0461319ed29fbe0db6b5e08a904d07c757ee9c7165c9176cd642a6a3bdbd2b5926667e69d5d14c84abe0e4c9be0b1d88f1af415d5403f743196e550aedb3de5c0bb6bb087332607cd11d32f6e8deaca706fe3c18aea903d3e5dca4d7e342364bccec73b50b23b0991a7f39b4c2defbe183b8194721252b2e3a2ac21c6a923a2b7105e58f7a28c5261d4c904a33484d4b460e88689f3ac12b6fdfb49afb0f550bade86ffebd0d82b40a18398e48693f2eb63302d684e1cce6786b764dd20d4fd9b0aae686a8827b60e5f3519197c93f95b06d49d45", @generic="7d31f2dda870dee007d39b1c27b0de4fd4ffab9de6a432fa54dd00357fce56110f1222e111f6f722309f24d8f02a01c6e534a10a72d9a03d1391f222a1ac5b3c09fed176f2ecec8c974b3229882c1cbcc4d31cbcd375642846015bd342f36a9209c37fb101754325eb88aea93beaf54f30ea5be1196278378e4bd103a097895c866d95d7ffdeae55346a30", @generic="c8c6eedafd5d7314e64da1da6daa824429fc9442b17b43457ad1567d1ef9599df37e0ad842417406d669bdcfda09ec47395a3fa7d23d18d846e58113539678de526da24072fca5a54d023f71ccbd029148e909e03c455457eeb351a1e946584b22250e6fba7b5762a629aba1d5942b18a9d8f68c16b4c0a0087a3dccfa164045a097f91dbef2601c4fd079219a351621906beb1d900699648d7155cd0eef9228f4ea005c26b3bcb075c2cea692b30016542bad2fcbc74b36da53d22b102a3318c6d20d48328d81505e2295ef5ce0f87d57acce9928c8eccd56b216bd1e79d9112f352867aca390ee1157c83e5568e32346b229"]}, @typed={0x8, 0xa, @ipv4=@remote}, @nested={0x28, 0x8d, [@typed={0x8, 0x19, @str='\x00'}, @generic="44383946c978b308c10a08970c73bba28f4c5bf51e09eb4a93"]}, @generic="112415ef29f01db2eb9625287f623d134f066c13d640ca02a3b65464d4dd81081c91ca6c8df131c80a09d107ac1c6f3e9bda90fc7c8872431606efd2365b59abfd06c7bb9080257a055e390af9cc37b76a0bacc090bae84574bcdb25538409ec585695f5676ea2566c09ae00218606ee4dd00c6eb5748d2d5778d486fa763eaef75c71b7c103d391ae10cd7c0efd3b27cc638be349e544df", @typed={0x4, 0x70}, @nested={0xdc, 0x22, [@generic="cd2cac79370e6d1fc8aa9016f39e472f223f474b48bd9a871042f7ec174592e5e92be7cbda65c51704783a71c3056c87d88162995b692bc85bf26e0647ba73af972e6a47d617ae9d6e10790fdc03fe722a16363a5390c19f1a0a919af4cedd2fe7420f71d1425396ea7ae1f62b20f9c670d57402ead51e7958d821859a1ed149cf0a6bc8ca01051715ace43eb12f61993a2f1c4277bfceec156d840ecc8ff84c2a07de0afd0586fbe4c22d1413e6147012aab27ffea8922e2bf5d02ebccc625c5afa9607f20c14ef59ac7a7bbd23184ed756b148b309"]}, @nested={0x1f4, 0x12, [@generic="05cb2c3318657abb5ab2a2113915e500c3efa1970a854c5a6c0255bc099cef429d61c2f187f64d31aa88906622a62141b8493c80d172fa901d789e0685c63b1a239b6dff056e0f4adfe889a0185ce711975bb293269b9f6bd6a44b9bf61e325ae5c99427dcb98aebf0e1cbe63f38ca5c66c8920fc2e5045084cd9888b5152da7527ee3dee37ed3f7e348e602d8f224e11112015d4809b83e681b46b558bc712a38baea41c6a5799c2cf553cb2df93be0fa24b0000347cf8fc9b5a549b9c76e0cf5d2ab8fd3b4edf600b71701062809713ff708fb", @generic="920aebad7650f964777fbd89bfc9ab35e5805aa40c3dd47fee256724f923d51ff82ab427982d62b32968532dd1254de282d07b501926febf679bc05cac58936ad9f464ab6f49f17ff0ad84805c8050fa09359255dac6f6f446d893c83194dd6357dfaaa9176c10f3f24e26ffb10efec97365", @typed={0x14, 0xb, @ipv6=@local}, @typed={0x8, 0x58, @str='\x00'}, @generic="a597d705cbd5c67d6da1eaa2c2765de4f06e253de9f1e121ed4f771605f608e0ffa07ce2adafe09bc036d0e4386def9ec7a0786b8f15eecf602c95bddc4fc8ddec66235f0d3178d9de4c22df94f28cd115536c8e006b0b323d0e3edc91694a41fac7afa0b6df09d891a8482cf1844330263c5173cff8879aace6", @typed={0x14, 0x4e, @ipv6=@loopback}]}, @generic="6f176a3aeb81a85fde42030d0605f4c3dd87a48a59ed3125ff3aebcbdd696556f9c69ce345abcbeda012624f06de47e0117328c746a6bd623354772d0709789283ba0329a32c8229eeae7bf0d9634e213c2350efdddf86d546833710d15b67cd2fbbe84aa397d9097e89e0718d2370c6d8a508c363b80f75d64e5277d2b96d319cc140ec3a3e12b01d245f38d71b39773edae560d720d67765736e937972870ff59958bd404560d0127772ca277fa146fd0bfe5b095d9dcc0f88b56ffe786f78887cce73ab7b701202c3cbe4d5", @generic="6a54397abb21f9f20cf67af14dd6187d460938f732dc51bdacb3f03aaca16146bd76d44402260f09bb246ab2406e9d84d80317215e820e105307ef0b08bbb66f89e041a2f5d6c26e0457df2f035ad122bd18679eae0aed346dcecab48182b31f1e67d292b5f13a9ea28e0863071ee04e081be468bf4ea1d81aa6e78118b47fc98ce83182e72cec4bd42494fc4a7e6f8bf6bc11755702d9a9ab657c61c4f8f3952fe2e4519ed169ff56600cb1ecde3c96c4970ca483bf656808412747dc7e28b7221cb1ed70ba9a9200182d94ca2df5006d3321bdf4"]}, 0x858}, {&(0x7f0000000c80)={0xe0, 0x2f, 0x0, 0x70bd28, 0x25dfdbfe, "", [@generic, @generic="ce71642ca9cccbf5ff4cb8b1c76bee50134718ce989161436560772dcb975eab901f2ff6e85b123a2690934cff41d7317cce9f5a63d1d56dd7312bf6e3c3e3c9c788754b3a5882a09b3242b553e0fe4be93170613868e5e607d84f1ed3ce740a292ffd05c3eb", @generic="10fe4e82b1e0a8d19cd523add38d122bfb4b0fec16c3db2e8b1171868ffeb304c084186765198798f089bd935b823082efe0f6221d048f8cca8ed8329a013f414d139a466b628828d8e4963159cb294fed5bccc52afc69bf0a11b9b0139034bf4e09ed5f524a4122"]}, 0xe0}, {&(0x7f0000000d80)={0x1228, 0x2f, 0x100, 0x70bd25, 0x25dfdbfe, "", [@typed={0x8, 0x5, @u32=0x1}, @typed={0x8, 0x5c, @uid=r2}, @generic="a5bfb6a47c8639269b0df89d01aa0000306c77066fad9bbaa33a5c8ea3b83523f5929e8961ce994a1c2aec09408638028f4511248a5077b3d53d2a51ec208196d6102aba39d1f11924af1129fe5b6f5eebf43c460e2c5abc712d88988ef06dfd362677f610c17abeaf193746b48d32657e50c65e5a74ee59e9722054ee3dd2e5eab07c24c7fe9c38ddc49c3ac5e82898ecf779c89b16399f0cd0229918f4c6fd90216d0736f4d361ff667a39f47550bd95a6ae4bb2dc7e496d552e5f7b1c36086198191db8317083c86aee561ea0eb193c3fa40287e3cf1d9d95a3", @typed={0x8, 0x57, @u32=0x7f}, @typed={0x8, 0x89, @u32=0x101}, @typed={0x8, 0x22, @u32=0xfffffffffffffff7}, @typed={0x8, 0xf, @ipv4=@remote}, @generic="e6fe80fbaff049b8bfe50ebc45930149990cd09da39b27d75b1a83430aa078be5decc884578e6a06b593ed7f7da7d16b30e99226e65d2d8fe1b48952eef2fa03baf7852ed03dd1d5777c174f6eb776b98dcea75192ba349ff820f73a808c2d2c0ed3084be80b51fb19781de60a0005d8b39734c74c2084df55e337b8045a5a35ead5a66899cf7a93177c3911d159094e30e2ad821e11ef2aa3f00d231df5fb95e45869775de3604de82b199d47ed92b95482d9c5077a957d414422564ac219d31ea91c6c363107e1d1546fa639dba3f9d30084b865bffe94b8c0acbc0dd0cc90e1707a92c6b5", @typed={0x18, 0x75, @str='vmnet1eth0\\vmnet0+\x00'}, @nested={0x100c, 0x32, [@generic="4ed40c5b616ffd14ff019fced47d52a004e9ebd6bee5fa59b7fdbaa28e0597f9966e75103e733be5d1abc8f3a181b9a9e4708753e8b00de8f7cf2e93b1b1a7377dbe556c4bc973792718509f23edbffd7b430c36f5912e9bd82c5e761fcbb66fa1a29504353d0459ff56e89a4616fd3ee8ab7a215dae304203b84fdb6b85f024a69881bd7e8bbc16d8a86fbc4e46943e0e083e8f3f77c232e07b20541b728bf51ae3350cfc97939db94b03c53d5917aef7c71ef0edb5d13081f53c357295f7e5a8b8a414f5a31b973c973f26d31cc26e17be58718f202dd0b473b99ef23a9717654df4c51b32192914e5bfbef5b704e1a0381052e0c44bdcdb8c44214ae8773f4a62f3dff06d69838b5d5c26810f66ddf81ef2aaf104182a96063f577daaf6a5246c8e31c5f318735a2d21dc9ff9f3348e33a995abd3cd0ee6796868c9a6e3f4011be5ad5880d70eafa07e117a98af27322caf9f240aaf81356cab51e9bcfa909a1fde340d50abb1dfe2cdd7357cb77ff4f930000bebd0f2d97dfeba0577ff8f64ce08a8b13e63ba94f2aa4ade267c755277d65293f608d466465fe576db143c90a1c2732f3898ba6d61084d812946944003ef87071510b184c34c089ef1f14b7643e8a2cf429808e9864f966a5d6a9e4d42871fa70d2054a80df1497403fe70f135cf479c33103af3d269b533d792018ec2305413045d33c75cd252774a39dda7a7b3a5cf21096e32264f5ef5699194ab8193fbc1c1c2d929c539ff1f540feb955eddf03ea9c5c5e6a3d60be75e1a7038eb214611fa93ad76837c2994cebdadfb73be40820c92234aa62b37c250bfd46419a264c1bc6b485198e2ea75cfaefefc3f88100e221faf82d43b80cf3b5cfe7986f59d1907aa62ae99845bdccd764ded6a0a6f7446d1a29ea1709f3cbf20e400eb22f159bf265b8ac2865cfc865dfa34a8e4211b076f2fedb6e682d336d9907f9cd8b8045dd470e7cbd827193899e836d60724c50c6e10086d5d921e9b2fdaf7f065455100859cc13962bb1c5a811136cf0006ab6423f8fc17ca408f08420d7830c50fbf5e65f1b613278528bfccade4c4ce2ceca7a2177fca2110ac8ef830a5c598a05ba1528b636f5bc1f4ec4e394c5095889edc59ff7169eb0c1ce2c326a9edd06d106b797938a041c9467f757fbd2db13c782a24a893364172e199b05de50bc59e05cde86db08fc8761f3a8f0a3757f892d12b40f7a5adbe63f9dcada61deee97a15264db5b5c22bb82ac5e0816b07b7bb90327b0590d0752454cf01058197ffb5424254b71c070a39461fb42200e5997a7130ced6fb08d400f5acae8f27e448092cca88a49b9808cf3ecdc773af5dd1e508b00eb353b4a20da4d1b78ee267d7131096ff478d072763091e2b94a8ff991784b4ba1a8f6c8341e198d0d4880d2193fcb4388a3f5cfd411ca344d3af3ba3f4475719d253be61a8af6e530db0d44cd642fc5926dbcbd2c0019dda6e748d6868e3f3aa3b12b305c61f5f8b9c7bd4703d95bf31010c63b25f101b52b45b79346ca021a66c4ca25575a1d9800442ed81c440d65deb046688b9bc1a76580599b194c00f3c1b93ffedbddfb1ce3b8bca52b954940469bcdeacdeb809c74205fbdf2723daeb34588cce13164535196d8c4dc8b624e0f2880cfa0af3117cfd783fd881c2d4669f5e473ecc8a06f4193ba2495a37dd781f6fddf24ad0a3aaaaceb0f4562b4b7a0b78d719d70a9acc40f9a5fbebedb312bd4dd80f7eda1b1fa4f8ecd64b59e1389de9fea664232a022b80cbf0f2d7ab0f44dd15c87fc73e93057d6c2e3d9a6ce3254025ded078f534c47087f3a8511bc8009d2be67be049578ae3b8f911e2b00d6193395df15c3177d15fdad3b96868906b74746f2221a070c26b7bdb1ba1b9b72e19d7a341685329cae42088f3cb05135c8073277e356d8665c9111a6e6ce3eddcb626763547b54b1b1e9e3a0c35129aa08aefc1e2aa2eeb1b8b2153f196ad9376d2a8ebc9c17b2f7030d568ef939c5424d49a5614928cc4f2461ec9c6f3dacc7428ca7edba3a46f62083ddedd4faa42162e26bd5e0619112b7134351b8677d41ecd2d41ec267e4ac799b82a0a7d78002fcea48f449ceb1c3848b0618c1d69b8a28dc3fd634edc20a03cf7a2188eae9954a4f338ed83d84d03111a456222a5810b4db116bd2b76cebae9c5755b0823107fbe48f51c9e3f68e322416dfc5860cf1cb440388a4c97d739f1bacb09a7e1f89a68bb9c671087c520d1f9f2576e238220d7f8b550bbf275f9cf8d0fd8d0d943f68a1619bfe4ad26d8068715d04be4d8661be21cd6ed897b373915e75c6bc509c8a888e678d22223bfa986061e00df4ead5490b5e04135ca67effc5ee9b1c8afa0d98408fbe4132f8bea654109113a09a1c62a10f7ed129107e0c8e30a9c51c6d0dab1833bf51afc75fcbad29eec8bc6d5161ce49d0fd5549df6c4ee8aaf8ae191fd7a0cf9f5eec14fc278e04de569ac59bc9cb7a689d10589c4967917b0fe5b41af87cef175cad998e0147964edf44df79ce3c0c2f478f188a55a747c3f9bc5f0e840fce761d6209d6bde1ca1a6822f8956d71f00b76b8062891d2c5baf6b1d1df4c4be13a56b3ccf25c70625ebe07fe1990f1fc09113b346ebc2ebc9037d685f36a0787d8f4ef7f266fdcaaa44b3fe841c68e691b518719660f93067eb13e47691015efc1f44135ef03227c90d78279d02067a42a94af3839a7c406e86904bc321c3b2d681b2f836e3cb18ffa368f6c8787dc6704e0dde14ac72590c0e24978a14eda8466474775a18fb364fed8a2e7cf650e6caf041361a1336c607b1872c51c5d8fe8ecbfaf0e0be4ab585374301b339e843cd74255ff1242b6874ea398d81f412b04a334ec34ba78e5c6cf17d72830b2e627295e52de2d5bef2c80f2f0b7b1e5a41c7db05a462bdda76faf414ba921e2a2c2366ab9eba5595e9991aa7b1fd2de61bbbecd4a3c812eaa94ac4680daae0f2280cefc60c78c7c8e095d3843524d5d1fda398df16c56031240e6e8489b6114d5ea4f35d09e1b8db59d2cd5433bdcd128585d11dfc93d8cef688c7bb2f99b6ca8caa94f77d0419bc3ccfab061290589f6d8aca6f6ac57c8cd4af9209b023bcd7146dc8f7abc7c3f2a3e8d9e75f81de913daa1d75e6e49bc142a4f1e78ab26d31c496cfe0abb170ff57a114f753d605ddc8b8ed1400dfa11954c6e7003480e17ab93fc49561e0dc1d33664de7e3db3841e427e1a4b14957663479aef4da54ac05099e5dc455a4138a98f8bdb84e4c348e69588c915b299ca85ddf54d605229702f7509c30a29a26ab642685d5a5b70c2b23221127fa613235e3ce02c7006d9ae58ca58df15d685f8c025a481fa9bd32afe39ed7c95eec8c412ccd89207bd2079594f11b8a67bb1fd5ae64aa337571f60e34bf7a14fa74c0d47dff54fdde8995ed123df0527f86b00429a5f3e4d8245e75dd3216d0c7a3cc20e127af2be7aca0775fff9d7eb656876855d72cfa69e7c33455a3bcc0ea11c58e9ce89bd86b7ceac523f2c38e0b46decb282eb8d55d1bb3cb2de4dae23e9be397c965193b9455dc7f207202e0989b5be288db5733c4564394513bf1bccc44abf41dd7cf44b05b58feb23334bfb85ebcb073439d457fef42554b6e12d41f6d9f4ada8682ec35449d1b595a99c3ac6e6062b00e668027cafa9690c24a8c1060e5dc309c698789dea04ff8984871191f8c9aa9cd089048f57f4b30bff3513d05f6bbf9f4d7baa3b4ec9521788305ab34ab7f0a3cfd949c992c485d6ff6c0ed249696d0a27865c6949b23319b6a19ce5009a96d97a606fa0b6fb1a9ff12941a92715a4eed0e018fb9178682cdf822498f6cadb5b5abe54fbd7d9d1bf8deb3431687ac76c45cb6b17b3422d94901c5a1a2ed1e616a3ccf95398e6f4bf50fc021e314d554f0e9e86f14e54076c2dc58e758571f66746b2cccecf44a0aebe26da614272f911be50856802e57021a329d8490364fdcf6be2fc58fed95a9cfa81ba4541fff55642a28f7ec2006eb1a4ebe858f6cf7ecee7dd6c23a2265d3466f9aa24e88b529970f9b010845b4d55558ac6ded7d19437e844c62c2208477d93cfabb7086c11458c2e3e4f5fa88e98d8448f551908fb4b7ac2506d84255eeae0ade2f47dc085e5f1202b6349c2498f9a0995a14d0fbbc56771d1dd2bfbf4643c2657a0185ec77705ea77494f1fc5636f06ffc7a1f73b5970db7bfc268fa245a96570fd5d0997b3fd627b75653118f3783466f63eb351021f8d227a78969e1535efb3a61766a1eb5671a582a26a1ad3b478f47d2e83d7b47d5c20cce89c3728c92a3fcb478394615a053d96c645449a76998c42d7c7c07be154eef1ab583fbbeda1cae491ed33778cf2aabaf5410876d5eb4618320482d0d3a8844abb84eebc5fd8c5a6926355d062a112b9eba42d8d6270735fd30119180cbd4f2449c96efc71224f018e19bf013c234a8bac0d3b7ac99f5587721f904b19d41d2264a45f7fc61a4b5959b6a1637a3e16aa4f39cb08871b74d8fa98c17c5df39ccb1ca2de6e386b0fa3ff1019825dd01fcbd22b8578eb5dc84079b2fba7f00a79cf4df21bc49872d75f33518688d51b06cab578a73a85f418bba54dbd578d372c1e49eb08185f7706b05f9bcd88886be66c3cbbb044c6d2c4b430be402c4bc6226c8dbcfa0bfd06222b92d372b8949647b23540b906aafdb3268612eeef2fbef1156097f4c285badae4bd9f3416374c6ca233c8eccfc847cbf9b687f3e744765633a1f9f05972e80987658743817f5a99c2aeb2e10c71ee5e5b2898caac832f7fd20e8c42dba44cd1b5d2dc12c76892154209c9fb0226496b52767bd91ae4387c395506aa260c73e497776765d2fda952ef32d366045bbe733228c8759930d651c8d09c7e21f221405d645d2242660e1421165a0823e8ff49e7858357f1c723fc31d4299919488704c0ac8af877c62e49d967dc9af41927d7f0583e9cf14b35889af0145397d878e8868c2b33ae87a8aa65d0837aa221f52853b01b6124fa5a391258311ffc7b2e82ed1308254616c30f618c53205912fccdc412de2ce39410826e41e796527c2beb10301dc6dc419b245646898b6d06eca119a81e91539359c6e538c1ee22af8bede35068635a58fa09089dbccdb4c27755380b4d3bc0dd9027825ed5dbba36b1a9a5eebd0a24a1c0b636274326c975208fb98da347f42c5783b0aa3985e8b3f13dfd3fb9e3660d8ee3618a6d7d7011429c26ac0a48397b71e40e64219fb5ed115515a57e98d84a53804d6cfe29d0926581235e8d653f0fa5326dfa855679463800c7f13494841501afa83f0fa462b89e1e76d04cd6125be350be7db74c511e547121b70992072f61efc7c4bb1cdab35d51d32f5da781a21473c718aee1a31d31992763c99dbef51a261b4dddaa0b4a336efca01ea0254090825d63a817b8dbfa4c0115a95701feaadb37e6f9122c5684d7906ded7554137da97e315ea1eae41d9d00b5659729bf89b5f390f916a4f574302e919084af207b5686c587c8cacaf4a2e80b7df5d06725426cc317ec86a7f9e82fb8cdac29e392d626de1c15bc7450154d48c1b98f4098f9c77987094e207feaf485339137dc63b2956b8ac6f0681ac9f1adef9bb794153482c1553e01a43b7c8dae702b2c07ba358ed9bfd9ce2d742b53ff7144cdc114f73c37e5877cc2a18a7743da4f78bc914af4aee935a0d69d3595ee461fc3cbaec29391d3cb981f818699ea2c92d2ed813ab06432dd1f0bf3aac63", @typed={0x8, 0x3d, @u32=0x8000}]}]}, 0x1228}, {&(0x7f0000001fc0)={0x4ec, 0x1c, 0x310, 0x70bd25, 0x25dfdbfb, "", [@nested={0x140, 0x64, [@typed={0x8, 0x33, @str='\x00'}, @generic="9f1bbf0c3e00c615d1c169a9183f8ac1e34b0e581d378515336c6e69b723fece2d9e5e0dbb788b8b5b6386199e0e9939444697a58a2930a1", @generic="9fdc517f92cb069891c992569bd6bea155ce9077e328967b9b8da1e533b5ce89dea21d56c5052394f9967bd42d53ee9b07957bb979368ad0f74c34dd15b3aa894dceccdf05cd200795efead2da8f74775711554c5a175bdce3b6df0aeca2137305d07a002c5522c6946e362b3d190268f8b45afbd36c52199a8b964a73c188304ed366dcea7be8e137f848d1709439580afc2c214302f779a1912a32f0a434f4fd06682a98b09d949bf80a0b5d4585dbae259b458e7b1665faa8551c591add1c9ca04175efa8669154447f7123ac153132e117084fc28e36f1df57923c516b9d58fabaa03e9fbdecc2fb54274f161e6ec372bf48d408af1aebcc"]}, @generic="e6f1d3a6034bc217a8d5685c0dd8a2377f5b2d3bd6b7e863a7b62546d2a36362f230313c4d69f0b1f2b900cbf2d0a4cf4dbe197be65885c21e81af40a8e0aa55e5334ca17aeaa286aab4523b76eab7d9a18e6c2787fc2f4ce78e7bcedbf03fa667ab0d6b60a0f1c4f387f0bfebb48f5240db26f0cb0ca356e50191cc161bd6461c13bee13a07a327e8bf3333dd425e245ac43af1ca76bfca857985c30e", @typed={0x8, 0x91, @fd=r0}, @nested={0x260, 0x16, [@typed={0x8, 0x2f, @pid=r1}, @generic="12c47eacb7d0e6f3c0bfbafce40b4a74b4ec7b33d53781137f2bd428c7160b2d4571aa60cebce11750e87de80d20eb880f7a448c0e2c16e6ea95e0c99f85d3fd195fea74f27228f60a0a7c980f9bf61e76a876db51e512affe8fdef1981bfd07b4ef877e67c26346", @generic="235bda497cd72bd3fd01121e0378e6d73bbc28d09ee426b3607c8e6bb9336c06b86b4ceab01323e6cc425add64a78b3bb19c2d4978", @generic="527f1f4460328c15650800dbfbd7841a5a6e227d61d1e84421c9bac80e21d2a87979fb2848eb492935b71a535df381d9b1b9b67f68bb5712cee31109bea97b8cea8c0e75aee0158e86de00978a68a6b63f9f3e2525d79675baa14efcfac6476d974cd867d830097d6caaa0367363e530d0c5515b7d3d3380432d32deb1519e6864140d2fcae5efc00d81d112374f8973a1d9704d0b49418db1dc0a2753b2a72ae221a92421f248db65a54dab6f42a7da01daed1a7d1264255ab5ac3b38936650dd6ca5299121223bf423cafc151003b116b558a2bad9d509a0c0b4d4031d16ca90e9c40d722ac8fcf5a97f9b90e6b92f627a685accf2d052f78c11", @typed={0x4, 0x92}, @generic="dfd70300616935b177c6f2e8c4947f4596454d45eb8976d45b39154e05a036033a44a02094e3f02a28b9a308f2412e5d8159943dff7a2c8e04f42d691f94f9a03b0b9805eef5621b655be965ed877c39934960387b2d993e305e2adab429d650e0921a099d1c2d6f2819ef82ae7725902b8cda3e168bcdf004f92f9ddc628d447d1efc54711b23e1ead81c6ac9f6576993b6ed5ed6334b", @generic="3cf8def06fd6dd5cd0426a272e6ddac3aef0855c8a83e8beb6bd33c15391d1"]}, @typed={0x8, 0x39, @uid=r2}, @generic="eeb9a9bdf54a030b2ef84286ba6480d29670f3a3", @typed={0x8, 0x53, @u32=0x1ff}, @generic="929c7a7d7cb4efd12e22d5", @generic="d66f6962928230c6dee9061ca1474e6745e5d0a4b2dcdfb8f0e9e79d73da0d8ba0f9b7da20dfc12570be8678e6793d8e34dcdbf22b0ae2854747446db89472d675f9f99aaa6b0aa861e6466ee8e159d4f55b4695ce84849e94e948e23ba9bc1bf203ed8439"]}, 0x4ec}, {&(0x7f00000024c0)={0x10, 0x35, 0x202, 0x70bd29, 0x25dfdbff}, 0x10}], 0x6, &(0x7f0000002580)=[@rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}, @rights={0x18, 0x1, 0x1, [r0]}], 0x48}, 0x4000000)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)

