:16144 Release 1 refcount change on invalid ref 0 ret -22 [ 423.921683] binder: BINDER_SET_CONTEXT_MGR already set [ 423.921692] binder: 16142:16151 ioctl 40046207 0 returned -16 [ 423.921795] binder_alloc: 7943: binder_alloc_buf, no vma [ 423.921814] binder: 16142:16151 transaction failed 29189/-3, size 72-24 line 3136 [ 423.927362] binder: 16148:16153 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 423.927371] binder: 16148:16153 BC_INCREFS_DONE u0000000000000003 no match [ 423.927377] binder: 16148:16153 ERROR: BC_REGISTER_LOOPER called without request [ 423.927400] binder: 16148:16153 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 423.927408] binder: 16148:16153 Release 1 refcount change on invalid ref 0 ret -22 [ 424.090251] binder: 16168:16173 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.090260] binder: 16168:16173 BC_INCREFS_DONE u0000000000000003 no match [ 424.090266] binder: 16168:16173 ERROR: BC_REGISTER_LOOPER called without request [ 424.090274] binder: 16168:16173 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.090283] binder: 16168:16173 Release 1 refcount change on invalid ref 0 ret -22 [ 424.141840] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.141859] binder: 16166:16175 transaction failed 29189/-3, size 72-24 line 3136 [ 424.141939] binder: 16180:16186 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.141947] binder: 16180:16186 BC_INCREFS_DONE u0000000000000003 no match [ 424.141953] binder: 16180:16186 ERROR: BC_REGISTER_LOOPER called without request [ 424.141961] binder: 16180:16186 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.141972] binder: 16180:16186 Release 1 refcount change on invalid ref 0 ret -22 [ 424.189181] binder: 16192:16196 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.189200] binder: 16192:16196 BC_INCREFS_DONE u0000000000000003 no match [ 424.189205] binder: 16192:16196 ERROR: BC_REGISTER_LOOPER called without request [ 424.189213] binder: 16192:16196 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.189223] binder: 16192:16196 Release 1 refcount change on invalid ref 0 ret -22 [ 424.330320] binder: BINDER_SET_CONTEXT_MGR already set [ 424.330329] binder: 16211:16214 ioctl 40046207 0 returned -16 [ 424.334228] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.334247] binder: 16211:16214 transaction failed 29189/-3, size 72-24 line 3136 [ 424.337768] binder: 16213:16217 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.337777] binder: 16213:16217 BC_INCREFS_DONE u0000000000000003 no match [ 424.337783] binder: 16213:16217 ERROR: BC_REGISTER_LOOPER called without request [ 424.337791] binder: 16213:16217 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.337800] binder: 16213:16217 Release 1 refcount change on invalid ref 0 ret -22 [ 424.357972] binder: 16222:16224 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.357983] binder: 16222:16224 BC_INCREFS_DONE u0000000000000003 no match [ 424.357989] binder: 16222:16224 ERROR: BC_REGISTER_LOOPER called without request [ 424.357997] binder: 16222:16224 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.358007] binder: 16222:16224 Release 1 refcount change on invalid ref 0 ret -22 [ 424.381838] binder: 16225:16228 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.381847] binder: 16225:16228 BC_INCREFS_DONE u0000000000000003 no match [ 424.381853] binder: 16225:16228 ERROR: BC_REGISTER_LOOPER called without request [ 424.381861] binder: 16225:16228 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.381872] binder: 16225:16228 Release 1 refcount change on invalid ref 0 ret -22 [ 424.420599] binder: BINDER_SET_CONTEXT_MGR already set [ 424.420607] binder: 16231:16237 ioctl 40046207 0 returned -16 [ 424.420697] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.420715] binder: 16231:16237 transaction failed 29189/-3, size 72-24 line 3136 [ 424.584128] binder: 16248:16254 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.584138] binder: 16248:16254 BC_INCREFS_DONE u0000000000000003 no match [ 424.584143] binder: 16248:16254 ERROR: BC_REGISTER_LOOPER called without request [ 424.584152] binder: 16248:16254 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.584161] binder: 16248:16254 Release 1 refcount change on invalid ref 0 ret -22 [ 424.593849] binder: BINDER_SET_CONTEXT_MGR already set [ 424.593858] binder: 16251:16253 ioctl 40046207 0 returned -16 [ 424.593954] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.593972] binder: 16251:16253 transaction failed 29189/-3, size 72-24 line 3136 [ 424.638908] binder: BINDER_SET_CONTEXT_MGR already set [ 424.638917] binder: 16266:16268 ioctl 40046207 0 returned -16 [ 424.639021] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.639040] binder: 16266:16268 transaction failed 29189/-3, size 72-24 line 3136 [ 424.651308] binder: 16263:16267 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.651318] binder: 16263:16267 BC_INCREFS_DONE u0000000000000003 no match [ 424.651323] binder: 16263:16267 ERROR: BC_REGISTER_LOOPER called without request [ 424.651332] binder: 16263:16267 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.651341] binder: 16263:16267 Release 1 refcount change on invalid ref 0 ret -22 [ 424.828903] binder: BINDER_SET_CONTEXT_MGR already set [ 