03:35:06 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x100000]}, 0x10)

[  370.666774] binder: 20535:20537 Acquire 1 refcount change on invalid ref 67108864 ret -22
[  370.726102] binder: 20521:20522 BC_FREE_BUFFER u0000000000000000 no match
03:35:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x7ff)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:06 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:06 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x3e00000000000000]}, 0x10)

03:35:07 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xa000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:07 executing program 6:
r0 = socket(0x9, 0x4000000002, 0x800000000000)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000000240)=0xc)
setresuid(0x0, r1, 0x0)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00')
sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="9400f1e6960000", @ANYRES16=r2, @ANYBLOB="010026bd7000fbdbdf25020000002c000100080004004e210000080006006e710000080004004e22000008000b007369700008000b0073697000080004000000000014000100080008000400000008000b00736970003800030008000100000000000800050000000003080003000300000014000600fe8000000000000000000000000000150800040005000000"], 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x0)
ioctl$int_out(r0, 0x2, &(0x7f0000000000))
shmget$private(0x0, 0x1000, 0x1000000180b, &(0x7f0000ffb000/0x1000)=nil)

03:35:07 executing program 2:
epoll_create1(0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
r1 = request_key(&(0x7f0000000340)='rxrpc\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000080)='lo\x00', 0xfffffffffffffffe)
r2 = creat(&(0x7f0000000000)='./file0\x00', 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
getpeername$netlink(r2, &(0x7f0000000240), &(0x7f0000000280)=0xc)
keyctl$get_security(0x11, r1, &(0x7f00000000c0), 0x0)
r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000000c0)='id_legacy\x00', 0xffffffffffffff9c}, 0x10)
ioctl$TIOCMBIS(r3, 0x5416, &(0x7f00000001c0))
write$P9_RLCREATE(r3, &(0x7f0000000600)={0x18, 0xf, 0x2, {{0x2, 0x1, 0x4}, 0x1f}}, 0x18)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f00000002c0)=0x13, 0x4)
pwritev(r0, &(0x7f0000000540)=[{&(0x7f0000000200)="135421e5c41bc182", 0x8}, {&(0x7f0000000300)="a0a44f91a0b239d5f1e6988e1612e81a5a99fa98240da0ae", 0x18}, {&(0x7f0000000380)="6bbc230b33899e0b8d46fcd6d31f20dbc37a1b3ca53cbf0d464b37d634eeae3e33df9fd5ed65d20b103983a4cc23deaf9b7200b62e19cc1d10d908643bc6a6a56ca95438d97c5ab41b2d14de5a220baf1d7c1e8b328a4a0d31fc9e80e45b8a61c7168d71a919f9bac8e25879aba316447557cf6790f5f456ec3787077c72905337609e12ce845184acf0700a0bcfa48b4cee79ede1b6abfebfffe6e6", 0x9c}, {&(0x7f0000000440)="2fed0ed00334d182b5280dfda42232df5fd4aa7ff8776e1c847803964df4bdafc188a413f3e48f4496ef2f0b89b767f6a140a6506f33f4b2db05be7bdd51e6f842053b65a78504c4", 0x48}, {&(0x7f00000004c0)="f097397615773d41c9fe12c6d4b488cb499386aa8f8fb4d28e7f7ac7e2f0220c51da3ba386ddba8b3a2329fec75715330a2b5b7d119c47a46a01eaaf5b69fc086bea008a77958885da0e3863605b004491e13330dcac398b02738e6b1ddfcb33006a47c3c299fd2197532a8282950932044b62e5e8bde99bf9f8a5cb", 0x7c}], 0x5, 0x0)

03:35:07 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x402800, 0x0)
ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0)
close(r0)
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
ioctl$KVM_SET_XSAVE(r1, 0x5000aea5, &(0x7f0000000680)={"7feac67b0686af6143fb64f6a36369aee0d588dbca006c62861a9ecae225cd41164315f02b26b238af6b67c5753c4e4d0363145ed1deb3faf9579b74fbe6ad76a7c4939749fd0904f5a4e4efe280c2821eaee3f0a356d17093e669fdad47518632446d2d2bdf891438d515d154fc9214a424cb374826233747de5d8fdf805530c27dc9d126bb8c97230e0d26fbaed0c7adc5ab614733ca6c6c7ec11cad990ed1ad6c2eee27f1d22823485026a93c87244fc45e03cf1435325bc786eae5634e75fdfc210c2b9dff1681d5f03bd774ed10605c2ea4177021786a744eac8d1b7a64baf1e3e617ae110ffb4438ca0b6fc62ac01a3a936f67b47e03360f1c47560433bba371f63ab1b3b03b1e1a66fc4b8c50b3cd2ded3fa854cfbca1a1bfafa1dda6ac4228acbc47992144087788998ab09bfb30ab706b4206f88887d91a9d11c77e917c6e6caa77d8725226f9f57b5fc7f9914e5ba465c748a9934a687469f88b81bfc9d31c2508e94f32e9760f8dd6a61a9c45fff37a7013bae4f6316a9f6158b5d1114377c7489852c6d5d74f60e0f546147e8263b384a0a7ca8666e41e677b9a0bc603c21eb6cf31f200441b724dfe73a702fa3757cbf8349bdaa4c77af2db3bbe134501458050230addc508e0347577faf5ca8d68ddcd531ac5eca61312674554a3c9c987097d7fbacdf857473bda6d23522c80fbc70d6c9678c83d03c9c9020426e0a4b62c7b6d1a62bff9de292412a919356a689d8d45dc8462e053102ebdb6a422edf36cb8b8e08721d4dc5e0a3adb3e898f5e4e54519b2f7baa17675e709817949c0cc1c387fd7cc1e3f053f394bbb6f77ba2bf4f36a6bd11869c7c4f46e457c9612a15288ca4f7410bd7d2a66b5747a49e1c926a6f69d1b358355b17bd5eb1352b1a2da9c3264cbca7a7eeaf5c18e67014557a4392aa6149d2360d569c0aa815cb61bc89954baf754964e1ea9a48eeb7a718ef2762185bfdf262c4d330b8142f2617e0e0300ab1acf9c40d068060894b8d2769b79702686da488356438f5c3c7f148f474f16228ebe755e3da140a000410fc5176e9fe7ceaa5f0560d87d951405372cef031b4e79f71798bed18c66229b0b9eb5fd734a14ca55c2c9f210fca25600867b40e1acdbf395441218e1ae449395d15e5222d2f33aeef56c3c42cbe24a03d6f5e4f96d4f98719de921e8ad2aa0404c140c6be0d990839f486af372dad312d566f8a55c1240ed229cc03141145090a7fe4e52e46b7f0acb57953ad7ff461e6b6b4ae78e1594de3e6f713ee0921a16e2125314aff665ab86e6c40d987531b8c2eec96b8a357c532fd07e8eb664c7b93aa661ce0b323de41ef62a9631b0bddaf013f5a4b8e6b8bc909de6f75b708aa972a9bc5273c1c4c5a1dc2d891a30112d5c0bc7d6cd9b7cd857d7c79b777277a76e89c3e78c80c0a4ed17de5"})
readv(r1, &(0x7f0000000300)=[{&(0x7f00000001c0)=""/213, 0xd5}, {&(0x7f0000000480)=""/226, 0xe2}, {&(0x7f00000002c0)=""/61, 0x3d}], 0x3)

03:35:07 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:07 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x1000000000000000]}, 0x10)

03:35:07 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x33, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:07 executing program 5:
syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f0000000080)='./file0\x00', 0x1ff, 0x9, &(0x7f00000015c0)=[{&(0x7f00000000c0)="fd9d855e9e89c12849de19b6c43905e59e01804ce73136fd05c5ab9968e7d102a6dde728382fe5f160f7c8a71ae5ea2501e55b81ccda65c5ac1b1e6f8850ac1f0a307475cc1aa60b188aa2f6592aabd27466360d9d96332380bf9661151be3d52cbe7435f7d8543ceb67ef82dc66ce7b412ce2f21b62a5b9b910acaf92c70bde21de45ddddcb288288fb9949e3fc2b04ee816fbb209278b69930c3fb1df69899b183631ac464cef27a906e7121692ea9de65b4bf2761ed53b0b4d0220e723f", 0xbf}, {&(0x7f0000000200)="74538bb374b9a07721789e7ba676214163ca26473769188c392a3639fe2a1e6a252da610cefddad32c43ab1f1a6c032cc92fbebec9", 0x35, 0x80000000}, {&(0x7f0000000240)="0a45ea86ddfca671edec14058db7271d0ccfbf3757550f8fa2e6161b0fc05ec9e9bdd2376442c6e32544ceec2a415fce62b9ad49392be5d4682fb0aa9b86c9e3bf5877283d4803992a354a7d7c766c3ad8c7446aa75655180100477e90636bb526f2bfbbde2f422a8e4cda418cbc7ef1ebb7d54526fd9d645bcd9aed35b9f33ee643d91c237c2d2a9c4797ab6e03c5f8f28c2255a049a320a219345d1e6741edeb16752458ec7b0153ce409ffc60eabcdbff2377305a10931d496030522020407b", 0xc1, 0x6}, {&(0x7f0000000340)="93879986566cebeb32ea364645aec2bd142d6c873374be37973e3b65f46a2fd4c855f55eb266ef3abd6faced28eaac34f32fe5e190f879f7dbb204b75350907b1d3d8dd794b56c9eb1f3f88cec007e3a3c6801b1677305aa11a792aa7726ba72dc996f0aa94e05ab7f4a5c440c9a524f68663fc03a9fb3dea840b7d2d7e62186ae4fa160f9d591f1c56f3a2e9efcaea23a7c4df5481b02d40ac49aef8d48c00c195107e6e57f10b053e65defc48189c9aa115f4e811e74e5b720d0a9363ceea4b74945f29bd3903ac0194c09853741ecb67b4967a1dbe378911399983ae04240fd4a4eeca8c35474df831e3af6e4ee4d901d37a36d5d7195e194303b0ede20dcecf9ecc5a15d34123ba22101c077b6b46f5b9278a735b2c8c9fe12b8cf40480ca011587176b4e37a572ab7f2fe252e2af2beed8f0f35ca0afe223d9e67b8581e555d5d8fbff6ad391e3da058670821b2898f7c51315127d64735286ddf77b3f2f3dde0232905eeab2033e9f5759e6ef1dbf425a934e08804d59db48171b2ab214d42396b04e5bfce4aab6c810196a4eb182faca324856852fc0b59c10c9ba2208f27915282ff4320e1da84d147e25850afff6822f5a6ded99910b9945307476deeefdf4b78c27d434871ce19e36121c20de7faf08e229d74fa18917447cd3bdb16ebc5c7e318481d505957034090355b42fd92cc7c0b2f0a9bd143da19262619dcdcf7793029db6281996a75610c7c8537b993dafb5a5073f97f7b3e243da5e151b7f23de6abfaaabb5620685918e468afb945b690ddf6d1656ea0db4aeba02f7ec1ff8c8c702086e6fe45b5cfc1c8eb3b9fbe8ee2e016edb5664407616ce5b43a2315d3be1c3d5ac07d7c6e1ba235c81f60641398e83c86ea5c98dd5fa4723647d153d70f241a4673818add6b1ee69e503323ca647edd9b814f63c0d19111c229a607415990231945f49746c18ad5df8891d8f8c688aa54c87484fbf8015534e91f091170fa515d24f555c52fa656b0d32eb01aeb2ca02684ff43a50004e8d012ae47f3c51f1363e335473071f670765764e00de2e6ed53e2eb49e54c009d4ead49e3774c8cbc83f1f9c1075ba3f0d12b3b2a7898a50f93825142a1b250b033ce7dac2fad8c95118d4588017565295b5c9b1e9419c9238bbe54ee5a499c59e1b3fda6ed7ae552d55584a896c03939314cb5646ceafd06011b16395494ef9eb5e528655feb16f35190d767057f1721550fcd9bbd0870e40658d2364baf64aed5d978d1dac87b6393b1a14f97038ece64f53560630dd92f1968b11ff295c43c3cfcaec2e3c011b7fcd822a7cbc8f2449a51a5f8389280666a4e6e6177bd757cc9bc68b402fdb434cb88b169fa9a66f331290ec83ef1f8ff26fbd977c777dac8a4f20d99b400abfbead2f181453ba4f001ffbf516c782d71106e3df753cb1416ff9de8b7620d2506ce2d66bc90c8a4504c4e156bd81e2b665594aa8e150ea310dfc10a87a33a16e85704516a2502d413be1bc86d3a514a00902a1ebacfcfb1404047216201ad62e774e515572feb7ff79bde45c922f9a9efeea7985ec2bde752150d432f9596c55f879b868c9b601074d56f790260ba3c8aecd00b158b4224f8720c020a8268021b9f5d783b8f6494cc5d8f1e2e62b8be4dc801517d9a82a3bd4d25f4c2ecd32d601517ae67eeb45eb078dcba3da5c4d6fe6c621d290937aea77fbe6778b654cfda27e8cadd7d19f23d9c29217c4ceb393b1e28218fc99e0c9d3a037ce6d8620c3f73a886b6e2e55e7919d816d7fd32dd467d3a35b152d64c6719a70700aafc9b47b7040683b8dea0f39e9076e07deab77ace42b262b4911dd83a6b5726dcd36f898b4be970bdbc6553e40d712573d0db3c6c5747f66b2aeba4256c62bc325a65ade4c5714e2bc53f2798a5272e44e79ab5ca5f2efaa33088cda5e5c2bd16afb62ce0e768a0ba65adb87d5138bcc73ba558e2d8dd273eeb114443531ba8afec4f4d1731580d8bf16c80550d2a97244c8c8ed9f34cd3852cbe75805b350ca9470b94a24daae83dd3bbd50a038a60ace9d92f7b2c5102fbde521395a0411a29bbb7278e44ca23a9205903b74c5a25812739d632f91e168ce1c8c81614fbfc44c84ecdecc077b892576d71927063dff3b19126a725c8784ba7229b75c89bfa970eeada1f9fe1007a451be7b9bfa03f922a63069625667d412e5a69af074478de321e82027facacfc1a854f0148339518d5d2968464c2b1e797840a46f1a626251eccc50e5dd88d320f1beca4e4bece3460cb751c22bcc51a3fdb3fc4815c8a3b69ee69e2311cbfc24780d51bba509bdb41160bc08b757dae5d768c7a88d9dbf7dd23fd5d3343032a12fecf5f0cc056f9faecdf7836ec28dd3c32adc7766f2c4486340173ef4b7bbe04245954c62458065237f93c3aab6ca52426d1e24d3220f6724961ca01b8ed630b5328830fa3a1d46646a3f89a595565cd19cb10b957dc8d8343d833ab35ae7a20ae265835435db4031517ce3e3d113a3615ba9786324fb32011a63e558cb72daa579a77300540be6d0d573c3dc9ea3828ec9aa62038579462058aee6003e397346bf693d0839164186e3daa230f764b09b8bf527d2e0bf72514453f0b1aa59746109de25cc8a45903654900440f2b637e773594abe468cbd0a7837a22a575a3ba327acf3a62d975f3e4bcab9593d051e020bb4073e12d6e4bcba157aafb323a14b15a99ecad4cabd21a9055a52aae2e15b7243cc1c8f2b05fa7d1a5e98517ed1d63ca52efa5b414df3bfe60a2eaefab47d2c93f17833b07bc7f18e0a4da65d253dda3221a0af95b9ccb2b3aa828f7d8744f977b9eb7538e23b45dd551a8e546d24e6ed93b517b291a121dcc807ebada38962e818e42eca5bf98b76479267be5f60b1fbe22e7de398d4f8dd28f5887957fbeed3bb94a2ffb75959b9b0660720b912ca3e70045b97fcd3938840d768fc460fc820b8eccc859b3e65bfd22dba1cdb97a4a30b65d22bd894bbb6a0784664cb9e186657d5660b243dd85e9e14589707f6630f434eb77932fd63da8e0a0e7a3fe24e28214b3400c9476e63c58428febd63021037408fa0241e24f05195ce3cabe1ff74c4012d36b779828ee2e325cbe49025b08fa90fc527cd5c4f361af9f57c95c284bae7ae11e03481e2f7c61ac362c1ced838fb25e7d1ec840a3562289c349df572cfcf601d77f99285f7dab520ad744afa33bf5b14d7a032c94c1798522787f16e5496796025d1b850c17fb3dbefe92ebf4a6e6483fdcb9d4f210e6cc9f0cc7ee6df042de5182ee1a8e8b7cbb93e9a841fcde5a1e9642198e35f55cc640255d3c5d3edcd33dc2a66ce3babbf1b0738655b74fec81cb6fcab4993b3416d8e37412d162061042cf308911f7beb111a45359b66bbd14cebf9a19c2b2cc7db25c1a0c502d8b7fd999bac59eabc3371b0ff4b8b305a618597ad1200a4bce8e98a396839f3280001f1687215b20bff329db5c015314e46cd6d1c1986dfe5996db367e9606ed635ccdfaff4fe699d7525a89442c62ae88efd402bff4b4c34db28d56e75d6165bc20aa48bf1feb9f895c9e74a47943da48a2d4f110efcd892cd968c1fc80716b2ea511f54ca91519d967a28643d2058afd7c753e5c7c28f606a68490c8d10278e2ee04bff59a79cc75b91f7db0ea0877e99e7a1cae28c2b782552fe38123e0b431e8424aa0eedfdddaa3988f933777afba05ed4fe072ed6275962947a108e3f93b914164272f2ec0b61a0de3023234b8413f9e925c0318697e5430cf928f12019bb989645b35202325d80fde00010c96e70a4d12d13fd2153b8898189100467fce00cb3fd5cf43e6ed9c4713eec639fc543d8a6ad2f128df870cac0b61c27faa7597afb357aa7ab288ca15416673cbf264f78ba437a82f86807b507f6cc64016ef95844ae8fc4cf6523989bd78ebd1695fbf618c98c5394782531bbd6cf0ba56adb41a6c1aff1dffe5eb236a1c057b01688121e6b93f0bc5b93031ffae8f817f6b1c7fbe5d8bf989a33dd3a17e4c60b4d75f0ccdff99f09b563902ffd5dce6ff79c11d14440da66e0a8d2d7492245fd5667e63467634b05963fd1b18a57981df45bc6309d5ed89e89f3495bb3296aeca427b6efb381940148d5626d4d16f22769692c28cacea8f9525113dd9108f6d6d1f31fba3f2912b7ce966fd6c1a5d40e96924cdf37fb5f98e06ecfb1f6d484f3301996f96f46f0a77fcc57fbb25bf283f0d970dbaf3e4e8e69098b00064182e3dbf43564acd1a5d462f3a26304eb6a056723e904569d554f2be9c8a45371fcce62e480f566bf3481b84ebdc1f40171d526a7ed5e8adf3e5f83aac2e77bfbf059ec28386dc0587fd7695c121a10123f2df5e357b21359fd9e21714ba762b113d0a6f401e3fb2114f473c3094bafee0b11dd481a8cceceb387af8f4ada67919b62fa24db22e031196d248724e2af503908e7a7774b0ef8c4e8ac105835feaab037f5cbbfabf85fde4908f24c55d8c340f91b9473a6395b1e6b6cdadd3d6bfdae70c1411ae70b46fa211eb55f5bffcf0449f56627b9b92d26e061f82f691a4920cfaef5774ad666c176f242f339d2751428bc543fe96c6222fc09109a982ee5a776a7fab2969be0c4e673ac167438f7619c9f649a7b280ed3d831e3f1826325b4d8761bf5062853beb907b56b41b467e9f9ae6fa87e525afd936b8ccffcbe67a137290f4e9a8dad6d36d04e7b790393f6a7a367237dd867f398540ab028715cc1657d6e9d9b2c964265a5d6893273d6b282c9ff38a073cff07a180c6ee0ca5d04911dc360e40912532bbcd13b21997346f64e4bcb9cd2d20117cbe6bdd6b2f7105f80f9c5d2df0fa5108bbf30431ee6b2a6f9bdc79574b7f8787cd62c543a9ede8e6f0c6143afc864d3cefd0aca8b3a5da60cd3225f27d5addac9f19c987e35cc5aa1eb9a8f2d0422cd2033b9a9b0a257252b652614a9af055b7a3baeb6534d61b8506333e37b00637bd17b7de7bf111d00efc4138d6544da27379789a78d2fde338fbf2ec9a43ab6a26e91cab33847244b7ac2eb3cf177ec9f17c7675226495b1a03456907c542f26d6fb3888258a0fb921099dafdd8dc3bc6406b5e81ba8687c29be8cbc04f7e3c669c067dc513eb5228895672f43881e57e4f6e7aeca4609525675af49f6fa841a8c8d5de62e23c322b48fb21fbb34761d6d67fc8b71d99cd232e86a98be542b97a73de00dde8f2250632e8abe92cdc9dd691c756930432c759aafb91b2b699ac6c4b8621cc4235b0bbd6798920025350046319d7626c16ad57cad80602804142d251fee43be8b74ea4021926a977f1fcdeed7869b85460da4ce0db112e6487e80e4dc681877994367d5cc4197d4e996bc046aea8e9d55d91de51faab2ec45f65f8ec96e379768179c399b778e7e6cb2b18aa9dfad50c6916c340f20dc193c2feeee20af139d73a62076e432ed569f84f0b8dfa5ba767f027939cd33066de9db2bf7266ef87792c2317372653f3cf23566e5a8d98e0eac8c3c8448e6cab47e74aed23baa03f448e5a43950fd946ea5d3bad2598d28cca93735b2a8795bfa9108e422541f8cc5b1441708a51f481f3e8eb0d753406822aaa579274d083d88f6f3233ad1af9ca69b6b59158d3ac0582a703c468aa76ec2946d6ce7f476d9232658f0ce59e3b70e5a31ceb939674d8d491591ec91fd59722f906cfadd7ec05a92d12788e1dcb789f1717c3faa86085d65cf064e46a2acc1658229589be07b945a36d2acd5179341433039", 0x1000, 0x2}, {&(0x7f0000001340)="23a3fea792f61bf42ec1baf343695fc19884b4c6437bb77538e32287706a770a91e791a80b1448748f2b27aa226a9d5dd6420770be20ac875010757b05095aba8c4fa56fc0e6cb", 0x47, 0x1}, {&(0x7f00000013c0)="e85d5c5001540c1380f143e8b3fbb6e23348652a48b1cc6789fa86d88fe179e99ecca9b60ae1b2b2db63593f4f5856e8be4e6cead73c3a352d2d6dd5956124400304f8713f2f91a6d7cd2e0f8e7c4bc6a64ed81922807ae3b0eec1cec4d730badd45fdcaa370d69285b722fc9a14310e9a43c558cae55590aa2d64b624d225a2b8e0", 0x82, 0x100000000}, {&(0x7f0000001480)="f39b859b108d236f3b43fe4b0cfab6660b2cf8c6b271f82b94bfb06366d01d704091f12de0a1c95b7c04494b3d54ab19ace76c786ea1447549c3ecea51818fde6ee24d5ddbe97e8e865c3a61c8c2c51906f0d39956b2f68a75c3f9c083ae8bdb64f86841f653331adbacf2fe5c7585a53530202df24f51191a1813a7584fe212", 0x80, 0x6}, {&(0x7f0000001500)="3499e80530aea5d2a4ed2652098f15f211213686da5c4e400eaa716a0b7c38186e8f84895bc55831b4549c267256c540c4e9459258cfb4cdf75fa1e03bd49e17756ae9a14acd3e3e33145176f55831c93a542014c42574c2c8542712cb5945d68e97185657cb3d7fc9bb69cb", 0x6c, 0xffff}, {&(0x7f0000001580)="7757aa06d4c23609d66cf1643169b8100f34c1868f0ea741a3", 0x19, 0x89}], 0x20, &(0x7f00000016c0)=ANY=[@ANYBLOB='dots,check=\x00'])
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffffff, 0x3ff}}, 0x0, 0x0, 0xffffffffffffffff, 0x8)
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
recvmmsg(r0, &(0x7f0000001980)=[{{&(0x7f00000017c0)=@hci, 0x80, &(0x7f0000001900)=[{&(0x7f0000001840)=""/176, 0xb0}], 0x1, &(0x7f0000001940)=""/63, 0x3f, 0xfffffffffffffffc}, 0xff}], 0x1, 0x1, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001740)='/dev/dsp\x00', 0x2000, 0x0)
setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000001780)=0x5, 0x2)
r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f00000019c0)={0x7ff, 0x1a8, 0x3, 0x7, 0x40, 0x7, 0xf5a}, 0xc)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="0363084000000000f9b912b6e7005a988679d2e64eb906b7b7d5"], 0xfc7c, 0x0, &(0x7f0000002000)})

[  371.461339] binder: 20535:20576 Acquire 1 refcount change on invalid ref 67108864 ret -22
[  371.536975] binder: 20582:20589 BC_FREE_BUFFER ub612b9f900000000 no match
[  371.569441] binder: 20598:20600 Acquire 1 refcount change on invalid ref 167772160 ret -22
03:35:07 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:07 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000040)={0x2, {{0x2, 0x4e23, @local}}}, 0x88)
ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000000)=@get={0x1, &(0x7f0000000180)=""/4096, 0x2})
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:07 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
r1 = syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x9, 0x20100)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000280)={0x6, 0x4, 0x1, 0x9, <r2=>0x0}, &(0x7f00000002c0)=0x10)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000300)={r2, 0xe76e, 0x31, "e3aed043da94a0f025867aeac9c3e616593e20684bdcf4c75f11fd50e3e096446b766030802e5b287d0677325e072fc86c"}, 0x39)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

[  371.593170] binder: 20582:20604 BC_FREE_BUFFER ub612b9f900000000 no match
03:35:07 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x10000000]}, 0x10)

03:35:07 executing program 6:
r0 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, <r1=>0x0}, &(0x7f0000000040)=0xffffffffffffff6f)
setresuid(0x0, r1, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)

03:35:07 executing program 5:
mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)

03:35:07 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:07 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070")
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r2, &(0x7f0000000000)={&(0x7f0000000040), 0xc, &(0x7f0000013ff1)={&(0x7f0000000180)={0x14, 0x25, 0x7, 0x0, 0x0, {0x4}}, 0x14}}, 0x0)
rmdir(&(0x7f0000000000)='./file0\x00')
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x4e21, @loopback}, 'lo\x00'})

03:35:08 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x74fc020000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:08 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
r1 = accept4$inet(r0, &(0x7f0000000200)={0x2, 0x0, @multicast2}, &(0x7f0000000240)=0x10, 0x80800)
getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000031000000a922ae0be356adac0228f6d003f5dadb649353ca2af3418244eb40b5c87790bb360a1421bffab1e85ab9f108ba27701971e1c63d21abe322d740edc111e4e3c43a0979dabe02b8568c195366df"], &(0x7f0000000300)=0x55)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
r2 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0xfffffffffffffffd, 0x2)
ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f00000001c0))
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

03:35:08 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x800)
r2 = dup2(r1, r0)
setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000040)={0x6, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x17}}}, 0x0, 0x144, [{{0x2, 0x4e22}}]}, 0x3a9)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000002c0)={<r3=>0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000300)=[@acquire_done={0x40106309, r3, 0x1}], 0x59, 0x0, &(0x7f0000000200)="849fac060a10fc01d9ebb952a5fcc6e45fa2afbcb804acfc8b522bec861a01b5f7d22d8b148910116e2b341277e3471926fdaaf9bcac9f159e309e3432395d83c84db0ca5c88f3a4f1f684b7f6ea451dcc029ae72ca25cab8e"})

03:35:08 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x300]}, 0x10)

03:35:08 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:08 executing program 6:
r0 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
r2 = dup2(r0, r0)
ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000000))
setresuid(0x0, r1, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)

03:35:08 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x4000)
setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x4, 0x458, 0x0, 0x140, 0x0, 0x370, 0x370, 0x370, 0x4, &(0x7f0000000080), {[{{@arp={@broadcast, @multicast1, 0xff000000, 0xffffff00, @empty, {[0x0, 0xff, 0xff, 0x0, 0xff, 0xff]}, @empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0xff]}, 0x3f, 0x80, 0x6, 0x1, 0x80000001, 0x67, 'eql\x00', 'bridge0\x00', {}, {0xff}, 0x0, 0x21}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={[], 0x11}, @empty, @broadcast, @broadcast, 0x3, 0xffffffff}}}, {{@uncond, 0xf0, 0x118}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x9a}}}, {{@uncond, 0xf0, 0x118}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x2, 0x4, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4a8)
ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000040))

03:35:08 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x1b, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

[  372.364092] binder: 20598:20643 Acquire 1 refcount change on invalid ref 167772160 ret -22
03:35:08 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  372.437506] binder: 20656:20657 BC_ACQUIRE_DONE u0000000000000000 no match
[  372.473852] binder: 20656:20657 ioctl c0306201 20000280 returned -11
03:35:08 executing program 6:
r0 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0)
setresuid(0x0, r1, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)

03:35:08 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xf]}, 0x10)

03:35:08 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
fcntl$getownex(r0, 0x10, &(0x7f0000000180))
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

[  372.485047] binder: 20663:20664 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:08 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='auxv\x00')
setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000080), 0x4)
pipe(&(0x7f0000000000))
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
socket$inet_udplite(0x2, 0x2, 0x88)

[  372.553905] binder: 20663:20678 Acquire 1 refcount change on invalid ref 0 ret -22
[  372.562004] binder: 20656:20657 BC_ACQUIRE_DONE u0000000000000000 no match
03:35:08 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:08 executing program 6:
r0 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0xf758cc89e25a9e5e, 0x0)
ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0xffffffffffffffff, 0x83, 0x8001, @scatter={0x1, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)=""/220, 0xdc}]}, &(0x7f0000000180)="a5a6024c8a75ceef670e9ab5b93279674c69638bad24ef48ab505d7f0430a177ed2890c731117c63392953d3e4cf4e1594e09a41e81ed08f5a6721d4a8e3ddc6835df1028d21b4e4165414c7f5b8777180cb7ec5021e520ca62c500932d4f18805af35437bbd3b495db237f610902304fc3f74abcc1d38e1f8fc1975febf09b20e5815", &(0x7f0000000240)=""/222, 0xcc3, 0x2, 0x0, &(0x7f0000000340)})
setresuid(0x0, r1, 0x0)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400)='/dev/rfkill\x00', 0x100, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)

03:35:08 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x3ffdb0]}, 0x10)