424.828912] binder: 16289:16295 ioctl 40046207 0 returned -16 [ 424.829007] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.829025] binder: 16289:16295 transaction failed 29189/-3, size 72-24 line 3136 [ 424.829355] binder: 16291:16297 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.829364] binder: 16291:16297 BC_INCREFS_DONE u0000000000000003 no match [ 424.829370] binder: 16291:16297 ERROR: BC_REGISTER_LOOPER called without request [ 424.829378] binder: 16291:16297 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.829387] binder: 16291:16297 Release 1 refcount change on invalid ref 0 ret -22 [ 424.901650] binder: 16310:16317 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 424.901659] binder: 16310:16317 BC_INCREFS_DONE u0000000000000003 no match [ 424.901664] binder: 16310:16317 ERROR: BC_REGISTER_LOOPER called without request [ 424.901672] binder: 16310:16317 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 424.901682] binder: 16310:16317 Release 1 refcount change on invalid ref 0 ret -22 [ 424.912456] binder: BINDER_SET_CONTEXT_MGR already set [ 424.912466] binder: 16313:16320 ioctl 40046207 0 returned -16 [ 424.912569] binder_alloc: 7943: binder_alloc_buf, no vma [ 424.912590] binder: 16313:16320 transaction failed 29189/-3, size 72-24 line 3136 [ 425.086154] binder: 16336:16343 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.086164] binder: 16336:16343 BC_INCREFS_DONE u0000000000000003 no match [ 425.086169] binder: 16336:16343 ERROR: BC_REGISTER_LOOPER called without request [ 425.086177] binder: 16336:16343 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.086194] binder: 16336:16343 Release 1 refcount change on invalid ref 0 ret -22 [ 425.090467] binder: BINDER_SET_CONTEXT_MGR already set [ 425.090476] binder: 16337:16340 ioctl 40046207 0 returned -16 [ 425.090603] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.090622] binder: 16337:16340 transaction failed 29189/-3, size 72-24 line 3136 [ 425.144069] binder: 16352:16354 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.144079] binder: 16352:16354 BC_INCREFS_DONE u0000000000000003 no match [ 425.144085] binder: 16352:16354 ERROR: BC_REGISTER_LOOPER called without request [ 425.144093] binder: 16352:16354 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.144103] binder: 16352:16354 Release 1 refcount change on invalid ref 0 ret -22 [ 425.183174] binder: BINDER_SET_CONTEXT_MGR already set [ 425.183184] binder: 16359:16367 ioctl 40046207 0 returned -16 [ 425.183798] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.183820] binder: 16359:16367 transaction failed 29189/-3, size 72-24 line 3136 [ 425.228515] binder: 16365:16374 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.228524] binder: 16365:16374 BC_INCREFS_DONE u0000000000000003 no match [ 425.228529] binder: 16365:16374 ERROR: BC_REGISTER_LOOPER called without request [ 425.228537] binder: 16365:16374 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.228546] binder: 16365:16374 Release 1 refcount change on invalid ref 0 ret -22 [ 425.338145] binder: BINDER_SET_CONTEXT_MGR already set [ 425.338155] binder: 16387:16390 ioctl 40046207 0 returned -16 [ 425.338252] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.338271] binder: 16387:16390 transaction failed 29189/-3, size 72-24 line 3136 [ 425.342782] binder: 16388:16389 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.342791] binder: 16388:16389 BC_INCREFS_DONE u0000000000000003 no match [ 425.342797] binder: 16388:16389 ERROR: BC_REGISTER_LOOPER called without request [ 425.342805] binder: 16388:16389 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.342815] binder: 16388:16389 Release 1 refcount change on invalid ref 0 ret -22 [ 425.392855] binder: 16396:16404 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.392865] binder: 16396:16404 BC_INCREFS_DONE u0000000000000003 no match [ 425.392870] binder: 16396:16404 ERROR: BC_REGISTER_LOOPER called without request [ 425.392878] binder: 16396:16404 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.392889] binder: 16396:16404 Release 1 refcount change on invalid ref 0 ret -22 [ 425.395121] binder: BINDER_SET_CONTEXT_MGR already set [ 425.395129] binder: 16397:16405 ioctl 40046207 0 returned -16 [ 425.395238] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.395257] binder: 16397:16405 transaction failed 29189/-3, size 72-24 line 3136 [ 425.442561] binder: 16411:16416 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.442570] binder: 16411:16416 BC_INCREFS_DONE u0000000000000003 no match [ 425.442576] binder: 16411:16416 ERROR: BC_REGISTER_LOOPER called without request [ 425.442584] binder: 16411:16416 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.442593] binder: 16411:16416 Release 1 refcount change on invalid ref 0 ret -22 [ 425.586762] binder: BINDER_SET_CONTEXT_MGR already set [ 425.586771] binder: 16428:16432 ioctl 40046207 0 returned -16 [ 425.589979] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.589999] binder: 16428:16432 transaction failed 29189/-3, size 72-24 line 3136 [ 425.595450] binder: 16429:16434 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.595459] binder: 16429:16434 BC_INCREFS_DONE u0000000000000003 no match [ 425.595464] binder: 16429:16434 ERROR: BC_REGISTER_LOOPER called without request [ 425.595472] binder: 16429:16434 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.595480] binder: 16429:16434 Release 1 refcount change on invalid ref 0 ret -22 [ 425.645991] binder: 16444:16446 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.646001] binder: 16444:16446 BC_INCREFS_DONE u0000000000000003 no match [ 425.646006] binder: 16444:16446 ERROR: BC_REGISTER_LOOPER called without request [ 425.646015] binder: 16444:16446 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.646024] binder: 16444:16446 Release 1 refcount change on invalid ref 0 ret -22 [ 425.669883] binder: BINDER_SET_CONTEXT_MGR already set [ 425.669900] binder: 16443:16450 ioctl 40046207 0 returned -16 [ 425.671210] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.671232] binder: 16443:16450 transaction failed 29189/-3, size 72-24 line 3136 [ 425.835804] binder: BINDER_SET_CONTEXT_MGR already set [ 425.835813] binder: 16473:16475 ioctl 40046207 0 returned -16 [ 425.835903] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.835922] binder: 16473:16475 transaction failed 29189/-3, size 72-24 line 3136 [ 425.861299] binder: 16471:16478 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.861308] binder: 16471:16478 BC_INCREFS_DONE u0000000000000003 no match [ 425.861313] binder: 16471:16478 ERROR: BC_REGISTER_LOOPER called without request [ 425.861321] binder: 16471:16478 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.861348] binder: 16471:16478 Release 1 refcount change on invalid ref 0 ret -22 [ 425.871669] binder: BINDER_SET_CONTEXT_MGR already set [ 425.871677] binder: 16483:16485 ioctl 40046207 0 returned -16 [ 425.871786] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.871805] binder: 16483:16485 transaction failed 29189/-3, size 72-24 line 3136 [ 425.919153] binder: BINDER_SET_CONTEXT_MGR already set [ 425.919162] binder: 16494:16498 ioctl 40046207 0 returned -16 [ 425.919385] binder_alloc: 7943: binder_alloc_buf, no vma [ 425.919402] binder: 16494:16498 transaction failed 29189/-3, size 72-24 line 3136 [ 425.936284] binder: 16495:16499 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 425.936294] binder: 16495:16499 BC_INCREFS_DONE u0000000000000003 no match [ 425.936299] binder: 16495:16499 ERROR: BC_REGISTER_LOOPER called without request [ 425.936307] binder: 16495:16499 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 425.936316] binder: 16495:16499 Release 1 refcount change on invalid ref 0 ret -22 [ 426.082793] binder: BINDER_SET_CONTEXT_MGR already set [ 426.082802] binder: 16514:16516 ioctl 40046207 0 returned -16 [ 426.082897] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.082916] binder: 16514:16516 transaction failed 29189/-3, size 72-24 line 3136 [ 426.112446] binder: 16512:16518 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.112456] binder: 16512:16518 BC_INCREFS_DONE u0000000000000003 no match [ 426.112461] binder: 16512:16518 ERROR: BC_REGISTER_LOOPER called without request [ 426.112469] binder: 16512:16518 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.112479] binder: 16512:16518 Release 1 refcount change on invalid ref 0 ret -22 [ 426.137503] binder: BINDER_SET_CONTEXT_MGR already set [ 426.137511] binder: 16527:16533 ioctl 40046207 0 returned -16 [ 426.137617] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.137635] binder: 16527:16533 transaction failed 29189/-3, size 72-24 line 3136 [ 426.168011] binder: BINDER_SET_CONTEXT_MGR already set [ 426.168021] binder: 16537:16540 ioctl 40046207 0 returned -16 [ 426.168125] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.168143] binder: 16537:16540 transaction failed 29189/-3, size 72-24 line 3136 [ 426.172225] binder: 16539:16542 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.172234] binder: 16539:16542 BC_INCREFS_DONE u0000000000000003 no match [ 426.172239] binder: 16539:16542 ERROR: BC_REGISTER_LOOPER called without request [ 426.172247] binder: 16539:16542 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.172256] binder: 16539:16542 Release 1 refcount change on invalid ref 0 ret -22 [ 426.323530] binder: BINDER_SET_CONTEXT_MGR already set [ 426.323538] binder: 16554:16559 ioctl 40046207 0 returned -16 [ 426.324072] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.324093] binder: 16554:16559 transaction failed 29189/-3, size 72-24 line 3136 [ 426.344199] binder: 16555:16560 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.344213] binder: 16555:16560 BC_INCREFS_DONE u0000000000000003 no match [ 426.344219] binder: 16555:16560 ERROR: BC_REGISTER_LOOPER called without request [ 426.344228] binder: 16555:16560 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.344237] binder: 16555:16560 Release 1 refcount change on invalid ref 0 ret -22 [ 426.393568] binder: 16567:16576 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.393577] binder: 16567:16576 BC_INCREFS_DONE u0000000000000003 no match [ 426.393583] binder: 16567:16576 ERROR: BC_REGISTER_LOOPER called without request [ 426.393591] binder: 16567:16576 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.393600] binder: 16567:16576 Release 1 refcount change on invalid ref 0 ret -22 [ 426.410451] binder: BINDER_SET_CONTEXT_MGR already set [ 426.410460] binder: 16569:16571 ioctl 