03:35:08 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x6000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:08 executing program 5:
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0)
fstat(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
r2 = gettid()
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)={0x0, <r3=>0x0})
socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
r5 = geteuid()
r6 = fcntl$getown(0xffffffffffffffff, 0x9)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000d00)={0x0, <r7=>0x0}, &(0x7f0000000d40)=0xc)
r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000e40)='/dev/hwrng\x00', 0x400080, 0x0)
lstat(&(0x7f0000001280)='./file0\x00', &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, <r9=>0x0})
r10 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe2$9p(&(0x7f0000003a40)={0xffffffffffffffff, <r11=>0xffffffffffffffff}, 0x800)
r12 = syz_open_dev$sndpcmc(&(0x7f0000003a80)='/dev/snd/pcmC#D#c\x00', 0xffffffff80000000, 0x2)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000003ac0)={<r13=>0x0}, &(0x7f0000003b00)=0xc)
r14 = getuid()
fstat(0xffffffffffffff9c, &(0x7f0000003b40)={0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0})
r16 = syz_open_dev$binder(&(0x7f0000003bc0)='/dev/binder#\x00', 0x0, 0x2)
r17 = syz_open_dev$adsp(&(0x7f0000003c00)='/dev/adsp#\x00', 0x101, 0x10200)
r18 = bpf$MAP_CREATE(0x0, &(0x7f0000003c40)={0x4, 0x0, 0x101, 0x0, 0x0, 0xffffffffffffff9c, 0x1}, 0x2c)
r19 = syz_open_dev$sndmidi(&(0x7f0000003c80)='/dev/snd/midiC#D#\x00', 0x6, 0x100)
r20 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000003cc0)='/dev/qat_adf_ctl\x00', 0x440, 0x0)
r21 = openat$urandom(0xffffffffffffff9c, &(0x7f0000003d00)='/dev/urandom\x00', 0x8a01, 0x0)
r22 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r23 = eventfd2(0x7, 0x800)
r24 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000003d80)={&(0x7f0000003d40)='/dev/binder#\x00'}, 0x10)
r25 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000003dc0)='/dev/loop-control\x00', 0x501001, 0x0)
r26 = socket$xdp(0x2c, 0x3, 0x0)
r27 = socket$vsock_stream(0x28, 0x1, 0x0)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000003e00)={<r28=>0xffffffffffffffff})
r29 = syz_open_dev$sndpcmp(&(0x7f0000003e40)='/dev/snd/pcmC#D#p\x00', 0xfffffffffffffffb, 0x2400)
r30 = socket$inet_sctp(0x2, 0x1, 0x84)
r31 = accept$alg(0xffffffffffffffff, 0x0, 0x0)
r32 = openat$zero(0xffffffffffffff9c, &(0x7f0000003e80)='/dev/zero\x00', 0x80, 0x0)
socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000003ec0)={0xffffffffffffffff, <r33=>0xffffffffffffffff})
r34 = openat$zero(0xffffffffffffff9c, &(0x7f0000003f00)='/dev/zero\x00', 0x8001, 0x0)
r35 = socket$kcm(0x29, 0x2, 0x0)
r36 = openat$uhid(0xffffffffffffff9c, &(0x7f0000003f40)='/dev/uhid\x00', 0x0, 0x0)
r37 = syz_open_dev$adsp(&(0x7f0000003f80)='/dev/adsp#\x00', 0x2, 0x20000)
r38 = socket$bt_rfcomm(0x1f, 0x1, 0x3)
r39 = signalfd(0xffffffffffffffff, &(0x7f0000003fc0)={0x20}, 0x8)
r40 = accept$inet6(0xffffffffffffff9c, &(0x7f0000004000), &(0x7f0000004040)=0x1c)
socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000004080)={0xffffffffffffffff, <r41=>0xffffffffffffffff})
socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f00000040c0)={0xffffffffffffffff, <r42=>0xffffffffffffffff})
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000004100)={<r43=>0xffffffffffffffff})
r44 = socket$unix(0x1, 0x1, 0x0)
r45 = openat$userio(0xffffffffffffff9c, &(0x7f0000004140)='/dev/userio\x00', 0x200102, 0x0)
r46 = syz_open_dev$sg(&(0x7f0000004180)='/dev/sg#\x00', 0x0, 0x40000)
r47 = getpgid(0xffffffffffffffff)
stat(&(0x7f00000041c0)='./file0\x00', &(0x7f0000004200)={0x0, 0x0, 0x0, 0x0, <r48=>0x0})
lstat(&(0x7f0000004280)='./file0\x00', &(0x7f00000042c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r49=>0x0})
sendmsg$netlink(r0, &(0x7f00000044c0)={0x0, 0x0, &(0x7f0000003980)=[{&(0x7f0000000200)={0x280, 0x38, 0x1, 0x70bd2b, 0x25dfdbfc, "", [@nested={0x270, 0xa, [@generic="69b0d8894b664466c7fcf30763aad88d295085b4623a22bf01a9463b220a791d228703ddb0a5ee53b19dd8d40b960731245a3623a846c7b328b1a64fef7ec07e59d5dcf21156995f648c38f4b6cc9b17781097784b0a7e9c4f0438e728b923b27844f34d7cfbcba26d8ec3eec03ed6a9fa83b6225221fecfe6d2340a1c33d45254777a200d334397b515056ca8a3573ff7b2a9d8ac1ff80c220997633d50baac446f0b2097ffb6350cbc038b7b9ca721463926b8486bd7a0d6784a47ae4dc14c620a1c09255a6fbdf9379675e9c069d9b6460c6a00a834c277c3dd610ef89086f31a3cc27ca63d0f85abaaa6beca53ca", @typed={0x8, 0x5a, @uid=r1}, @generic="e25f6f605fe59d9d61d64ec7c6250f74d2ed2e3bd73e78a95fc85e0210a040b80448c5553ed3767d1edf042aacd4cf778355904a2e47857b8fde49", @typed={0x8, 0xb, @ipv4=@remote}, @typed={0x40, 0xe, @binary="6bc99830a35b5f499583f168138c338c1d3f10147bfc7fa2e7632059c39500a86259a7936a9dece2dbe03b180f2ebec0b70dd6eec8c158412ef861c4"}, @typed={0x8, 0x8d, @ipv4}, @generic="5b12cb50084606fcafb756d4387223f9a82499183423e83758f81b32062aea47839f4aa5a199521b02e5c6cee79c76d508b2a8ca779b7116bf9210ad1750f475ef21dc93b6c203c0e3e968168f2670b601f2d97db583b1e3ca06d65da62be9644eb23f2e5c16da138bf7a648871ca71c505ca95a4c900d37fd8c47009c93531ce7cfe636d369dc668b94fa39bb5c764ecb3269671532ff9283290d43344d811cb2326ef3e271f345e6a848917a753d43b63979ffd8832665497a52931bd459983ea98c4786b9d3bb14f414ff7409225c3c9de79b40a1b58412d1a24a373bfd28e922852ad2e1b788ab"]}]}, 0x280}, {&(0x7f0000000480)={0x704, 0x15, 0x0, 0x70bd25, 0x25dfdbfc, "", [@nested={0x58, 0x88, [@typed={0x8, 0x2a, @pid=r2}, @generic="533ce79c2c2ba67516fea898790a7260897b4b94d5d12438e7cdb683490913cedb9fc9efe891e0a043f1ae060a7a5cca80eaf5b9b56abb96880e9b487a4e6430293861c820eeeb9ed514db37"]}, @generic="2ddbd67e5c13394440111f28f21f66980af71c98f3175407b2a1705a8c8ab35cb9a6a0ac202372f594a36d7ed4392b2d4061f89c261acf45a6b48043d22cc658f13847add691251a5ec890680b61b9e4275799e8be08c4b9dbb279b972bb6e8c71536d952ea5a94330ec3eedb381249ba0f73b8159baccd726e01eadb81c07ed4c31ffa2593add3c8a38930739dd68041b6c644953778abd3a100e318f98aed707b14a8f5c971fce813c281b91190c13b7dc241facdb56a33c7d5dd277a98b52e810e83d90ff86d23adfb3ea8b7459468b6fb83a0b4be3a71300", @generic="b1416bd770af20224e7009028862ee98621c45acd2c6f1f1686cc090cefb3195f19ee77d654c20992019091da500ff22bb45b280cf7528995ff9001327ae95fdfad20e6381938dafb3aa64b5caf264cf7bac90ef6f68a36d040cdb0b23cade34d52b05aaf5e5a97ff121a5a34ce06aa821df06874d4f21c06288cc62e6e437845cbd633e73e8a720bc950cba7745cdd5598a54c344bd4afbb93aa47ceb49b43c7eb38e02b52a3b14dde3da1b5a2d9fc96a4f76e12fa3f2e83fe225cd05add14bef16e203f4f08aaf9df2dd5155e568c9ce423b1f8d6b1d4b718c34cef5464b77ceb6f3aff87ddaa3beacf9ee74b85afa61cb107dbbf1a0c5", @nested={0x4c8, 0x71, [@generic="17aab00b5402269ac4c97c9230e02e294b5c90db7658a00ad6bdcfe578bbb1e6de99f1850984906e20e3a3bd59c780eb3aba4ce84cc4c78f201b4e98782d2ea53cfb1a09fe6a", @generic="e1de31df070ea0ea024b837641934ba8a678f96f4ad87610da652258d7c0a2641abf1359823a5c2ee356adca6ddcc07bb728180f10fb0ce25dcbac34faa7c9dd820ed657eaf4c85a5b0cdbbf75c347ae2ad2d15789b644fb63f1de6d6eaece47e9691ded68acf4f0fb525056e3228a8e9c9e00cc90c340af28dc7a830e5a41ee5e6db93205d43e3a9dddaf927457cd8fcb0e5723385ab38f8c2399c3f4b4bc210ce3facd9c6957ebeb79d7947096d3da0c227177024f17427c5d4adaa378c9c7b2c4d7e0dd4a40b27cf40383dfc060aad3fb0b2bdeb735da96ebec7296262147ffd960ff84cf69", @generic="9d606028cdec7eb51a67e51a69fb23f7dce7d297016ed405d90cd173b914f4362655e11297319007d6e22072e61199226ed1e74a95d40a95115b8c908449d6cc578bc5985070604b5404f769b8c17b03efcee477f9657bb64ad454c37bdb5785640c2dfabbf18c180cd129f9584aede8bc8e6ada7811a18fa24d0319a5b364065fe27949baf212c89ef3196d57ead6a4d1417889c6d66f064621ab964a8dfe499ddd0cdabd27d296f116f06812b22245fd6b27801145d498", @generic="8c1ef84cd61e52fd9930a86ac11f78812b6c0d15278eb4784ab12d08acebdcc6793047e66e468abdc946cf75840fc6f7bf4e34a306a3a175bc11b58f3bc4d96d1ad7c345b3365dfecbf4178d4b512fb5787f6240dc5c5c0d591641a5d8b07c32f69724edc3bc182662b6bd0cd67a1f31178b64c5ff8b297b7bd661ad2337b61149be42a17599c671f12153a3f00dcc0d726e1d3a5bd5dc1c33b834131da51b85e3a4720d6350b495739714b3132f", @generic="ff77f66184cf905ee29cd0bdf713dfcae45a95705ffd22b6821f8a9afeec257a298018865f36a21caed4b12521202e759b3a41846f3f1d38047efe8715571db878a859ab7e9884d5b83f35a9eedc0bb8c36dbffe04722e6f2f3b17a6ef6d67f28882e92a448d00cce01a1187ae8725751b675f657e71d702d84dcc08797ca00628592360f154e4feb7a43c2eb6159a36f9eb11529918f8424bdcc4e75ffc3421a963e6de772b11bbec01fb8818ed980d636bdb1770ccf2e13322631750b3cb4a381382389e6091f02a6981e3b7586971ca0758c9836ae9db26a95cb94e166e4724542e8ee72fed9338202c04ef929b763470d6d8bc3504e91f", @generic="858a35eedec76aea4b234c97e26b1a8c2000ecbc0ef3ae1cb666e1289072a3a69f1886c6dc7e7d04424748b78a8d", @generic="8a7daac3004c701124cef38d0e20052a198ae736173d315253b6169d7f35495b6a1b9994d02ebeb8ab9240c74457427a18d56302b1567b8d6f4ca781d0cabaf4f3860da5ec89480dbed6bbbef3e2af7bc7f57c5ff10c30a7f6fb9dd84754132a2513eb9427a2c13efe2fa1268a3b2e44a77dade81c300fbdc19909872075a8980d895219f53a053174c4426356c21a019919041a789269cbe816a30f3bcf4ff4172dfb911f82c9c25b2ad7bfa0ed91aaae18b7a56d0efc6af826fa91b5e52192bc30450a690865ebe6fbe2abc66b7d33a50a1ad8744d3335ca8e1a2bc50f9baab880cd13cb8b270372860255ee4295ab51187820d3", @typed={0x14, 0x0, @ipv6=@mcast1}]}]}, 0x704}, {&(0x7f0000000bc0)={0x130, 0x5, 0x6, 0x70bd25, 0x25dfdbfc, "", [@typed={0x8, 0x6f, @pid=r3}, @nested={0x9c, 0x2f, [@generic='O', @typed={0x8, 0x4f, @ipv4=@loopback}, @typed={0x8, 0x38, @fd=r4}, @typed={0x4, 0x8e}, @generic="7b70c42eff1cd7cf6a6b47dd8c93edd32059c3d3e7e15b332a0a4f5f401ba81a3582ec30c8459fc76516ffff11d403207e923141a55c75de71a2260e346b79de11dba3eaeff1db4348cc941e5554b580741da75ae17cfccea4a645e412a3b7c0a714623a72d7559c441ec7dddaa9f1487f90fda1e7", @typed={0xc, 0x6c, @u64=0x8001}]}, @generic="8fdc604e7602b9e1960429879463b16cd7d2f9ed15c3e380799c76a32f0e0861e7f7e4f1ccf88699360cdb46b748718937326d550479305c9fd7185650", @typed={0x8, 0x22, @uid=r5}, @nested={0xc, 0x3c, [@typed={0x8, 0x40, @pid=r6}]}, @generic="bf383b9c64fdc167af5c7ba7615224c332b0da2e840d4ea36893af75431d5a90", @typed={0x8, 0x86, @u32=0x5}]}, 0x130}, {&(0x7f0000000e80)={0x3cc, 0x2a, 0x700, 0x70bd2c, 0x25dfdbfd, "", [@nested={0xb0, 0x35, [@typed={0xc, 0x82, @u64=0x77}, @typed={0x8, 0x15, @str='\x00'}, @generic="49816bb72a134b24f2cd2ed4c67d69ad6cc2934cfe3551a71af7d0e4f679f4553f053ea6c14f1d84d0cde7181e58a617cbbbfd0dded0777b7194d9635fc685b16b225159687ca706cd69518e", @typed={0x8, 0x2b, @binary="f0a19c"}, @generic="99f338f5b56613601f52a5aad20ce3e56b433dcead7b69d124b2a782eb32383734d598fcdb88067d263b4603f9ee1afa26fcd97e5a9b52c921283e2b516719362a"]}, @generic="3e10644f108c300cfc7bb265d5cb09bf7596f31a8aeab82381b7b19675061d13b5e28839a1f2fc8e7338d4d761df322d88f407269a70fb14299c56c99e5abe04d800d4c74d9b647046cbdd17ee7c6fb143f5027628580f9cf31a4a36d65d9a06b059b54b6c139f5018d08146332adc9fe23563ab640e754909486a9a76b1625ab2143551b9effaf06388ab35fa9c7a1c1763752bb93c47c529fafb9107bc964155aa6595d1c64a59d77d6de093e71f20fe0fc18c18702011368a69aa3d02f55b8b26517ffbbcf438212cf563297c9986792132c6cea5073268d233", @typed={0x8, 0x4b, @uid=r7}, @generic="e8a0ac6bf5c89dc961a6b4e37a9d1d280288e4d0634b684b4fba5f4a06981e61a7b4a90f499314dd806d2b082553ccc9dd94ded971c5ee91f581aee7e932e931402e4cfac71a90a2abb1b1a4768ca746724a5e70cef0d028e6d3ab9879265dbd78fbd665652b2598fafd7593f45319817f812be4f4615093e9d04ce064c341260256aeba3185e096bdc9d54bdbe5bd84e15f647b4c2515160d5680", @nested={0x90, 0xf, [@typed={0x8, 0x7c, @fd=r8}, @generic="afc28ae5484ebec1174ac9b761ff9f4a334933b4594645e68f9f38d56cd04ff490ddce6b76cba0ebb21682356867235ad696a60394b5be268a0eeafe4aa5b6b0eaa67863016469a871312432be39fa14e79dce6b32b2352aeae96748c8c0ceec5a046d7a4e3f5cfc42c8dab754dfa95f755cf334302617fe140938370c1b628b54da9712"]}, @generic="991922", @generic="d92b2782cd98", @generic="b4ab929086cd424bc9b90c21b9f15124fffdff925d883055d61476c97a35242a0a710ea6b9ef4d8941a17be87cda7da1f4ce98155ab62d1f69649db9be8288b9574884afbc1e63148ced6f544bb087096ba9354777b6590a1398bcead2fedd5b269311fbb7e015a4451f9478c62371a97ca80c9667a799ee45b3de640df6f8e89fd6929890fde13e9e817f97f598c3cf904f2ffa39ae86ce2a0108c52f875a70bc04735e4c7dd1e2833abe4cc25f3fdc7be820869ff1bbe1e60c5b4f3c4a294bbd4125df12b81ade59f924a929e7db52c36bb55493a54abe1b5a13ac83693642787e28382b0334ee662280a823c2d937587f"]}, 0x3cc}, {&(0x7f0000001340)={0x1024, 0x14, 0x500, 0x70bd2a, 0x25dfdbfd, "", [@nested={0x100c, 0x7e, [@generic="09abb06f06961ef3043cd9641fa88ba7faa3503330c4da7097832b63b2666979715b2c89de0181479ae57919307e2d5c6a333a5ecdd52bf62f69c2855bdd3f7c328333a2e4d09305f0b1307078c3e183ccfc52ee1be72b7d376241893a80e40baff4bd8ae06c4dbc69fe48a87738befbcabfcd337abb4f1d725d46b9eba695ad03ef436881fd47f986bd478a400cb907263ea7b6daa466f78111ad82f98ab9645c3ff4cec719f1c2f330be6695cee6358498e80dd58bee9673b7b9288d43575e832e2139520bed2a007599b2ac37e218fa35d72d2b94ab6e946b57483cb926abb877975de38ebb47e485988f1f3700a948878134bae130127d8bb9c72cbdbf8bc9ab93bdc017b0f8814a2413773171efba4808acb1ce70d648e4e539da7c9cbfd720ba4e4839fd127db2e6b7b88dfe7bbd0e5fc5a2006b9f4d7410a19cfe17e53a5de7e5f15e5bf9397b327c927c9630cd568230a2762d1b35458845e6423e17a7f707c4fdc2a11acac0a3e20422fcbf8951e88b22f6c604e98967ac4531f74084841716b82a786e8186e9332840f245350c5aed9ec975fd5390d1e0462adfb8e581653bc8d65b460c2656cc167150ddd506bb9dda5d80995ce2757144fadcdd2d6c38bf9f6e1cec78b2563ba72438ef2153be70694d459bb1cea09bba71666a736af1dba18ae0283f77ee9207897b86eb94f37f7e692dac02c56ba4eb6f734ad39445c25999f3e82c5be5b2ebd5e7a6671c6fff7215ab55433f657f2723b5db26fdc186d5eafa740b364b08ba82a05e980f793a1f90d3ddf45ce77740fed421944a570fd182bfbd5e00b83092bd951143cd33152ea117e44f5f975e8007e99fdc7ec588c6c06a32580faaa7ed71e939baf82b3788d832389ef62355496e9c6e1ab5dac68ca43d61e963a3982b738e6174bee3e5ebe321a8d7440b451068bc24c968af3ebe31ce65ae830049a428adacb437708123f35493a84eaf904cfb7d00d193909c0a281aea97a48bedaa03f5a79dfba0b37aee8b8e49be6b41e13dd23bde65bb3f6db046cb59f859e0a774798da91a21cc8007816139ecf9e81cc0edd8c5e062bb99702c21dcc02b0173d1a4f8e3bba21a4e483067a0e68472f643336bd48855c20a5f3fabcbddf112b7093baf10fd2bec1a81588fdf627f88c2e12e59d6306d5cc8dad7b7628cec07ae40a71da8157f11f002953c4917c8e4ee51495fbcd68af42dde9a992e74730e90f2f6a3e8e42b77573796b3173e4985248a30c1597546737185ebb0eb84aedbe347ea597d797b7dc7f7438bd5f9053f964259c8be5ba4d44347dd5a2309c09dc1a7998a7a4b9951b5ec4d04ab36c8e78be23f55a4bcfb6e43c40d1e534c30b4b349ba0651ba1fb392d02c0474ff50d11ea1447a2cb41258ddf35c0c1433f19481d382084838535908e2ae995b2ad99f0b872c5e0e0e56e9a3dc4e8e8790b810596c9ec3de807d3d191a098803523270fb50afd2641b7a41896a35a919f6212c972e3255be93f8bf0f4ffbf07a6b78ac841d74ae1901d9cc77fba99806cef486113d6719edcab0ebc5f687da7cce31d877228b7ab2eed8d8abe4ebc2982ecab3bad6f8b07b2cd6fd09d934ded894f49b3245cd1ca1aa6b016251aba1ea62460308c5e8c9d1d3af65034463df0dd3fceedab8687ea4d5894d0086b5a18b8e2a97fc2c539c96f271d3765b2c2dbabb6841a4aa47750940d45f111f1fa51456deb659751bfa4dcff3844676fcac1577a279224fb8d5bc2c81ac57d032156817977b44ac02b8380f99fd3cff9b3450207802fd3ef84b70f777118bd7485c1c5c747dc8b933e1967f9079dcf76ff7dc3720050cd76c70576f1c88653304a12c8e3fdc73f1f84cce05cff52f14f87f68853802696a6a11ba7ad26670551a54e8d34c2020fdaa1dc93ace5ad4f85ce38500b61147ff162cf95085495cf218639ba7cfa5aa1c1b6f3654092621db4b8ca81ca1c0f7ed41cd39d1efe05c488400bbcaa7aba56df4de1acc978682bae08b0469ea08e4361ebffa3e2f7840dbfbc56cfadaab2f81d5119323e6795095c3feb9547218e9458b107321e69fb111f45ba22dc9f9339b4e2f5a34b82b97a8d336e35ddc03418a3675709442650a3127e730c35385c00ca9364f38a949a49b5c070f6e562ebe9d75c113dde4dd451a59bf3d10be3aa996c9729709482cfed8dbf493e544ff5f080fd79d92eed33dea16c3430debd34fc6ddbe2a7622af58923879a07d5f5e7db86b2400e05dade98c210db25a19bad6eb72b24a0dd3db491eef767ec17358a74d5cb92c1f2372362287e4733d100f7de5c3f4ad778e9e64657a1bb6cd18cbf559ef7f8bb095929056856583c94839ef294300603290fe305738fe6b34762bc9191c0edff4990e812c52e759f9f0fc464b500c89ab2af56fc7b678939dd252cdbafc87ff6bfc915e3b575b2c84072cefe1f6073d491eef78e6efcdef96c8fc3e01b7efdac5351a7d424abd992a60e4c8295308481ffa46a96d1134ba2cb12d3d298a4d0bd885aad0593ce7953905535b113a0cb385b05b397147137aa65162e5f00bd2b36b695a4c1d7ef04a729c9d757b025ca69116344a3a962b3ae5860e23089b9aebac22797f8aa7a19038f9a40a8070a4349add99ac85c0712e2b5c17f9ce37e3aac11f5eb2917a0bd2f23f3b11da2ef239bc990069a61a641c94431ce6ea551a64c9fff4d26907a7aaf6aa8bbdeda5bd855aa5c5a689d5edeabbccb1a3593bfd7a339800544bac21d2b85596287436e648ae4e6d07de10d7e70f0b38fb5c784a5d0ef486e7872b511f63437d6fe82a32dc08921d6da9c80077cd44ff1a31af2fd82c2a7b38fce6ab9796416d6a32dfd2bb714cb8d45ecd4f268433451be7e94e4777983a21a5337d2f95d7e0af133a1e71f252d53f9357f63c0852ef99e622ae2d9a24626c2dcce940449f85fe342066066b9700021f54624d2675dd27acf072f1e9f621667122c6ee8e6b471acc3eebd295f6c615dc92b60fe767b74280428482187822b40544fe82ec6606adc241ceecf3ed1d378e860ef117f29e4320b2cc842790d7ea80695d71076893e3c4a98090867958860be2a8250a5428442911a69de2078f52c79788470476a39d160c850b4e0ee21e43c12be34510fce3842d63066c2085908ec38315f81f891dbe5125c1ebad59ec62a3e21f382e38d65e68b6e3719a2274f20e4bcac00633295d310f62682a5bd370fb52e00dc