40046207 0 returned -16 [ 426.410557] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.410576] binder: 16569:16571 transaction failed 29189/-3, size 72-24 line 3136 [ 426.434073] binder: 16581:16584 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.434082] binder: 16581:16584 BC_INCREFS_DONE u0000000000000003 no match [ 426.434087] binder: 16581:16584 ERROR: BC_REGISTER_LOOPER called without request [ 426.434095] binder: 16581:16584 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.434107] binder: 16581:16584 Release 1 refcount change on invalid ref 0 ret -22 [ 426.548599] binder: 16595:16599 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.548609] binder: 16595:16599 BC_INCREFS_DONE u0000000000000003 no match [ 426.548614] binder: 16595:16599 ERROR: BC_REGISTER_LOOPER called without request [ 426.548622] binder: 16595:16599 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.548632] binder: 16595:16599 Release 1 refcount change on invalid ref 0 ret -22 [ 426.555812] binder: BINDER_SET_CONTEXT_MGR already set [ 426.555821] binder: 16592:16598 ioctl 40046207 0 returned -16 [ 426.555951] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.555970] binder: 16592:16598 transaction failed 29189/-3, size 72-24 line 3136 [ 426.630240] binder: BINDER_SET_CONTEXT_MGR already set [ 426.630250] binder: 16609:16616 ioctl 40046207 0 returned -16 [ 426.630358] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.630378] binder: 16609:16616 transaction failed 29189/-3, size 72-24 line 3136 [ 426.667250] binder: 16615:16618 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.667259] binder: 16615:16618 BC_INCREFS_DONE u0000000000000003 no match [ 426.667264] binder: 16615:16618 ERROR: BC_REGISTER_LOOPER called without request [ 426.667273] binder: 16615:16618 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.667284] binder: 16615:16618 Release 1 refcount change on invalid ref 0 ret -22 [ 426.697655] binder: BINDER_SET_CONTEXT_MGR already set [ 426.697870] binder: 16627:16633 ioctl 40046207 0 returned -16 [ 426.697973] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.697992] binder: 16627:16633 transaction failed 29189/-3, size 72-24 line 3136 [ 426.818378] binder: BINDER_SET_CONTEXT_MGR already set [ 426.818387] binder: 16644:16647 ioctl 40046207 0 returned -16 [ 426.818480] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.818498] binder: 16644:16647 transaction failed 29189/-3, size 72-24 line 3136 [ 426.823708] binder: 16639:16648 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.823717] binder: 16639:16648 BC_INCREFS_DONE u0000000000000003 no match [ 426.823723] binder: 16639:16648 ERROR: BC_REGISTER_LOOPER called without request [ 426.823731] binder: 16639:16648 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.823740] binder: 16639:16648 Release 1 refcount change on invalid ref 0 ret -22 [ 426.872560] binder: BINDER_SET_CONTEXT_MGR already set [ 426.872569] binder: 16651:16657 ioctl 40046207 0 returned -16 [ 426.872663] binder_alloc: 7943: binder_alloc_buf, no vma [ 426.872682] binder: 16651:16657 transaction failed 29189/-3, size 72-24 line 3136 [ 426.906011] binder: 16661:16665 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 426.906020] binder: 16661:16665 BC_INCREFS_DONE u0000000000000003 no match [ 426.906026] binder: 16661:16665 ERROR: BC_REGISTER_LOOPER called without request [ 426.906034] binder: 16661:16665 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 426.906044] binder: 16661:16665 Release 1 refcount change on invalid ref 0 ret -22 [ 427.066171] binder: BINDER_SET_CONTEXT_MGR already set [ 427.066179] binder: 16679:16682 ioctl 40046207 0 returned -16 [ 427.066269] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.066287] binder: 16679:16682 transaction failed 29189/-3, size 72-24 line 3136 [ 427.069443] binder: 16678:16686 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.069454] binder: 16678:16686 BC_INCREFS_DONE u0000000000000003 no match [ 427.069461] binder: 16678:16686 ERROR: BC_REGISTER_LOOPER called without request [ 427.069470] binder: 16678:16686 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.069480] binder: 16678:16686 Release 1 refcount change on invalid ref 0 ret -22 [ 427.134670] binder: 16696:16698 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.134680] binder: 16696:16698 BC_INCREFS_DONE u0000000000000003 no match [ 427.134685] binder: 16696:16698 ERROR: BC_REGISTER_LOOPER called without request [ 427.134693] binder: 16696:16698 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.134705] binder: 16696:16698 Release 1 refcount change on invalid ref 0 ret -22 [ 427.159489] binder: BINDER_SET_CONTEXT_MGR already set [ 427.159498] binder: 16699:16703 ioctl 40046207 0 returned -16 [ 427.159591] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.159610] binder: 16699:16703 transaction failed 29189/-3, size 72-24 line 3136 [ 427.178934] binder: 16709:16711 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.178944] binder: 16709:16711 BC_INCREFS_DONE u0000000000000003 no match [ 427.178950] binder: 16709:16711 ERROR: BC_REGISTER_LOOPER called without request [ 427.178958] binder: 16709:16711 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.178968] binder: 16709:16711 Release 1 refcount change on