20a878640bfc6547fcde427452749178079906bf372f9716d0702d81dc71b01e8a59bac9a398a6d84b01197ef847a443441d18fee5ff84c8a9c495cfbbc800940de87b524fb2c3c8515434ddced8cae0b3e077bb43992eb2fa08f77a5dcf39fbba870a5194ac3583fc62052c428f0153ac2c97d8cf6093273b193fb18bfa5d44f4cf7b995f53a554e393ab67fd0818eb4681a467d585e9b5cda1180aba342f8168b9b7f5f942db200f9e32eac72e11eaf5fa8b4cd46417b7cb3141239c5b4a41b7072d4f9b7462aadc174994f941d228122d71277671f9f6c8a2baaf2df185915067373d8b5efc1e080c2f40a4ed8c9c3eb257c1bed10893741ac4ae0f9069671aa8d645bac42fa697fa67f92ce0b35a4ea7ebd6d896e15c286abf4ff2d36544f7cd608b55081eef8558f2e293d2a5e7e578ec5de77421c8bf15ad9986752bf434e7280bfc68b22c7c2992f079253c177aa106788df6c78f55a73119c0272c0f32625f0c9fbb12b265145c3f5d572cb806bbbabc48a3c152e7f5a784800304204d4a9eb2bb9902e94e0df60e55904455a4d81181f9c60d25651588e18ccf7f66bdc140bb96e4154bdc34b33479a31ae3f3057da6a322a237915d576e5bb5948d6f1dfeb394f5eb99d30b95811bcb11aaac833b4a3e6aa3447e44ffaa841ab10c1c5438adffb8faf76560a940863e780ecf8cb1df3693c681a668ba49d2f582df208143722b9d01818890943d328fd7d3a0ec199ea66fa51dd88c368aa75141c32886fac2073f68f9a52156f78142556dd6d3a282e773c2e47e5b732104975589755b6f77bc1e8dd3f00e46924622759f36caca48f212fb67e9b339482e7a015ccfe3151274f34ec45da81b938e51af23a84921863c36d1e332929628a11d65b711b1756e54ef8c0c5401749fcc3446584d564974b23051bcadd3cda1c65634423e203a5134bd9e6e79a9e347ca57b02357357c8444c5a71f54c3bf1103a3aed56b0d671252e8a69e99967999ed5d0940aa06e6be14282d26b312cd118b6910067a181c8a9de3cf86e829aceca29cf6078db0cc0e33d97ec8987d7b5384b5cfd0c88782ab2201b3d61fd9538167e4e078c9bbce27e64344dcc2c9c430887cc18edade3ba503191a812512213fcc897953e0a9be61440126319c5fd084e906e3a5c51e013de1d391caf09dac180e8133944bdd1d2e58c4a201eeb4ac4622bf9990380d00751d21c9936251bc5638d1d45ff4abc9edb9664f773f1ce80e66f3a6a6e108d4869e4b16673c25753a0b56f55b2ffe1f6cd286b83b2201aafb14e8287b4f655235dd646cddd630d436d6f27daef344a8b857fc3ce405aab3b37ee656f295a6421c4f67881c23a0f30c68306ba59125c9afb6243b8e94412b099cf17d568b38c9a25727017b24b92122b1cfbeb4de8b9a0640ab09249c610b39bc2203b3c8ce7c62f259254afd5bb1e506af99b2e6363e35cdc44955236747af46fc624f96c86f532dc1ed27d8585adffb9a277e0206186a1fb65d88c624bca55a8d9585b81947ae2a3ef89b92359056c36115b33276ed47c1a8553833bad77f1d916054159f4f48bb5a463a9282f1ded5fa933a7c51aba6e4c24f921f98dc63a77aa4fcd6ff7dd12d225ff4a886047950bc517d7a939bbbfa613f84c2bf4679c150e06ab69f75db8b605ab8397893e12d8a876f3609be5458d8dc46911f8902b0d84f3d9218671dab96c09a8c113e42052e19ff3bb73c7e43114abaaec9d9a429dde77d6706941e9f42209f9008e0e73dd359caacc4bd7bd2b8d3bf5ee26ae788e611fce508ecdec3df0972ce8fb8d5817c455af93552c128a9687a1eac6cc588a574f4c04d48811e7462d2fbacf134fc503d0c568d76838b4af8903aa579d6490ba091862e80a64ddf4d35b273116f324085134684277b8798f791091d99250c8341de4ac5121f59857e6511873c4f53fe0a2a0fd3b7358bf02708f456b37a4b97896e08b7f6bebfff4364b430d8a8ed20de95a68560b1d24353ec54790afd804462168b8bc17d8f9c3c20226ed7550af4e52c37d3bdce903d62497ce5ceb6a0b71abf6c468edb86226c3e984d65b1e4852843e95c061073fb1dffb7742fa535bbc4fb08004ddab9598886d013f3d4fb1f39077b76636695477d52913b03f5df664e99300efa8ae03f96b9f0232931d9f69515318dc134cb00c30f2d823337bbd86edb013b419228b0b59c2b11b8c4f5f44b162a89fd0ea54a02f72416b68e2679a6c845102fddaa9cb62d595bc82ba607c07f2d2034d1515703d9a6bdaccd9146045de1b2e729c4ace3e4eccaf29fc49646281478faefe3a2eaa1cc5926734bc64d90e26f36d4f769180f614f36af1473059b74212216651d88198970d6233672b686aeee338ae0dadef621f4dfce6ea5f7a49d78d38325d4c46fdb09ede4e67b58fabb871c6928e66804cc6eb494b133f1970117fd739dc5c47bc774a11d2c89820f33573d2332d3ffb675cbed806187294f9e93cc383bf8ee4b36269dc525eb89efa6e141fed6f", @typed={0x8, 0x5, @uid=r9}]}, @typed={0x8, 0x41, @u32}]}, 0x1024}, {&(0x7f0000002380)={0x2c, 0x2f, 0x4, 0x70bd27, 0x25dfdbff, "", [@generic="21cbea88c50d5e99300050df4617034438cf28bf2868e4c150fb44"]}, 0x2c}, {&(0x7f00000023c0)={0x28c, 0x42, 0x0, 0x70bd2a, 0x25dfdbfc, "", [@nested={0x64, 0x66, [@generic="65ecd8e22c388d2942e68e2c22ff00952b4db257fbac5049bba04d77fe5a2533a8caae01873bb95fd1ad669cb23d87be803cb19dc41a0843269bf983d18a449d5e7174941e2f09558de72cc98694fff5c5b8fe9002c3aa20a5f07c6ad6"]}, @nested={0x218, 0x21, [@generic="89494090f7686b0442f80c97dc4c3adb4cb60114bc4681900ba1d8ba8ca1b07c1b354bfe22c39397c9c89ebcce89b1641cb31c9d975cfeb2e652f3b1a6f426d1d8323b92f67e98b52b3400109f42ac0dfaad00862ee4bfa4b8849d9b0f1cbe4ed2880254dc3ce388ace03fadd5aa0196452878d6c322d383c4838f62d4796cd2633493ec9f97359f7549ca74f06a8b19228d4d69cc088c942045a1e767f905fb590627baf53574da9fd055ba4ac7a4127b44e469d5ee61d52be7cf6cb878b4431cbeee628c6e98c09f83978715e780977aff1f03e7817cd68b2f66ade7287d898ab549f7bdff356162f1d9a8518309187c81", @generic="1815f50ab923efd7321c6262b711e3bcaeafab3f992c35410f491ce16c82ee9ea558ce2390f5f2813bc784b3daef3472098d7f40aa7f262141315c358cfcdd8d", @generic="5db511e9d00da322759b8a567af3a4bb293164c5793e141a064b056ebf36790011ea0c062812d6a5f736718445bcc873062160f0f9c8bbb8bce7a7efc3dc384f3bfea357b242024bc52b5dae128b844f1b57e1300467bcdeabedeb61a5594c27a5318e4fd14de4353dfd2699a003bed1f46ca3cb153d1427c6448eecc853cfa4daefaf9bd24e0bdce1a3030dd1baafb2d1701ce08737c30cc3bcae7967390bbe5698b67b257ff659cbc2411c36b9f0a6eb23371a0180d9e4df5a55df3c255d9a4d3ad306e1dead4bff0bad777b40ae4042bc111e9c287cd702af2e103de1e258"]}]}, 0x28c}, {&(0x7f0000002680)={0x10e0, 0x13, 0x100, 0x70bd25, 0x25dfdbfc, "", [@generic="a6ebf1b53f9e552b97bf43615682728c7e09985b4614ad7b2d4812f20660848c9b2f852b0a48a62b319d6347dcfcd72b3abcf81d81e85363ed235bf84b2ecbc74dd414dedcec91aa45d6ed07e6cab357730218d9bb71e164a71efee1c9f40b103d6ba20e0887242b389511e67fe2df3d0f775ca6412d927d5adfe23e83557d60a776569108b3e7d38be7b0c9986b29abdb7b85199d8546d3e451045a7ac72fa43e733560d2f05af309264157a84e119dd88108200ca7", @typed={0x14, 0x56, @str='/dev/binder#\x00'}, @typed={0x1004, 0x58, @binary="ea07154b15b1fffc6ba3f51dcd85f0288fe3758365dc16da281129c997506b9896f011ba7fd6a181dc0d74b09af293e91aea4af0b6a9fbef07708215e389120aa368a41bbff41809dcca5e90215e43134098dd969b878188c2bb4b1d47c9de90ff24d5c20f3438dac8b1604c58ef47120ae6357ba22ff95e4cee1003241ae7a1fe4a2dbd3758478e7f9405fe2ec3077b63eae57352f637d1b72ac38c7e84861cba883843e8afcc669c07d482c639453fe117553f18583d216268ac6a3f6823511654c3c81246d3ad98b781017ca38b48cf58b85c4861fb177a287150c8481faa7c62098d52b3f459ca1791d65816d2b5142cb84ea75dc47eb39670ddf4cae5d7160db3cc11e395427d8f5820dc282e437779f3de9ee456daec1b3ec86cd962d2cc93f0463e158fe74a44f2b0005a5c2f54446a79f48b95f81993889930914b5eab5b0681a9a650e7133f8a8496bc6ef265f948e1411c8f6644b0d03f6ecea9431fee0f58d749c8c445d4dae745c3a1e0402e3513a3f18daec76365d147c6091159131b62a0060803327aa81c8ca308074e5c0bec74de443843be325a29c5824addba6d57ffd000cf2dfd3e7108accd990ec0e9bcd083de5192a7507aadf8d6a986bd142d6a5315363fe45100ce2d8c7f4a61828e905f1ae88c74a413acc1797950b5226bb3bc6414f1369952b46f671e8c4556149d901f9768d39fb60190ace49c940f978cb7d52125f5c4035b4faac8159a63302cb859ecd4854240f3680fdf0c10e41c897a5fdbf489a0849c502a662c475a1feb7c88c5481c354ca40a809e86fd927b16cd0c9e19253a6e4ac9ab3378d76a2b45f7b73c741ede9e8b13f058f97a445d924119fb093ace9dc45ff7392694727435ed24f0d56e9d7138b15b38d152e8b4e945726abc3c1300c3dab023fba403d10c9cf60f73b58f8ba69fadac70f277cae18ce82103a14e54b96dd9c2e2ba5008df8158c38b791b853be63dcdbee382f9f1085ea703f2f4a869f50ae18fbc38b65d63b162244fe7761bb6ce8ac9771fbae6d7ee997c9272d2d6b33ddd6335287462ea8d1b3eb5c218d73a8c21a7c4883fc46af7bb9e3c5665ef47d08dfcf1d327f0c9d8378ad160036b7ea1c01dd8637576ff66f2a35587bfe37fb1de37c56c2c7e8592da0465d969cdbbfba6c836d4add3e0d653dcdaf38d6377c095ca3f4b3ad8db4bbf3489032f3930a0c2412ba37b0eda3a35cbcc3fbac6ba5667d2ed58e341e81b051648023a762631c3cc17dbb089c5d56e35c81e9ecc95e0b07c3bcbdd3f7f3d8cfd44d643920f395b7f0226ad785c84094ffe392648149213a5b8d4b9e770f22dd1d3e1bd2363b0f8b1f2132852a7459e9766616149dcc77dfbf3f626eb7fb7250a69c43b6f720764f4ab1fd9bd6566e3dccd6c741a23bd1ce6d46493992a103157afec9c9858fe1a97d08d284563babb197d26cbc5a5d39ae2918158c3a3bc8963eeb7035ec6f0564a101f3d7a0600171bdbd22e30f7fdec219f66f3d491e8f366486934805cf90194593020e8e29983109eb88ed835da88eb1f4b723df2773e267b90f51d0f5c5c29d9d7d7f2adfc70b4f98c5e7fe3f9b65ca45ccf3468c60eba0e0c3323d6996378b70ae25ea1c30f8fb7cd9f8ba18d5e0a2737c62c128a1e8b6a14c3a94d3367ad0fb7e1aa4b1d56b138b3210d3d42b132ea2e6ba53098f8282d9cc539386d8c8dea1566fa006cfc67a071a61c1a9cd78d2367491676981b0c35d89912a51599cfe4a7e06b5de973621d6987161f960209f87c2b76b375d9996c581213c8d02d0f5e9f4520824b13d3a604a609711be1d5e8d96ca99e264634340261b10272917e648a7361214ac07b579620f968a7801283c77ca02b6825670352ede5ff82c763415a4dcbc22b6485d91a3fe7bd395c37bcce930b76fed838d3b690c86557814c745f0fdc34ae157b7de1803cee9c584efc01c8a1cae5864215fcf8dc20a3168ebf19d3cf9a5a6a6441cdefb3d4b4d128e5e38968f07bc87569209a5b87475695ded40aa7036566f87ef7773b69e2fda6f94a8fbcf60b52e0b567ec51ae0083ddd6653c46df6564c467e8638090a03f79e6ce574e150582446adbe8cd4ede69ee68d3f10eebe5cde32ad3a42ef35592d59bc1e760a8e9e6b83961fc974f7a160530a5f587fabcc4d8d292a127a6db76e5e31786b513af1de7b563270ab96accd3e9102b13ef3cbead95954c3e797f6d85758a75f2194754294092059300cd9b2b315d84e1060f44f2d3776c11a31c689bc7d5f478dbf483147275b298e6d8d02dc4e514f6c53117555e9e7b359cff3912cecc22b398bd110432813f462d44e7696d397bcea1e2016215442df0d90dc5b6f5b3ee64b78dc1b2cd764e4cacd6492b5905cc6c02738c662df7f9d0350f3376e05111fd1e428ce28974158697c50bd77ed03c3cb966c04b6d13e6d04b645c273aa699a50dee1f72d09b0b391af319f684c92cf812249539110966895aace890252f000399097038f7ee7cf1615a03a18c7c6b327eff9b1f6b5a6e39d901ad00339c4b2520f2e5f17497ccda94326861fb491187211016bd585b8042a790f7f03b3326a2ac0a48f3852fa8f153124f512c56f6d3db8da97293c7a8252a03d694a85dd33756e0a8b14be58b34e1d02bc63b0df576c4eec82918187f24b4c7adb906308fb21c0c664c58bf507ea72e7e9e9d422e43fd5939689b537aa8edad576a30e9daa736c74904b402292c72a1700611437eb0901c129acd0d5e0c85090d05f9ec10436adaac5f1cbdbf5e27b65ca7d5f02d46ab34bd0ac409b00323ef1408d8467207223fa9d54865f0077361f21c400d75340077526140c04edfeeeb1cfeda0d311d74da99fe5aac64edd0b141c76530d603690002ee306f29e6d45f01fceb1b39613ed0df508658ac1c3a5ddf836670e22a8a84b74dd9d8185c7bd4ac4f2f5298268da45481984028ce20107f60c32c4112877aed73c7295d9b47e5e7ea1213b69fbdc245e3d48f5ff89f400907399de5cef41bb87b44ed0c320f58b60fddc2c20925e1d57d8d4022388e809b96c932447eefdbb9fbe2a4fdc9fe15b3f3291234478a528279fba1e67b7589d888c7b4cbe1b67bb91c7c2113cc48db3c38db05bb59a5133084107fa544e45636d2eb0ee2d675822f0afd98f35c5e61c92a74f7a3c604bd39f08b034fdd480a588141541413e923a2be197556ca143918e8cf2e722dc1c12a1fd78e0cfbb637167504a77933910040c7f5537c9afc04272219772df546f6e28b6245f5c0acdf3680cd2858f2c8fe1c4c646d28f78196851929ff16f019aaf787e8e512325094cb31195c4baa4b22dd668affca837a09a1a48fc430db1cf8b2e561441bbff64a8673677d46349e59e2b13d43c938f94d403ca384c305c0d90d2d1310c7a16578b9b259ee49e4193c9f2ed90d82c9c98571d6c9f0d5f08837ce3e2b8b9651dc4d66df4a1fe510d534c51641a4c6117e4c1d80e59bec22c25f2d05020856f59d74a17845d17b7f486e3d499d8fa45a0c92103d027ac0fee3dbce87ca4e169a8adcff666ca33ba11f3d25d44305ac3d8a9f75896b1cfb4bdb332757c143a2c96b853f292b4ddf0249d45cf72d359b9204c33d106115ebe40e3d605d85b5b2a45059abfc1246bdd9290300a795134918b0c0e70fc63f2f7a3272d464b254759c5974b2c6269f3416686b0c384837c4011d6d93a63f4a79c084e5203812efed9b34bcd106d466c89adb1ee6e2548b2af01ef847728fa0df85057daa690aea5f0396d9d0a7ac86af4d8a7826e7062b6d427512c8e805f115d6896ebd386e01dba3da49e534030b025d6a76ab95688826dd36c33879f300bfa3d31a1799a6a09c66518753571eca69e13d7bda71f20f3b654d54837f3a08dba1611deccb8ac0c832dba728d97047f8afd99cd7b12cc81714b03dd02979a1eac6f3a2b721752a8022c663273c3d37fdb2c7944fa478d410eba4a8be1b2ee7a785167a596d77d37a7fe93b96291e44eb60663d475df5781110051a841ff3b60dc19663f48baae4f1912309422964db53189dd430eeda081e8ad6715c82f598ccf5d8928be4c754327a3934e2974eb87e0ac1c4ac158b8f89ea9f5bdeea7e025b0e90beaa49284a4cd6d05578149be793a78421ca0ed633e1e19a1bf2faa6c376c9f882ff0fcc185dbed64143e144509b60f867d44838398556ad7ced75f933e61e551d5b0dda84481d28bd379ff73a355dfcb5cb55dc70d996b392c4f7dce1d02aba4ba8ee82b9b0a0de0606dd6d84edf4dd014bc5d80c8a92b74c7ef2ca453881e7a8db023cc219f362161c1a495fb2c0fbb8b9f9c53c3bff6ee3e40dd82a59bf12f59a52adcecaae60452004eca967eff354c4f6fc1b2d8611f97898a3df42cf3c35c512ab0c139bed0581f1c22f572dffbc37379157227c309892ad4560272e4cc52bf2327dd18910159a88d0d59b16ca3589b81962e6373e774544ac399c8d47212131ca3d33da434a57f1313bdb851291653f5d7163fc96b7653f54ca62c51958867c634ccf3b554de1189adbd9de3404ba484690197b2b69e7822cbe112045199fe63725d4b9137e83c2dcc1cdc23c3cffb098047467167030c640d6bf3adba61ed53f3c73706f8439717d8c2f5ba2e132af19effc26b2a7ef0cce825a77629a3abac7b4b064db9d8181fecca2a3f7923e448b63a050b79a90101b080285da12525f9a62a28d86c23a02d8420b973aed668c61e8341702e4c45b0dc74bc80ddf1f4eb7c54d082e3ad2e8e09c8f1c6b13e6f1dac321c3d8bd2efa92adf54bcfb7ddad621179e8df58d5d0e54313efc39b6aa4c742697531cf31c86f775ab29023a2018c94e1cf72d4a06488989a03cb8f7f17a9db4e38f4c76a4ba73efd71e8061d10244e038605d9e1c91aa7e3009a4a47618581d7a6acb2cfd6b166d0b270c0e8819c790b52af0d01353babc8d2e4f12e2a75c0107314f26901c438d05e80e78627fae4da44bd8f84cbaed47e435ca5b4f509211d0e8b617ee034f35527dda2f1fec776aed267f588335d6ae353de37e273f34c0b5de1c9137ab4e5ebf7c052a018c8d381c80dee3a874b5066fe3ba6682ed073f8551f4bba16e3a86cc6e2e3dbe8461188131e09c132dffbbc28ca59a5f85b41570554ac2c9d2d181d77c5471623b4f4b783daf5d87859446df00489b0a2e99d10e8ccc366adfa3e0225e45ded177391f1c9bb52d31d72d6674e06551a9e1db91af3c8ea6d4343cb67d63890a12a23bc763c3e76b82d7aff6bfd2d203dae6746cb341e9786272941d52fc6c63c79df560be7bb473aa0ab4d7d9be7fa7902e482b04acaf552ae6fd83810f30623f968a99b53be6ce39a3d9fbee2efe626e3995de171fc22ced8951199979ce3221742d85c725b6d7a18bb0ed2892c98ea378fe1f2d93c4f78b4f26e8a286c7d1e1a98c8051edb648bef3c81a72834bf02381c3d3b98393db57a5e0a8b41a55a7ca76a43e368d959bc37a213030fa81492f4d842383bba0d1590b539721fc305136cad0ba633a3d62d2b69d0bb140a038ba18654446e1e6a05f3805bca480356e94a058c2b97ab06c63eef06d63d124aea4fffa7a9f3ad80ade1e5bd9f742e26a3d1636ac2482d9bd34edfd3e8d3ea1f827cee457f4ffa6d704bdb6f4a3bb40acda0c0e02eab8df4676c6a3d3099cb306a03bc48cc3db7ed0faa1806ff0ebe89fc0596c552221f6a59da460adb03a0721eccd5b7e2901b28b88bd83a10a6e80df64a329de4e64adeec"}]}, 0x10e0}, {&(0x7f0000003780)={0x200, 0x35, 0x2, 0x70bd25, 0x25dfdbfb, "", [@generic="85b360bb406f1a9ba894daa83b1a1145654f270ce0280fbae7fd1df782f827bd08644edc4ee7e7595085c988526fca583af02bf73ae1b199125a6b8715a0", @typed={0xc, 0x57, @str='ppp0\x00'}, @nested={0xfc, 0x12, [@generic="1d515d58f25044e6", @generic="6b84b9befde14ae2651da9e75ccdb821ee33306088bbc7fd6eb28cdca2e66acdd31ffe12bb7017f55a380066fd4aad1a00433670a5c85944d2e5c98f49604ec465adb73dd0c9fa6ef3a162aa6d6215f7b948de95ad12878f8a0a82807f540663d82819bfb1b91b0d8dad9ca6aee01494429d42894cf32006d356338a44383ec726bb5d90fdd2027ed106162b56a8d8fa1e5c24fea5013a505fcbef79fc27a73ec317fd0962e6fe9739ecf58b98cb34763e95113d76fcf987f4dfa2efe5eecf0e359e815afe687f1af6969e75e873eaca0a71925e25faaddc4471f6fefd8166799cd1a23b5d6051efa9f733e085c1"]}, @generic, @typed={0x10, 0x7d, @str='vboxnet1\x00'}, @generic="b0a0568f12d3505bcf28ff606b13effda266bba49e9cc0bceb6b75cdb3e30c7399c375d412ff67c64ec1a96fe13fcc0ab8ee14ed2285a2d1221154b1a5a2ca8bb514e6c44ac666255a9163a4aeb0b243686874013432916980ab755fe10848863ea0bf073d6bf04020f4822c06a98b8482fae6b7e0db8d708e81cb3416be8c87099bed8e761e31a3d480ed4895c67b3ebfa8", @typed={0x8, 0x48, @fd=r10}]}, 0x200}], 0x9, &(0x7f0000004340)=[@rights={0x18, 0x1, 0x1, [r11, r12]}, @cred={0x20, 0x1, 0x2, r13, r14, r15}, @rights={0x30, 0x1, 0x1, [r16, r17, r18, r19, r20, r21, r22]}, @rights={0x38, 0x1, 0x1, [r23, r24, r25, r26, r27, r28, r29, r30, r31]}, @rights={0x18, 0x1, 0x1, [r32, r33]}, @rights={0x20, 0x1, 0x1, [r34, r35, r36, r37]}, @rights={0x28, 0x1, 0x1, [r38, r39, r40, r41, r42]}, @rights={0x18, 0x1, 0x1, [r43, r44]}, @rights={0x18, 0x1, 0x1, [r45, r46]}, @cred={0x20, 0x1, 0x2, r47, r48, r49}], 0x150, 0x4}, 0x48800)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r50 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r50, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:08 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000080)={{0x2, 0x4}, {}, 0x10, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:08 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
connect$bt_sco(r1, &(0x7f0000000040), 0x7)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
r2 = syz_open_dev$mouse(&(0x7f00000001c0)='/dev/input/mouse#\x00', 0xfffffffffffffffd, 0x10000)
ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f0000000200)={0x3, 0x1})
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f0000000680)="1a8c443d3a568c81cc096a3eeddab0f1b182da383fd71795f40053261e23b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f01777d0f7509d3857adb1ef597c90dc67d18a883edca7f96e1c2f19cef1f5ba408f0067f06f5b4d5be565f49ffe0aeb127b1c12b6d74bc30e8a9e23d77aa54f4760e162d586aaefa2f8672f47141d4a335b3955a302304c", 0x82, 0x0, &(0x7f0000000240)={0x2, 0x0, @multicast2}, 0xffffffe5)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xef, 0x0, 0x0, 0x0)
close(r0)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

03:35:08 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  372.768099] binder: 20699:20700 Acquire 1 refcount change on invalid ref 100663296 ret -22
03:35:08 executing program 2:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x480000, 0x0)
getsockopt$inet_udp_int(r0, 0x11, 0x67, &(0x7f00000001c0), &(0x7f0000000200)=0x4)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x600040, 0x0)
getsockopt$inet_udp_int(r2, 0x11, 0x1, &(0x7f0000000080), &(0x7f00000000c0)=0x4)
ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x2)
write$FUSE_GETXATTR(r2, &(0x7f0000000040)={0x18, 0x0, 0x3, {0x9}}, 0x18)
timerfd_create(0x7, 0x800)
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{0x2, 0xfffffffffffffffc}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, "6c6f0000001000"})

03:35:08 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xfe80000000000000]}, 0x10)

[  372.821127] binder: 20699:20709 Acquire 1 refcount change on invalid ref 100663296 ret -22
[  372.824985] binder: 20698:20701 BC_FREE_BUFFER u0000000000000000 no match
03:35:09 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x27, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:09 executing program 6:
r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0xa5ca2924093274fe, 0x0)
ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000040))
r1 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r2=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r2, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)

03:35:09 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000180)={0x2, 0x3, @broadcast}, 0xd)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
r1 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cgroup.controllers\x00', 0x0, 0x0)
ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000200)={0x2, r1})
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

03:35:09 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:09 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x700}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:09 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xd0]}, 0x10)

03:35:09 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x400, 0x0)
getsockopt$inet_tcp_buf(r1, 0x6, 0xd, &(0x7f0000000180)=""/4096, &(0x7f0000000040)=0x1000)

03:35:09 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x0, 0x40801)
ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000080)=""/15)
r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

[  373.261770] binder: 20729:20731 Acquire 1 refcount change on invalid ref 1792 ret -22
[  373.276316] binder: 20735:20737 BC_FREE_BUFFER u0000000000000000 no match
03:35:09 executing program 6:
r0 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r1, 0x0)
shmget$private(0x0, 0x1000, 0x54000000, &(0x7f0000ffc000/0x1000)=nil)

03:35:09 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:09 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xc0fe]}, 0x10)

03:35:09 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0xfffffffffffffffd, @remote}, 0x0, {0x2, 0x0, @multicast2}, 'nr0\x00'})

03:35:09 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x1)
ioctl$KDENABIO(r1, 0x4b36)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000180)={<r3=>0x0, 0x40, 0x0, 0x8, 0x8001}, &(0x7f00000001c0)=0x18)
setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000200)={r3, @in={{0x2, 0x4e23, @local}}}, 0x84)
recvmmsg(r0, &(0x7f00000068c0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000004c0)=""/165, 0xa5}, {&(0x7f0000000680)=""/175, 0xaf}, {&(0x7f0000000740)=""/181, 0xb5}], 0x3, &(0x7f0000000800)=""/4096, 0x1000, 0x4}, 0x100000001}, {{&(0x7f0000001800)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f00000019c0)=[{&(0x7f0000001880)=""/79, 0x4f}, {&(0x7f0000001900)=""/39, 0x27}, {&(0x7f0000001940)=""/93, 0x5d}], 0x3, &(0x7f0000001a00)=""/4096, 0x1000, 0x8}, 0x9}, {{&(0x7f0000002a00)=@xdp={0x2c, 0x0, <r4=>0x0}, 0x80, &(0x7f0000003b40)=[{&(0x7f0000002a80)=""/81, 0x51}, {&(0x7f0000002b00)=""/11, 0xb}, {&(0x7f0000002b40)=""/4096, 0x1000}], 0x3, &(0x7f0000003b80)=""/4096, 0x1000, 0x9}, 0x7fff}, {{&(0x7f0000004b80)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000005080)=[{&(0x7f0000004c00)=""/139, 0x8b}, {&(0x7f0000004cc0)=""/25, 0x19}, {&(0x7f0000004d00)=""/212, 0xd4}, {&(0x7f0000004e00)=""/249, 0xf9}, {&(0x7f0000004f00)=""/118, 0x76}, {&(0x7f0000004f80)=""/215, 0xd7}], 0x6, &(0x7f0000005100)=""/159, 0x9f, 0x7ff}, 0x4}, {{&(0x7f00000051c0)=@pptp={0x18, 0x2, {0x0, @dev}}, 0x80, &(0x7f0000005280)=[{&(0x7f0000005240)=""/30, 0x1e}], 0x1, &(0x7f00000052c0)=""/229, 0xe5, 0x4}}, {{&(0x7f00000053c0)=@pptp={0x18, 0x2, {0x0, @multicast2}}, 0x80, &(0x7f0000005840)=[{&(0x7f0000005440)=""/112, 0x70}, {&(0x7f00000054c0)=""/239, 0xef}, {&(0x7f00000055c0)=""/253, 0xfd}, {&(0x7f00000056c0)=""/144, 0x90}, {&(0x7f0000005780)=""/142, 0x8e}], 0x5, &(0x7f00000058c0)=""/4096, 0x1000}, 0x1ff}], 0x6, 0x12100, &(0x7f0000006a40))
connect$packet(0xffffffffffffffff, &(0x7f0000006a80)={0x11, 0xd, r4, 0x1, 0x81, 0x6, @broadcast}, 0x14)
ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000300)={'ifb0\x00', {0x2, 0x4e23, @multicast1}})
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

[  373.310198] binder: 20729:20749 Acquire 1 refcount change on invalid ref 1792 ret -22
[  373.333447] binder: 20735:20751 BC_FREE_BUFFER u0000000000000000 no match
03:35:09 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x4}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:09 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:09 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})
r1 = accept$inet(0xffffffffffffff9c, &(0x7f0000000040)={0x2, 0x0, @loopback}, &(0x7f0000000080)=0x10)
sendmmsg$inet_sctp(r1, &(0x7f00000007c0)=[{&(0x7f00000000c0)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000100)="16e058e976de9b0658ac0780479f850293", 0x11}, {&(0x7f0000000200)="b02d21909655d0f9a49518107535098711c792b2649c0fed416d41d9e54636272986d965090c66c8f303a9906db47bbb4c862ab2698a2bd0c83599caf6673e59aeaf2323aa58cdac7568e4d80a59632f726ea3fd4862abb0476dd05e9d52aace8209aa15df7d0386e9c313a1d077503849c1d570675c34687e9744a17a926640df88880763f89096b9584054886929d68795ae69508d26fc012496516517cd27a05d21d1c63e5df0f44125c401e34cf2ca9ec24f7328f66292cbd6ef2c3092d60fe676574d0705d9d9db63bfb9ac3b6a9efa083787759de4e396", 0xda}, {&(0x7f0000000300)="c48f44427c493c63ac2eff4dfd4be138a0703a152efb3533a09184d872dcbe91b42346f437793e9693d475bbe78f95320e3b886ff1362721e4356d20e18d8e9d83b520d3c5165d8a4c02150ebb3b851483ecb876dec49126e56a8d35f15a7259b621ff55da2ba017e9a2578f64da9e690bfc056c1378f7b64a351a23f87b252bcda448a51f54b12eb884fe7628949d02ae01326a41c3b8251903c2567d36c860a98a8fa4d192a9b426d84361b9c24f0a20", 0xb1}, {&(0x7f0000000140)="aa72c212", 0x4}, {&(0x7f00000003c0)="e2674fef0de19fd100fcbced144f8f49ccbdd440d8b94d0da523b8a013681ee703915a895752f4b54246d056e7a92e10d3406b8dc67b869d45af107b20d06301b386946c6b0847e32843bce609e3f9f1dde1", 0x52}, {&(0x7f0000000440)="6bddbc67c9f022ab700feeeac01ec1a1", 0x10}, {&(0x7f0000000480)="e0d13434f8c066e840d434149e", 0xd}, {&(0x7f00000004c0)="2cc003b112bc790b0704d0f11a2e9c69d94226e86525203a9ca7e332a2fb2fd94644fa3be192438f7eabfee2dcf9f0c2c74d8683833d89e5bb6c9b652b79170bbf84709779e9cbb9c6a77095a9d8d60360a0fdc2d7b69a35098d0b1a2fbeb9118b9a61d62b5a6cb20615cac8713fe46a6e8248e5285cf11b28c13280cbb55a26c635152546db2afb44123e51a90b97538c45715f25b35996e5bd441f8fdcb8d3e5ecf8352f6e2b901297f2f57c05411036579fb874", 0xb5}, {&(0x7f0000000580)="4a29489cea8a7a1e9df9236b067b8f912b57118b453bbf02d168f51904858e980328345c924a40edacbf90b10cfecb519473338618d9e2dca6bd43d335f1917fcd41d52d47b11203c7660ec31d27fe9782b55b69cb96a6697aa458f0958722a2ef63540cd5cbf409ff2992ef625203202872231c80178592da8b0bd43f7d5edb80f32bdafd2fd944d2fa68bec198b239be195bfe203d9d56d59c73a7b78bb063094f597be55191676c366edc8532c8ecc156edc2793b104c47ae0e5081a9f070ca3c", 0xc2}, {&(0x7f0000000680)="e0d72c7b697ef16e015b062183420e2cc0b5bd10cd7f7d56", 0x18}], 0xa, &(0x7f0000000780)=[@authinfo={0x18, 0x84, 0x6, {0x6}}, @authinfo={0x18, 0x84, 0x6, {0x5}}], 0x30, 0x80}], 0x1, 0x80)