invalid ref 0 ret -22 [ 427.301972] binder: BINDER_SET_CONTEXT_MGR already set [ 427.301983] binder: 16720:16724 ioctl 40046207 0 returned -16 [ 427.302191] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.302212] binder: 16720:16724 transaction failed 29189/-3, size 72-24 line 3136 [ 427.304390] binder: 16721:16726 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.304399] binder: 16721:16726 BC_INCREFS_DONE u0000000000000003 no match [ 427.304405] binder: 16721:16726 ERROR: BC_REGISTER_LOOPER called without request [ 427.304413] binder: 16721:16726 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.304422] binder: 16721:16726 Release 1 refcount change on invalid ref 0 ret -22 [ 427.358013] binder: BINDER_SET_CONTEXT_MGR already set [ 427.358022] binder: 16736:16740 ioctl 40046207 0 returned -16 [ 427.361377] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.361398] binder: 16736:16740 transaction failed 29189/-3, size 72-24 line 3136 [ 427.375123] binder: 16739:16746 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.375133] binder: 16739:16746 BC_INCREFS_DONE u0000000000000003 no match [ 427.375139] binder: 16739:16746 ERROR: BC_REGISTER_LOOPER called without request [ 427.375147] binder: 16739:16746 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.375158] binder: 16739:16746 Release 1 refcount change on invalid ref 0 ret -22 [ 427.540474] binder: 16762:16771 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.540484] binder: 16762:16771 BC_INCREFS_DONE u0000000000000003 no match [ 427.540489] binder: 16762:16771 ERROR: BC_REGISTER_LOOPER called without request [ 427.540497] binder: 16762:16771 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.540508] binder: 16762:16771 Release 1 refcount change on invalid ref 0 ret -22 [ 427.576606] binder: BINDER_SET_CONTEXT_MGR already set [ 427.576614] binder: 16764:16774 ioctl 40046207 0 returned -16 [ 427.576770] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.576790] binder: 16764:16774 transaction failed 29189/-3, size 72-24 line 3136 [ 427.601063] binder: 16782:16787 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.601073] binder: 16782:16787 BC_INCREFS_DONE u0000000000000003 no match [ 427.601079] binder: 16782:16787 ERROR: BC_REGISTER_LOOPER called without request [ 427.601087] binder: 16782:16787 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.601098] binder: 16782:16787 Release 1 refcount change on invalid ref 0 ret -22 [ 427.641317] binder: BINDER_SET_CONTEXT_MGR already set [ 427.641326] binder: 16791:16792 ioctl 40046207 0 returned -16 [ 427.641416] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.641435] binder: 16791:16792 transaction failed 29189/-3, size 72-24 line 3136 [ 427.779462] binder: BINDER_SET_CONTEXT_MGR already set [ 427.779471] binder: 16809:16814 ioctl 40046207 0 returned -16 [ 427.779573] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.779592] binder: 16809:16814 transaction failed 29189/-3, size 72-24 line 3136 [ 427.806748] binder: 16806:16812 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.806758] binder: 16806:16812 BC_INCREFS_DONE u0000000000000003 no match [ 427.806764] binder: 16806:16812 ERROR: BC_REGISTER_LOOPER called without request [ 427.806772] binder: 16806:16812 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.806782] binder: 16806:16812 Release 1 refcount change on invalid ref 0 ret -22 [ 427.840934] binder: BINDER_SET_CONTEXT_MGR already set [ 427.840942] binder: 16828:16832 ioctl 40046207 0 returned -16 [ 427.845669] binder_alloc: 7943: binder_alloc_buf, no vma [ 427.845687] binder: 16828:16832 transaction failed 29189/-3, size 72-24 line 3136 [ 427.873501] binder: 16835:16841 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 427.873511] binder: 16835:16841 BC_INCREFS_DONE u0000000000000003 no match [ 427.873516] binder: 16835:16841 ERROR: BC_REGISTER_LOOPER called without request [ 427.873525] binder: 16835:16841 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 427.873536] binder: 16835:16841 Release 1 refcount change on invalid ref 0 ret -22 [ 428.025882] binder: BINDER_SET_CONTEXT_MGR already set [ 428.025891] binder: 16851:16857 ioctl 40046207 0 returned -16 [ 428.026018] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.026037] binder: 16851:16857 transaction failed 29189/-3, size 72-24 line 3136 [ 428.026201] binder: 16854:16861 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.026210] binder: 16854:16861 BC_INCREFS_DONE u0000000000000003 no match [ 428.026216] binder: 16854:16861 ERROR: BC_REGISTER_LOOPER called without request [ 428.026224] binder: 16854:16861 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.026235] binder: 16854:16861 Release 1 refcount change on invalid ref 0 ret -22 [ 428.063471] binder: 16868:16874 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.063481] binder: 16868:16874 BC_INCREFS_DONE u0000000000000003 no match [ 428.063487] binder: 16868:16874 ERROR: BC_REGISTER_LOOPER called without request [ 428.063496] binder: 16868:16874 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.063508] binder: 16868:16874 Release 1 refcount change on invalid ref 0 ret -22 [ 428.116141] binder: 16880:16885 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.116151] binder: 16880:16885 BC_INCREFS_DONE