[  373.524239] binder: 20772:20773 Acquire 1 refcount change on invalid ref 4 ret -22
[  373.569989] binder: 20778:20780 BC_FREE_BUFFER u0000000000000000 no match
[  373.586772] binder: 20772:20782 Acquire 1 refcount change on invalid ref 4 ret -22
[  373.610374] binder: 20778:20784 BC_FREE_BUFFER u0000000000000000 no match
03:35:10 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2b, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:10 executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.current\x00', 0x0, 0x0)
setsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000040)={0x2, 0x5, 0x1, 0x300000000}, 0x6)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:10 executing program 6:
r0 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(0x0, r1, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)
syslog(0x0, 0x0, 0x0)

03:35:10 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xff00000000000000]}, 0x10)

03:35:10 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x40000, 0x0)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000680)=ANY=[@ANYRES32=<r2=>0x0, @ANYBLOB="e00000007e4dfa747912d25cdfcb3c583f1cf23ad2b8d5d7a72d1e3fb50ac40269828e15879ffb45c39779cc01ca67d990540d8faba641e7970bb05786841c73936b6267cdb60022423cfea8a1b476209e4be9b835d96ccd30fbda053d40e1c875bef100be3d56485dab5858647fd42bf7d9c1e36cfa7418b057f1eadf254c32213b02c6991330e0b9cfbf5e0984d7d713690883488282fa9708996218eb685c12748d3654b49fb04461ebaa388d03f81dfe560b8f7a952eacb3764c749fbd91841693fc29658458b4e6e78652a04ed0f4be966000000000000000000000000000000000af3146cae689cc8b7889dc4e33cef9fd93c8bca878c340ba423ce505473784f9c6dd5a3ad37f839b8b6d363744f1964fe5c951e6ff5d271487c7138f37ab057b3e7665b0c6d05447d82a3f2d5f66a3effa4bd60357d8ddc0adbbf0bbf4206c170c09b457bd185543f6fd2d7b937a4b7d47e98e92e51a415828ba364d9be6575821208ae5f503f14dcd017a1f3d6b82c815119daf7d3c4c27e8f48c702a75644f9539888ea94acde78bffbdf3d8f01eb97e9c1a6b3a059fadf4ac8a35f1b641de4290dfa23906ceaa83925aae8f80036fa5515c3fe69f9bebed4ee80edeb18ded8b4f21a9c69b4afb6d3133e35c572a9c2cb783cd5422447626"], &(0x7f00000002c0)=0xe8)
setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000300)=@assoc_value={r2, 0x7}, 0x8)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f00000001c0)="c749ad1e0b884083655df5eb5d27460287f45c18cb79ed")
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

03:35:10 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:10 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x7a000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:10 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xfdd2, 0x0, &(0x7f00000000c0), 0xffffffffffffffe5, 0x0, &(0x7f0000000040)="51db88c11eaff850abef7a17c4e2394ece4b9191adc8ebdfa024bdff25b97305bc6a44ec19ba47cfbda1f7ed916fddecf8bfd17c52b2cc9df2b9591821a4e8ec28d9bea23a6a0600000009ee7de540a602000000000000000000000000"})

[  374.150881] binder: 20789:20794 Acquire 1 refcount change on invalid ref 2046820352 ret -22
[  374.171565] binder: 20800:20804 unknown command 64978
03:35:10 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:10 executing program 2:
iopl(0x7)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x204801, 0x0)
ioctl$TIOCEXCL(r1, 0x540c)

03:35:10 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xfc00000000000000]}, 0x10)

03:35:10 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x105000, 0x0)
r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00')
sendmsg$FOU_CMD_GET(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x54, r2, 0x40a, 0x70bd26, 0x25dfdbfd, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3f}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e23}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c0}, 0xc880)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

03:35:10 executing program 6:
r0 = socket(0x1f, 0x4, 0xfffffffffffffffc)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000000)={<r2=>0x0, 0x7fffffff, 0x2}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={r2, 0x61e8, 0x30}, &(0x7f00000000c0)=0xc)
ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000100)=@generic={0x3, 0x55a, 0xff})
setresuid(0x0, r1, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)

[  374.212346] binder: 20800:20804 ioctl c0306201 200000c0 returned -22
[  374.291928] binder: 20800:20810 unknown command 64978
03:35:10 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:10 executing program 6:
r0 = socket(0x10, 0x2, 0x0)
sendmsg$alg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000080)=[@iv={0x98, 0x117, 0x2, 0x80, "d1296b23a71a237e9d2096924b0cb49a7d0d77e1586aa2433c6b8abcc991266e67ea3cb9c389d66f5ff9daa7db529b2291751ddd637a0bf332ffdba5fadacd9eb1fefaff211c80c42bd33a74bd400a55cae36e2ab2d56c8dd31e20a42cc7c13880f83e3d185856102d85ae12409938dee46c38ce4d6a10a373b30709af888434"}, @op={0x18}, @iv={0x60, 0x117, 0x2, 0x46, "6de76739a0bfc32e68d93a9e6c05a837a9abc9734c2acf2f3c5a452fbeff4e6ab42bde20a78344b6eb0d9bc2c2a41d9bbe259695b7cfc470967bdf8a77ef3dbaecb684545d3f"}, @op={0x18}, @op={0x18, 0x117, 0x3, 0x1}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0x98, 0x117, 0x2, 0x7d, "6f45bc159eb18d10f4fec2d55a91a46098421f39cd74685065a5641f444879ead54530f60f8dd4c40a5eb28e13342e3bf743aa36a26d1c42d0a9c6c3e3543f898b061227169be5607e85c93df4bfa1b7916be77c2d6e55f3a841f1d6c150505b2b448476f2ed597415c66139640727fa78c4264ac1e435018e1ad50f18"}, @iv={0xc8, 0x117, 0x2, 0xb2, "281f9899e9005e21d0a9537c0650d88de244f9c9b64012de953f4dede448a911f933247a411e0d5d10bb279228cba391489bb43b071f2c03dfefc74d9294e36dd01ef481af29649cb3306d0a3bbc555b143e67e731effb40089954c81604eaf81eaccafc1468bd886f53e4a1c66c91b1f49a569fcde47a00038511b1826f1155b5d3ee5287a140eab625c6e550954e04dfe1421b04c942fe971b21d1120eca2ff8d7dd60140a32249bd8b0cdd8fd7dd5cfa6"}, @assoc={0x18, 0x117, 0x4, 0x9}], 0x2d0, 0x805}, 0x20040080)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
setresuid(r1, r1, r1)
setresuid(0x0, r1, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)
socket$pptp(0x18, 0x1, 0x2)

03:35:10 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x181800, 0x0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f00000001c0)=0x1, 0x4)

[  374.342687] binder: 20800:20810 ioctl c0306201 200000c0 returned -22
[  374.937099] binder: 20789:20843 Acquire 1 refcount change on invalid ref 2046820352 ret -22
03:35:10 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x14, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:10 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x44000, 0x0)
getsockopt$llc_int(r1, 0x10c, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x4)

03:35:10 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x100000000000000]}, 0x10)