u0000000000000003 no match [ 428.116157] binder: 16880:16885 ERROR: BC_REGISTER_LOOPER called without request [ 428.116164] binder: 16880:16885 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.116173] binder: 16880:16885 Release 1 refcount change on invalid ref 0 ret -22 [ 428.223700] binder: BINDER_SET_CONTEXT_MGR already set [ 428.223709] binder: 16891:16896 ioctl 40046207 0 returned -16 [ 428.223801] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.223820] binder: 16891:16896 transaction failed 29189/-3, size 72-24 line 3136 [ 428.229638] binder: 16897:16899 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.229647] binder: 16897:16899 BC_INCREFS_DONE u0000000000000003 no match [ 428.229654] binder: 16897:16899 ERROR: BC_REGISTER_LOOPER called without request [ 428.229662] binder: 16897:16899 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.229673] binder: 16897:16899 Release 1 refcount change on invalid ref 0 ret -22 [ 428.252256] binder: BINDER_SET_CONTEXT_MGR already set [ 428.252265] binder: 16901:16905 ioctl 40046207 0 returned -16 [ 428.252358] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.252376] binder: 16901:16905 transaction failed 29189/-3, size 72-24 line 3136 [ 428.264990] binder: 16903:16906 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.265000] binder: 16903:16906 BC_INCREFS_DONE u0000000000000003 no match [ 428.265005] binder: 16903:16906 ERROR: BC_REGISTER_LOOPER called without request [ 428.265014] binder: 16903:16906 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.265024] binder: 16903:16906 Release 1 refcount change on invalid ref 0 ret -22 [ 428.301089] binder: 16909:16911 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.301098] binder: 16909:16911 BC_INCREFS_DONE u0000000000000003 no match [ 428.301104] binder: 16909:16911 ERROR: BC_REGISTER_LOOPER called without request [ 428.301112] binder: 16909:16911 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.301123] binder: 16909:16911 Release 1 refcount change on invalid ref 0 ret -22 [ 428.304614] binder: BINDER_SET_CONTEXT_MGR already set [ 428.304623] binder: 16910:16913 ioctl 40046207 0 returned -16 [ 428.304751] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.304768] binder: 16910:16913 transaction failed 29189/-3, size 72-24 line 3136 [ 428.484915] binder: BINDER_SET_CONTEXT_MGR already set [ 428.484931] binder: 16933:16939 ioctl 40046207 0 returned -16 [ 428.487828] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.487850] binder: 16933:16939 transaction failed 29189/-3, size 72-24 line 3136 [ 428.503818] binder: 16934:16941 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.503828] binder: 16934:16941 BC_INCREFS_DONE u0000000000000003 no match [ 428.503834] binder: 16934:16941 ERROR: BC_REGISTER_LOOPER called without request [ 428.503842] binder: 16934:16941 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.503852] binder: 16934:16941 Release 1 refcount change on invalid ref 0 ret -22 [ 428.550778] binder: 16946:16952 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.550788] binder: 16946:16952 BC_INCREFS_DONE u0000000000000003 no match [ 428.550794] binder: 16946:16952 ERROR: BC_REGISTER_LOOPER called without request [ 428.550802] binder: 16946:16952 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.550813] binder: 16946:16952 Release 1 refcount change on invalid ref 0 ret -22 [ 428.569030] binder: BINDER_SET_CONTEXT_MGR already set [ 428.569039] binder: 16948:16957 ioctl 40046207 0 returned -16 [ 428.569151] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.569168] binder: 16948:16957 transaction failed 29189/-3, size 72-24 line 3136 [ 428.756283] binder: BINDER_SET_CONTEXT_MGR already set [ 428.756293] binder: 16976:16981 ioctl 40046207 0 returned -16 [ 428.756390] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.756411] binder: 16976:16981 transaction failed 29189/-3, size 72-24 line 3136 [ 428.758134] binder: 16975:16979 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.758144] binder: 16975:16979 BC_INCREFS_DONE u0000000000000003 no match [ 428.758149] binder: 16975:16979 ERROR: BC_REGISTER_LOOPER called without request [ 428.758158] binder: 16975:16979 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.758167] binder: 16975:16979 Release 1 refcount change on invalid ref 0 ret -22 [ 428.811960] binder: BINDER_SET_CONTEXT_MGR already set [ 428.811969] binder: 16988:16993 ioctl 40046207 0 returned -16 [ 428.812073] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.812092] binder: 16988:16993 transaction failed 29189/-3, size 72-24 line 3136 [ 428.817075] binder: 16991:16996 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 428.817085] binder: 16991:16996 BC_INCREFS_DONE u0000000000000003 no match [ 428.817090] binder: 16991:16996 ERROR: BC_REGISTER_LOOPER called without request [ 428.817099] binder: 16991:16996 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 428.817108] binder: 16991:16996 Release 1 refcount change on invalid ref 0 ret -22 [ 428.896845] binder: BINDER_SET_CONTEXT_MGR already set [ 428.896854] binder: 17007:17011 ioctl 40046207 0 returned -16 [ 428.903044] binder_alloc: 7943: binder_alloc_buf, no vma [ 428.903062] binder: 17007:17011 transaction failed 29189/-3, size 72-24 line 3136 [ 429.010643] binder: 17018:17024 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 429.010652] binder: 17018:17024 BC_INCREFS_DONE u0000000000000003 no match [ 429.010658] binder: 17018:17024 ERROR: BC_REGISTER_LOOPER called without request [ 429.010666] binder: 17018:17024 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 429.010676] binder: 17018:17024 Release 1 refcount change on invalid ref 0 ret -22 [ 429.025903] binder: BINDER_SET_CONTEXT_MGR already set [ 429.025912] binder: 17021:17027 ioctl 40046207 0 returned -16 [ 429.026002] binder_alloc: 7943: binder_alloc_buf, no vma [ 429.026021] binder: 17021:17027 transaction failed 29189/-3, size 72-24 line 3136 [ 429.076703] binder: 17030:17040 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 429.076715] binder: 17030:17040 BC_INCREFS_DONE u0000000000000003 no match [ 429.076720] binder: 17030:17040 ERROR: BC_REGISTER_LOOPER called without request [ 429.076730] binder: 17030:17040 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 429.076740] binder: 17030:17040 Release 1 refcount change on invalid ref 0 ret -22 [ 429.096659] binder: BINDER_SET_CONTEXT_MGR already set [ 429.096668] binder: 17042:17044 ioctl 40046207 0 returned -16 [ 429.096760] binder_alloc: 7943: binder_alloc_buf, no vma [ 429.096778] binder: 17042:17044 transaction failed 29189/-3, size 72-24 line 3136 [ 429.198616] INFO: task kworker/u4:3:2102 blocked for more than 140 seconds. [ 429.198622] Not tainted 4.9.141+ #1 [ 429.198625] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 429.198644] kworker/u4:3 D25560 2102 2 0x80000000 [ 429.198664] Workqueue: events_unbound fsnotify_mark_destroy_workfn [ 429.198678] ffff8801cf0eaf80 0000000000000000 ffff8801abc94200 ffff8801da6f2f80 [ 429.198687] ffff8801db721018 ffff8801d9aff7c0 ffffffff828075c2 0000000000000096 [ 429.198697] ffffffff83ce0cb0 ffffffff830d2c20 0000000000007f61 ffff8801db7218f0 [ 429.198699] Call Trace: [ 429.198712] [] ? __schedule+0x662/0x1b10 [ 429.198721] [] schedule+0x7f/0x1b0 [ 429.198729] [] schedule_timeout+0x735/0xe20 [ 429.198737] [] ? mod_timer+0x5b2/0xf80 [ 429.198747] [] ? calc_wheel_index+0x33/0x1b0 [ 429.198755] [] ? usleep_range+0x140/0x140 [ 429.198762] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 429.198771] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 429.198779] [] ? mark_held_locks+0xc7/0x130 [ 429.198786] [] ? _raw_spin_unlock_irq+0x27/0x50 [ 429.198794] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 429.198802] [] wait_for_common+0x3ef/0x5d0 [ 429.198811] [] ? out_of_line_wait_on_atomic_t+0x1e0/0x1e0 [ 429.198819] [] ? wake_up_q+0xe0/0xe0 [ 429.198826] [] ? srcu_reschedule+0x85/0x310 [ 429.198833] [] ? srcu_advance_batches+0x1e4/0x430 [ 429.198842] [] wait_for_completion+0x18/0x20 [ 429.198849] [] __synchronize_srcu+0x254/0x3b0 [ 429.198856] [] ? srcu_advance_batches+0x430/0x430 [ 429.198865] [] ? trace_raw_output_rcu_utilization+0x150/0x150 [ 429.198873] [] ? fsnotify_mark_destroy_list+0x80/0x390 [ 429.198881] [] ? fsnotify_mark_destroy_list+0x103/0x390 [ 429.198888] [] synchronize_srcu+0x1e/0x40 [ 429.198897] [] fsnotify_mark_destroy_list+0x10f/0x390 [ 429.198905] [] ? debug_object_deactivate+0x214/0x340 [ 429.198913] [] ? fsnotify_init_mark+0xa0/0xa0 [ 429.198922] [] fsnotify_mark_destroy_workfn+0xe/0x10 [ 429.198929] [] process_one_work+0x831/0x15f0 [ 429.198936] [] ? process_one_work+0x774/0x15f0 [ 429.198943] [] ? cancel_delayed_work_sync+0x20/0x20 [ 429.198951] [] worker_thread+0xd6/0x1140 [ 429.198960] [] kthread+0x26d/0x300 [ 429.198967] [] ? process_one_work+0x15f0/0x15f0 [ 429.198974] [] ? kthread_park+0xa0/0xa0 [ 429.198983] [] ? __switch_to_asm+0x34/0x70 [ 429.198990] [] ? kthread_park+0xa0/0xa0 [ 429.198997] [] ? kthread_park+0xa0/0xa0 [ 429.199004] [] ret_from_fork+0x5c/0x70 [ 429.199008] [ 429.199008] Showing all locks held in the system: [ 429.199014] 2 locks held by khungtaskd/24: [ 429.199031] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 [ 429.199047] #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 [ 429.199054] 1 lock held by rsyslogd/1896: [ 429.199069] #0: (&f->f_pos_lock){+.+.+.}, at: [] __fdget_pos+0xac/0xd0 [ 429.199073] 2 locks held by getty/2024: [ 429.199088] #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 [ 429.199103] #1: (&ldata->atomic_read_lock){+.+...}, at: [] n_tty_read+0x202/0x16e0 [ 429.199109] 2 locks held by kworker/u4:3/2102: [ 429.199122] #0: ("events_unbound"){.+.+.+}, at: [] process_one_work+0x73c/0x15f0 [ 429.199136] #1: ((reaper_work).work){+.+...}, at: [] process_one_work+0x774/0x15f0 [ 429.199428] 1 lock held by init/14057: [ 429.199442] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 429.199446] 1 lock held by init/14059: [ 429.199458] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 429.199462] 1 lock held by init/14060: [ 429.199475] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 429.199479] 1 lock held by init/14063: [ 429.199492] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 429.199496] 1 lock held by init/14064: [ 429.199508] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 429.199512] 1 lock held by init/14066: [ 429.199525] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x476/0xdf0 [ 429.199541] [ 429.199543] ============================================= [ 429.199543] [ 429.199547] NMI backtrace for cpu 1 [ 429.199555] CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1 [ 429.199566] ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001 [ 429.199577] 0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40 [ 429.199586] ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000002 [ 429.199588] Call Trace: [ 429.199598] [] dump_stack+0xc1/0x128 [ 429.199608] [] ? irq_force_complete_move+0x330/0x330 [ 429.199616] [] nmi_cpu_backtrace.cold.0+0x48/0x87 [ 429.199625] [] ? irq_force_complete_move+0x330/0x330 [ 429.199632] [] nmi_trigger_cpumask_backtrace+0x12c/0x151 [ 429.199640] [] arch_trigger_cpumask_backtrace+0x14/0x20 [ 429.199647] [] watchdog+0x6ad/0xa20 [ 429.199653] [] ? watchdog+0x11c/0xa20 [ 429.199660] [] kthread+0x26d/0x300 [ 429.199667] [] ? reset_hung_task_detector+0x20/0x20 [ 429.199674] [] ? kthread_park+0xa0/0xa0 [ 429.199683] [] ? __switch_to_asm+0x34/0x70 [ 429.199689] [] ? kthread_park+0xa0/0xa0 [ 429.199696] [] ? kthread_park+0xa0/0xa0 [ 429.199703] [] ret_from_fork+0x5c/0x70 [ 429.199709] Sending NMI from CPU 1 to CPUs 0: [ 429.200120] NMI backtrace for cpu 0 [ 429.200124] CPU: 0 PID: 2089 Comm: syz-executor.4 Not tainted 4.9.141+ #1 [ 429.200127] task: ffff8801cfc297c0 task.stack: ffff8801ae710000 [ 429.200131] RIP: 0010:[] c [] __lock_acquire+0x44/0x4a10 [ 429.200133] RSP: 0018:ffff8801ae7179a0 EFLAGS: 00000086 [ 429.200137] RAX: 0000000000000000 RBX: 0000000000000046 RCX: 0000000000000000 [ 429.200140] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8801db621018 [ 429.200143] RBP: ffff8801ae717b48 R08: 0000000000000001 R09: 0000000000000001 [ 429.200147] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cfc297c0 [ 429.200150] R13: 0000000000000000 R14: ffff8801db621018 R15: 0000000000000000 [ 429.200154] FS: 000000000275e940(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 429.200156] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 429.200160] CR2: 0000000020b999bf CR3: 00000001ae541000 CR4: 00000000001606b0 [ 429.200163] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 429.200166] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 429.200168] Stack: [ 429.200172] ffffffff841eeb00c 00000063a0b7e2f0c dffffc0000000000c ffff8801ae7179c8c [ 429.200175] ffffffff810a6ab3c ffff8801ae7179d8c ffffffff810a6ad9c ffff8801ae717a28c [ 429.200179] ffffffff8127ca25c ffffffff8128eebcc 0002babcf4000000c 0080000000000017c [ 429.200181] Call Trace: [ 429.200183] [] ? kvm_clock_read+0x23/0x40 [ 429.200186] [] ? kvm_clock_get_cycles+0x9/0x10 [ 429.200188] [] ? ktime_get+0x185/0x1e0 [ 429.200191] [] ? clockevents_program_event+0x1bc/0x3e0 [ 429.200194] [] ? lapic_next_event+0x60/0x90 [ 429.200197] [] ? clockevents_program_event+0x17a/0x3e0 [ 429.200200] [] ? clockevents_tick_resume+0x60/0x60 [ 429.200204] [] ? debug_object_activate+0x32d/0x4e0 [ 429.200207] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 429.200210] [] ? check_preemption_disabled+0x3b/0x200 [ 429.200213] [] lock_acquire+0x130/0x3e0 [ 429.200215] [] ? __schedule+0x13c/0x1b10 [ 429.200218] [] _raw_spin_lock+0x36/0x50 [ 429.200221] [] ? __schedule+0x13c/0x1b10 [ 429.200224] [] __schedule+0x13c/0x1b10 [ 429.200227] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 429.200230] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 429.200232] [] schedule+0x7f/0x1b0 [ 429.200235] [] do_nanosleep+0x1f5/0x4d0 [ 429.200238] [] ? schedule_timeout_idle+0x90/0x90 [ 429.200241] [] ? memset+0x31/0x40 [ 429.200244] [] hrtimer_nanosleep+0x210/0x550 [ 429.200246] [] ? hrtimer_run_queues+0x1c0/0x1c0 [ 429.200249] [] ? enqueue_hrtimer+0x3a0/0x3a0 [ 429.200252] [] ? do_nanosleep+0x197/0x4d0 [ 429.200255] [] SyS_nanosleep+0xcc/0x120 [ 429.200258] [] ? hrtimer_nanosleep+0x550/0x550 [ 429.200261] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 429.200264] [] ? hrtimer_nanosleep+0x550/0x550 [ 429.200267] [] do_syscall_64+0x19f/0x550 [ 429.200270] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 429.200280] Code: c55 c41 c54 c53 c48 c83 ce4 cf0 c48 c81 cec c80 c01 c00 c00 c48 c8b c45 c10 c48 cc7 c84 c24 ca0 c00 c00 c00 cb3 c8a cb5 c41 c48 cc7 c84 c24 ca8 c00 c00 c00 c20 c39 ce3 c82 c<48> cc7 c84 c24 cb0 c00 c00 c00 cb0 c73 c20 c81 c48 c89 c84 c24 c98 c00 c00 c00 c48 c [ 429.200725] Kernel panic - not syncing: hung_task: blocked tasks [ 429.200732] CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #1 [ 429.200744] ffff8801d9907cc8 ffffffff81b42e79 ffffffff82a78560 00000000ffffffff [ 429.200754] 0000000000000000 0000000000000001 dffffc0000000000 ffff8801d9907d88 [ 429.200764] ffffffff813f7125 0000000041b58ab3 ffffffff82e2b62b ffffffff813f6f66 [ 429.200765] Call Trace: [ 429.200774] [] dump_stack+0xc1/0x128 [ 429.200781] [] panic+0x1bf/0x39f [ 429.200789] [] ? add_taint.cold.5+0x16/0x16 [ 429.200796] [] ? nmi_trigger_cpumask_backtrace+0x102/0x151 [ 429.200803] [] watchdog+0x6be/0xa20 [ 429.200810] [] ? watchdog+0x11c/0xa20 [ 429.200817] [] kthread+0x26d/0x300 [ 429.200825] [] ? reset_hung_task_detector+0x20/0x20 [ 429.200832] [] ? kthread_park+0xa0/0xa0 [ 429.200840] [] ? __switch_to_asm+0x34/0x70 [ 429.200847] [] ? kthread_park+0xa0/0xa0 [ 429.200854] [] ? kthread_park+0xa0/0xa0 [ 429.200860] [] ret_from_fork+0x5c/0x70 [ 429.201150] Kernel Offset: disabled