03:35:10 executing program 5:
r0 = socket$rds(0x15, 0x5, 0x0)
setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0x7, 0x9}, 0x10}, 0x10)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:10 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
r1 = accept4$nfc_llcp(0xffffffffffffffff, 0x0, &(0x7f0000000180), 0x80800)
sendmmsg$nfc_llcp(r1, &(0x7f0000005ac0)=[{&(0x7f00000001c0)={0x27, 0x1, 0x0, 0x6, 0x4d16, 0x7, "71528db22cc94dfe2576b2aebe44014a33411f88b638d4dfdb8a9fd44b35db8b41764214e0bb4e5231161e553c98a0b7ec36dbaa698a1ab8cb191bf1857d50", 0x2d}, 0x60, &(0x7f0000000340)=[{&(0x7f0000000240)="e775056d8b6c77a6cb8dfd37f0b6f5d923a72270c36ea0fdb3326becc4bd1f4d5703940800f077d08d7bc7b72000554be6f3b6ac9380753963605c44a3bcff17b1e4e06d6814d7e7ba0742ed6d9ef67efd0b8bfacd79814e5de765379ee725a1166c709a8ba3e8cb7da68097e1b5d56411148768753500368d", 0x79}, {&(0x7f00000002c0)="32975bf5f742882683bb514f041f2640f8768d6e656d739156f78701a369e2fb06253a127c99d5191ab0eebf033bd7f18bcb7345347d9556094aac31ad71e78ff236066f0593f34804db70d9e678ab582c602075d834172cf38c01d4e0ec6d", 0x5f}], 0x2, &(0x7f0000000480)={0x48, 0x11f, 0x81, "ca2715ddffcd0a366110c7ac43c8e8c260b3d226a5d6bb4e9c2771458db235d3dfc08e99ab366a072312ecc7ecdb09b02cf22c3aa3737f"}, 0x48, 0x20000000}, {&(0x7f0000000500)={0x27, 0x1, 0x1, 0x1, 0x1, 0x20, "4fce780c6e8ad35228487e4cafb787be1ed190bf780d22d8d8557322dd780a198c72f769b3038802e23ccd1fb3b0ac431e2e436134d0ca791e0829ece186de", 0x1}, 0x60, &(0x7f0000000580)=[{&(0x7f0000000680)="b648b12b714d6979b9f76a0cbc707dbaaddf92cd76f22954b1d32b4169aa923ad01d5c7109a5c2f4335d9bd77c6a38fcb54f8852c4ad00f54f97e914227303ee272cced805012ee93306d99512b83de28f00808535c0af54c1180ed81196bb68ad8dfcbd86d3472efb4ae309e03640616518f9bfe74ff7", 0x77}, {&(0x7f0000000700)="e534a66be83afb644e96ed76d6a6814a62825abfa6266c73ba62f935907dd5c0aa0bee253df24b7ae27277525b968a95ead88729ac2a9632ba558472024d34f6ed4cb4401d321195d93d2f011272eeccd54bc91edbf5288838a077c6972d8c2baa3d0765449a2010c90c69fb00202d8a4fe097666736f3efa7faec6c0bb3414b1f1ebb31c14b91303f097f38c779948536421d6501fb12bc5905b143233149e6210b42f47677c0a81a7d894c73feb44e7e4dad90c692f8726f0482132012338ebe0184a2fa11b89496045eb7d6c2875ec4", 0xd1}, {&(0x7f0000000800)="4bafc16220be87c3cf488a556def58289a31de7eda058eeeeaa23340aab9a0107b7a78b76fd2c70f3a1fa86048ab38a20c1b0e32ed318c3ef464e44e3b1c926553dcd0c9ed9a5505f309c9ee8526d25c4038527f99d3dbd7d26aa7aac94dabe0ce11ab3a39ad1c3ea6e0c6a12cd8dc5fbff3d43f7432885fbbd31214e03ab53477a1d005383bb0f97e9d3ae3345a88819dfd9b84c1346e0b7ee9a91954188546b89236c75ab33c8b75e6c1bfd036ed4b4cba85108d26c6cb2381ac64f55fa950b767adbc44458850d80ca2c863fd42b0a73854245a3aa5b568cae24f1a77e0844f174e4f161b3c5b0156", 0xea}], 0x3, &(0x7f0000000900)={0x48, 0x10f, 0xffffffffffffffe1, "c0633161d22035546c7330c1be83e5e495ae654805f06a85012777abd2e9f91138c1434cd7fc149818ec8b5d6dd305e114f7"}, 0x48, 0x10}, {&(0x7f0000000980)={0x27, 0x0, 0x2, 0x2, 0x8, 0x100000001, "34e52531b4d956cbf7f6bc735b0621f3fdf55fbce4147e1ae1801958109881bf69c3d825bd768a7958c7356aa211ed0ec2ec10e2bc9600553a586df16fafb3", 0x1b}, 0x60, &(0x7f0000001cc0)=[{&(0x7f0000000a00)="3554ce2926cf241f8546b7b44827c36a0f3e242da49bfcbe6ac35f06aa84aaddb1a9cd2a8ee70c7056a9a8be16f87751b7cbe3ab38cd70b5a3514114ea6dea794396817589624afb6f9eafc6608c9d61dd5cfbb26b4c96570efa587e46c9ea375e192285385c218417da08dd4d67e70cb81b2e2cfac3e601ae50808e52f7a0fea370ca3dbbad5d2a339b8b22556c8113e4d0b0842d1d4282a8645719", 0x9c}, {&(0x7f0000000ac0)="10d894a6dbf61f78e0c9456362838acf4d0627b8d94d57f1c731a29bbf6825af1efdad5a85d43b27ae7cb8f8b20f7c649ab9ecb57e7f42a3907660ed4d875615f3fcf5e70e0843b3cbc2692264e8a138ef42e82a8f44a5c2ba4d566e25b2efd8a432436be5ace6d4940141008c7a33feee7b8ad0a9d31c309913a4ab1913f480794303e219fb000e43a787", 0x8b}, {&(0x7f0000000b80)="40d5bc2fe5165ec60bd06eaeae9d2f86087d0accb6c5e95343660ce08595dd06768b8b3eefb17e467bf3269c2e2fc92730635e28212211cb063154f6afab267f9e36d8ffb1911155aefb1f1ee0544ec8542a08ecf89adee2fa4f7b704af60efad046b9a55c42e9f81a15c750268d31", 0x6f}, {&(0x7f0000000c00)="ca8dc1a56e1f7566edf700929d1f45dc6808da60eeb0e336f776066bf08b4a6235a398c23a674692801754f89375bbf4bc92224fbf6bdd6bb9d1d613c5bde81d957e8b1164bf9f78917b65d4c338ea62206e027e5962bb13e958aab0d6401c6ea3afed3816b46e5ff9a2d6960b3bf1dac034f167b3b9ef3698db2ec8e7663140538acae572464305da3d2397080367fd28739b5bc41c3b2a9381ceac6b5fde2cb6603687ad4cc9691cbd7c709aad12439f7d5f060f32dbc3f31912c47fa9bd28933d2873437fa76d4b18452175e67d6f5727c83760473f6fa22e1361730b2d2a22e1b6b15b5e3ce495078f758afd0cdf4ca159a4c37e891bc7c031139c3822e43e3033e8f2c45f827d60c3bfc53df83ec867ee9e0169d1e1b2834e0e8cf59e8ba5533f387911351b9319fa1d46f96997ca1db050de699441566618034814040dec5c90c6bf8aa8991916fc0aae50e03e89179170e21544cc96d3fd0e381b51dbee304796253558da8cca21f01339c4a63ef1b515f0ef02c550c0d37831cba41789df329ec1398e2a5e4758e6c19975aea4ed44b69bf0c685a96ab48485568bbe131b6f9143d3247ede5f4337cfcf478065a6a21fb13c916e2bd60bd3dfbf60011b43b0a272f4dfc197881b54c50b23f02681b8b344ed52c49de42beacd8efa72f0d16bcb197a423f7ee6d59a1ae24b02e652c6cc0f216a0d5244b52da4100689e919581e8d16c2f028a845c6f0a3aeae707d1fe467393f52a8198ff288ec6d5c9df08911afcc700336a933fa340c94d563a504d14acfbf303ab1f94f6c0f4d939fb7154a2fc063e4bcc6b10f1143e44ac791b9d3b0b7a4be61693d893b8c8caacb4bbc008f587b31c396669a2d7df7bae3c8903646096c50519335127b5d9cf94ad6b4f07d378282dca5b867eeedc060aaac2ef1099fa448fb345a1ea4aab60b2c30ffa8763a6957010e3f78bc6fb9ab2d169ac9f3fee70ed688101a77eb3deb2f52deb9d3209b8a11016d170ed09920350dab635c612b789cc65103baf74c777bf0672bf987f32c01c07c33ee358c22e58b2c2fe855a4d6c04c9340faf80f02631cd97319d88a86cbcfb44fdab654a5074920675168dab50a3b6dc570adcb41eb98f163640fa68a6aee3b05d8065bc4846527e958ef3c1331490aa6056236b7b619565f3087b35538ca26844d78ee9935f95bd8c9b9db2ba4edd94d473427237afa7aab970f39221f242902c734ca5511bae9be6a61392eb512a4f290cb089c0d22010a477b24ff694cb17c0be5f56616fa27925a1178d8e9f5a8017bf2faacbd3a72ee7bb238be5ef73e096e84e84022bea0e1beba06ff2bff1c77930e4aa7dc74acc0fe4cd973d8f87923533b927bdde568cfa9d5e6ec4be57a9ee2b2e8230067ab6d9ceb8b8abff5ac139c30a5f065bfa7021cc00d9c97b64401897af3a03e551c6f020dd4823604846210427874a8053b8bafaa47b65dd6a2940f3bb870e8b7ec925c302a713e258f32d0949ef1c3a44b3551b6d3436f95d90993d3784b95ef3141649b2ebbf906e4248951651c097ce666809a940699edf8ca955301d8b38d17e9ef8ba904d4eab4caf1f6e297a19adee1e5d661e23caf16b2ee349068459bcb998bda646fd7e80cd9fe24a06c4112f34cd907ac5fb0639b1d8b5879951e2b455753bef5359e9b05ba45603cc23e770e23a6207099279c817a95fb2eb48bdebf30393aecca96919a4af58ac92d706dabf2c96a9c2a070d0af581ef35dc5291d6e6072b58c292044c688ca21392d02f59b40c413387bf1a1350bd533bd22165681d3d85180eaad62e0170432520b6d91e106ee91baa0b461ffc4e4e2ea8c787bf0fac4b3558b8cbeeb164a95bee7d941b48f388a9c6378f2849291d0b1ae22bcf45bc44e3d504ebc9c83e20f65dd7c21f19960972ef078c47de1d9854c839e2f0ff3f0b2160d54e3dd281e9f80921d3f56951c941b33f41af2478bc37ce3092fe42f18b60ccd177b4efb849f914cd6d842488c7ed96b9e28f123c35db5685987123d38d5ce42ad6e7e89579f2ae8e79040e102ee99a2378e94dee6c84b6bcb823a532e04290be519e48ae6050406e759d29927368a2dc3b842a15fe27d7507177f26eee6a0676b88916da77564bd77a2430f7800341b83a06c75a874fd1cd421dd4664500927ffe2382d5a6945d91c24626d84485440dc74ec20fbbeb019563991d5d475df3a3846a7338e0c90b8e305668e59238803d3369d0644dcc5c552801b8337f1268bce4a2c579cf0e70d9892deb06cae07b8c48ed534232c034b2f43221266a8ca8f38cee5820960dfdce756e9fa986c27f3778e24d0d3a59e1c00d65529a7b3b7fd9ce7380b916aefb727cc74ff9c5ced062ab8148c230958f04ffaee9bfb783e79d9d071863a152e4d36cfef2be6893f6d222a17c3b9751a53ba663f39ab933bd84d842da43d10425519b9a087b94c27e3fd4038d7d3fc896db3a0f2904f7e3408be915824eb66b69e944bd51fa1b4e1a6912d5156e530c74771cd177eeedb6a1dcbdf54b2797498d48db66c3f5d7df272e0078b97e045b1f3c50f38060c50e1cd5a711444dd9e85b6f40566288fa726401ae79eb636dbd1c9d64165e933d55ca84899cf67377df9c8bafdc0efa6706d283cf356019b5a22fd541a76a711ed88b52ba4a5e966853770dd105a10b421597ef13883ca64e3fd5848d841aebdede7b4a252947f66928d775dc5659da4342720e02179d9dc430912642c18494dd9ad2bc2b73bf68b98e6d51231845f231a68a73e47c25b1b7698bc7c36b3dfedfc9684410f5236634a073793110b4bddb6d72ff33fdba967ba035b74fde8c93dc6094f6f4c4bbd776549603605e97f1f28d9c231afb51b82a0df1015a6891de560078f151fb6a8e61029bee7b2ae1a6d887d91ac50be4b8ab4e06466b8098a338679d79cc49271acf44c994da7985f4c967eb5759d2274374b038cce633c450f200e91c8bc45462b9b99496c1940dde977e0d058a51f77dc249acdfa9834353faf985d0a7510a06ad1333f21c687faff663e653a17c5a19816ae8daa7ef62e86835b91c5986c01d705acd05dbf669ac235f1baeb4f68d94c2c67eff77948ad8edacfe57b1c7916cab350a1a542dc74e7559261ba97eb6f229ed406284453fb07eda9916613c9dbbbfb43800356315c3c05e00e0265d035dc0156081df83aa30f85b464072b4b6d1457612b17f9fd85162adc23f773c87eb6c055895b1491d4e74d92a3a2a335ef20a0fe05dff4c26f9724cd39b92ce3601e0063e42516fc49bd9960bb25d9f4eb5bcd19fa2e173fc2c66b6a7717c59c666e2652003a4037d7cd709f2d56ddc20deaedd997c8a382de09f0d6afbf2a032a86f2e30b0683883fb94395bcbfad6798ec7509188456c791a322227864860cf0e62cc5083e59dc844be12388e65e5c93301dcd929300a785c5bcd37679644e92ddb8cf7311b398aa701eee4a54aaa6905745f512ddc858ef1debf2fce8c11e0470edb0b4cc2bf9fe62701ace16507141f45a0fb1267255081c516c9ac9f9ee3ecfb9439c5854f4ef4a23ba8260a6e536d85978b3dd7385eee726b6948580f517a02d69d54720434b6ec3469eeb337a54079da567caef73c4ff5ff4c0fb750e4165c95d6a4c83c4a05c2db91e491b6346ba253806f52062ca0094b953faf1836c955f188ee806e07d98dfbad9c3637303cba796881623bf46f0a742c0cd0be944beb9fdff4e51b1784e117febbf65d2f94aa0b1dacdb49df5b826e5321d7de8e25dccd97fd08de10b182d09bf4cf6f7b9e532b612afd6a9192aca96a92608d293ee33aa9c05cf55b6b5d44e9c32beaa7a3e67023b9c6291721260ff36ef642272c4e203efab01fd988ea6390d61f96188e5a41cd27b4416e96490d554d5ec021968a2e7ba302ca0eb9b77e3222335fbc5346c89914bceffc7253bdea5c1c97021633039602d162104c9a71c21a10e97cfdaf0df1f1823a52a90f1250136c6a29ce2eba3ddbc2eda7ba298e15ae4c540ba3cb94960c07de000b64c3bbb7419414f48003d55ff3fd3725fb4f8b07f365e97c4068a2088e59bf6986503b25d8bd239d42130e1acb7f8a684934af573f2fb19e5accfcde410b1589d0b4b391892d5f0f9ae84d6f1ba0e5b8f18d20b0c025944af67b6f7971050a77682a41174e96d65d04742f052e7ae7699b9e7fd76f816bd71c7db733f989d6fa78c740dc635e9316d117218bf14a24ac5a81dbee456fd0ee7de0a984672a3a0caa12e9d837efa57a5babc5b2c57d862ca9829bba3328f322726357abad7a266986efe5c9671c8d97df3efab54d4696fd6137633507869d7675853173885f53ef0cca3f4e2cf1318bd9bb59b3b022217aabbbf4b61a81896e6e29cda400136f6cd0f23bb54c2f400638045a1c5c56d2a2470de9c62695029a8c0c40ac9752ebaa906598e31745e0ec53debd150cc20fab9eef3eee5c7efe9d789890bc1107ce7f67954466a724460e343170c51b8b11d86561984448be9801631b58a0764840ee0387cdd0c8f7efea3c7f6af0e778de987316c6784f7fd291d76df6914122eaf1dec8ab4f9604cc5676fb719c4e100db7127782373993f23d21efc3fcd5d0a6a61baea2b2ccd395acbc14ddb26278dcbcdc4606b948b28ef9a6bdd6c21d570f32d61315fc475c66d75d1c24b4a108e583ae70b211b40ec0740802f7c1de6567bd0d55a65a772eb3eb97b47fe29262e83e529ca05fe5447f8ccda7e20df51fb86b87000952763b17139ce9cdcf6e0ecc27eb03156f14088287cfd118160c58c92660316a055e28ac359e220e110fa79e851b5280a9cd944390f944cf40505f6c1fbeef02ab59854c2c57b57452aab9c2f80e7d4490bbb3c811a3cb3d78a41c97759b2119dad95cb21904387a4b9dad6d3b3e8f8ec036b2743052df87f949a6e264e9ae3b9f35731d14a4e587c111cc8b34268d1fea7f47a3272273dab3a8649ade6bc5080c6498a28d266f5fde9cba8998343b5f63d7611e8b282c8e4fb76def44e71e5d554f1f10926dd6c3043d04c1abd155eb847db3348354154f1d3d77035e4aee4c166f4724928b298de90b0312c23ee843ecca471d30cc4039e70ccd6e92503c75d84e8bbeda379259a88b7c4b61ee23ba3c7b6a5e8a77f4957a4995775316d1cc7c8ca2a061c5c986665ca2552b5ec367718cfb9f21bbcf9597706297ab4f5ba0ac9aff1f1c4b53f8806272da17dbb2a51d2de2f4bb56255a74661a2593eb4a3290bffbba0016fde799ce77bede8384e73f6fdcf63e2544e5119d8957fda0d673a605169fc70e0ff594bb59528153279c981d331095ad35a299c9e04cf3c96af4c70fc556d7589338f63fb93cff40040a50cafd9a05a87e0fd526dda98c1f010c275bc74b5a0a931c75c89506625aad96add422b0e7ff6467042728f69f737ca581894a09aa7ec6b29e2e4b2e15d5cd2586a9618546814e2662b9b2a92d70e19a10bf5ff4da45a9f29c5fe8894bd957f6be8bdd8465970d5577ff9aaf227503200299e141bca69ba837832f1926c4c9e2818a4c16a864bd8b65ccc4606380051edea03fe736d63ab128f959a1e947f0ba85f01a8bedc32e61eea01ade6217e4051c5945f691a523f4c9833242119600ba4799418389d22f14f3f1989d1e10ed8a45681b1194613455f4b93c0e724f207f413b49a6990cde5045f42779117056d3f61d6960684b21874d528bd85b700efaaf7ad7d7f9a2950bdc12d62fd7205adee4ad7d179e3d22ca", 0x1000}, {&(0x7f0000001c00)="9418e71caec242dacff89d3a928c661caaf9ef10964dcc20f13755cd872579d1b25c1c2d936625c92c712c1e59795a02c82a9adadeda8a1f4beeabb5e02dc31d434ade69cf457271deea1d06d3f9aa0a4f2d716937ac45dd9c6ff23b5b11927cc045807760889db5cd6596d2f6b9e6ae878e631410df52c8afdea1d1f2a69768df86", 0x82}], 0x5, &(0x7f0000001d40)={0x10, 0x10d, 0xfffffffffffffff9}, 0x10, 0x800}, {&(0x7f0000001d80)={0x27, 0x1, 0x1, 0x7, 0x7fff, 0x2, "637d46e93aa349535896719647c3fce2775f1641073dcc63f7cbc65750e75eceefcd1a405a65f2ec045fb2b8cf3f54c4157300d81224b68da596ed67781ec4", 0x2e}, 0x60, &(0x7f0000003380)=[{&(0x7f0000001e00)="8a2fda53d0b5b25c079a4ec0a3bc3de323346836da91b9be8f54c8587a9606ad2f2748c06f2b4d17ad2e6a003087e58a6f21ef591da52687215a76ea1f04c9bf564fb8133ec86b9ee52fa588b951972ac5b654a0c6cf69e075f7a139bd39f5b12249c13f10b1871e00e480688e836f56a26039ba7260b9fc1de211e8bf78e35d8494e731dd9c63313a9789b34df560f0f8556049120cf680e5d4b0471b98b45d6aac81a67fb3c5481d7b55e695148dd0d594d686190ef1d0a6d5ba62c77476092d71216d77214a22c5e4089200e30806debe6235f6aa44010156ff55283d14071520c420f83a2f4f8875bd34cb4729204df2ffcd963156", 0xf7}, {&(0x7f0000001f00)="31cd46cfa3cad9816e1920a98ab5c55feb38fc2ebea91d0b7e2173f1efc5a0e74d026ad1381e713817eda5454de0da3ed18f11ff13a2e5fd751c7039809ba3eba34cd46098d20612bc747a3279163482d1d54dc219a75fcb33618f4316e8c57dc9dc23a0578fb9f47339e8b9aeec17a2b7d270315a73873d89656b39ffc21e6bcd05729fe350f77c1c31eb178f8d4c6342ab3e59ec963dd6de96b05c7777420cc5b6d5a2f9ab411dbb72a393f076c6c657468e32389e885614b6d1d3f01cfcf56359f156884fe8e267", 0xc9}, {&(0x7f0000002000)="cc99855258448b88c75d466dc21320a9fbdb355b0217adb771a1b4faad762642bc95f608f2e97dbdc5dbb5252ad2162c0ce961ed1992866c298ec746f7395deb4963b7295a4ab885163c280477bfcd14a7026d1842a6d473a0781202b37d146936edd23dfffd8e0aa89e9c163dff6e3e8da41bd0a75811ea77f200a744b02debaf8e44b117eb7c5ef91626789d0024ec99f71ebad33d7c", 0x97}, {&(0x7f00000020c0)="b010318fa5873244f672f060cb8980e0dd3ab2ee5da91379726c7c6c6b104c073808a2af85", 0x25}, {&(0x7f0000002100)="978717704cd6cd35f9846ec0186b764f913d17afa6d92dcb4222aced8c8ff2d578c7165c72b24d6f27392370f7715b3973fdd1ebbd679104c827eac1d11753c7835a0f1de075cbe874c6def2481b2283f78595a3346a2c4a00abbacb01aa45fd455f0d70f28bcbfbadd191ad500ebf384eb316dbdda33198557a391fd1ac7896e0d1327e696e791b80b65e9cdbcdc076f93b335dfe15ac7ffa8d465576992d4435f12532fd4b38d556a87ef1c016b20b147befd393ff53b648bca6b137021f6679bdf4a446658ddd32a0134d9a447dc41c06c70e", 0xd4}, {&(0x7f0000002200)="324b01c3f0a7e6b721cd764fbc7ea50c39abc8cfcd1cb0b11879220a96593e63365bb8ff4e73c9db02ef605a4daa4dfc7c1060aa1e0618cbf58355322b021498aa2ececc8b807d8ce6a8c8a87299807b26efe4e9827721ed1f35ec618d94264ed5edc6b6f318e4305914e75f1474a390d8c35f3baf274a37838dc746797beae5e76bcbc5bd5b0e7907391385d2f8e5dfa8853797e891aa985aa175bca21a35a9616df45812ae68c3b15229c479dd33243263d1f3028f33887d4b87fccd27e1c25fcfa4cf9e4104ec648d107f8d8ca1899d74dd41fa09699742291f6b4d274aaa03aa760b", 0xe4}, {&(0x7f0000002300)="67e7586fa10a83e1bd10bc1892fde1d1844d2f2c50daaa0d36ccd1b66cfae70a87f730c727d32f21599b6948", 0x2c}, {&(0x7f0000002340)="c86867b3cbc8d0e468ff257a7fd923dbd18099c41a4f67f4479657cc6ddefa55158c73381a8f937b2af5", 0x2a}, {&(0x7f0000002380)="e7f402605263b645b6a5119ae442ee91f7a345f4442880a179809fe76245d6fd854b9ff41b111ca920632c5e51ed60afcfb6cb0168e1768e43d28753dc81dfb4dce0fc67de5ead940c1a14deb6c552b81be1ef3a86d5c784c898772a3578d112abeba8e38474219c6ed3698c1914cc831888a718c90a20c3fc254ffab03745c528fa8bbbb5d4a7875000a6961aae9dadaad49683c2e75c26705c13a622c1f6cdd49e20980cfbb4ae9488892ddb40b315a5b07b08b8f33a2620a722b8e66184efa91192cb1cb37dfce30ffd8259137cb0e8526dca97c2d8486e29025b312e37061a63d5cf7f3e0294f801baf516654a5e4fd682a1cc92964cd02fca56c8db95aa83b59ba1064c8e939e934c8820705a903d1a9415adeca7330ad3abd9a9c72720ddf867369c2ae0a16ff0cf5c66085210a84e1b6d11cbc23522426dc3b88f50960a88b51a7532bd787da42dd5fe297e5cc43c8b1a6df62aa318614c3fe0cb5efce7eaad7bba0362ad2d9141eac4b6f4f8028fd52a5aa56241d25a34f6203f63a170df3e9b31ad3a79d8e484646e54c71e8987353be3ff0b2a141746201205948518769a53ded060636083e1e59f07a09f530b350829b6940e4f0a452b4711e914839a098eb620b6ec79496c9b951a85b7527a05955b4f3cfa486a0ccaaa3ad6db808c220c0c9bae3dd57ea98fe7d3b7d57af8a4cfd9e8d645be186d071c61104d08c6e125ce347aeebb713a4e3886ec52c315b27d728a99bebfef6df795573d2b47a9147b2035e4d7fb32a7dafb0262916966222f9e03deab6a3fd4375b8b82d1eacb2aecedaa90dd858937b559105cbd7405ddcaa6e86ad708112057ca01896550c79cdd7d243ce04829fc3082cf5d55a02cdff1a43ba4db2ecd78a32f9bb37a44a284f13c774e83a4feb986e381ef32583ce1a77ca73c7e4c5f3861e64d08a3fe85ef14999094184429f6fde565bdb06607b02029a55529fcd8ae165e711a4c8bfbefb97d4b5202e1b8965e401394029d2bb3d398d7e4b211c8431cd3dadfaeb1de36bb6902d78dfbef01267947e780b0160fe4f368c21f99e824cb50dea08c739a90b1cb8d976acd47454948d077b6fe83ce9a18085a9a96dd2920b0bd75956455e1cf30ef877dcdbc72c60a1107257eb474ab3ef87d5201fd8dd80832087df53e35a26ea098d6ad2434eb9da6e9d2a76c6df77f84f6600c50e00090efbbdf7310a6e317357b096b559940c82491c67fe5dd4aca245846b4f402a5f8a9ef3a4d07627b1c84dd13ccfd29deab81ab5bc95f0f95bdffad71c512c171163317fabb0d5656da3a20b9237934368a64aacde08a9f5d0ac334ac7a9068d7c94362a49a14836b238c5382bb3dc273cc53691cdb61254a5fe08c255c16afb79ea3b505e2dcc6e581d350bc97962db2709af86935e71919ba752ceba4410f142b0dcd00f74a69eeb554cc23a37bcec4d3f17ef398a8a3ba675f9be77512738c5a32e5fa51071185bacff4d3e30279bf3b3574c8106aea3d1f6dead0e7d9871c01e0ed87b2a0c18047ed3552d1aa8d74abc0078375990e0e8b44e557ee1a2c514caef3f19889923b2bfa73b2d2469e18867c417ef5268d186eb1f33bf8d94c2f970650d86f9460fd7faefc53795bcefea85a3a58a07037017ffa304753a03584692e539627f34cfd3f4ddc32fbfdc81b8272f18cff98d8fc3e451229cb43d1ff3714cafa947c681d8147a47dd676c1eba6269902d1790527a6c868815033e1f20e80cdaebe5f5262c2ae633124159c92388dd60d41c383438cbd519c1ccff71300793ef7ee24fbb3aa4f8d71159b3ff579e9bd3308a86a93930a7dc8fc51922c35ed3d09ef87622105ba617d9f0c71b3a0ef35822604daaa5c9f82069c271e4c9a1be425a746255440f6fae5c0e9000064e9619d9dc284b5e8090ccf3bf676dd534c4d7a1e064bd99b22afb39e33647522c464f2756623ab4485940990fc674ed5fc12a5d4d7f5be07f52ec0f86b9f57419f2cce8de3409ef6fc01fe500634d730b1d82f97d613a5a117d0dd6b878cd32b5300fb0294eacc8136aee982dbfd580b3d52659ca57cef31ba4f7d7e64849a23c8da4adf71c73242d98e5871d91cb9949660e70a33f521ab83dc347f79128c74badc970dcdf50f616f202944e687b2c64f87911a97195e7dad76741650058278aa461e818e820577defc08017d720839db8e58478b138e1fe68d3806bec55f7f9e0a196b15d2c10192dfbe934ec30f5656f4175eece95b7dac5b199ccada8fe79384190cc05fe0ca6de19f27d0fd2c0e31e959e807b03a09b52daf4b09ba4acfd240e523c1c0b239370924c512c0bfa707bfb6f986ebde7a3959780b0abca2844ac4220fbe14142bf1c5169a7f87a1372f26de6f4e64878c2c4fd2a9dd7be09837354ec9a5e49fe9876fbff898d9d9811f44988494d016c6f5e9813021f484d54cbc478b2abdeaa024f54856cb931ba074a14ade406f46e13e2c07b440d7c514cfef01574134741cdccb2fd5b5fe7cbac750038b59cb355d3ea21b260c020924b8dc862af39358a390d641b8e84f3d9643a5da9be9ab034d1b5bd27ec369192fd2de5fd24db2b9568768de6ce7b1d3df4d4cc879bd77947065c304d32fe1fb9d2d6336dbe2307619ce4977e993deda08258b723e0874092f57def63a66c57616cc65f101529a4444877d2901dd35ef380ddc2f6d85e2c66d9ab4a93036c561aedd89e5bad431477dfc3ff6a02a5756be686f6b693413550a26d786009b80ec8a99ccc4a1f4034d9098fb8ac81fbbcf2ce5b25354147f80c1983a0df35d0dfb9de611b9fea840159c5bfe797d9770ca80e8f2901e80e8c5dfcfe5edb3f622d5bbcc432e2e1fdf6543e23d7d0de8170876ecff86d76be6d68cecb937b7618829cfbbc2539876264d6b0b2725f724640d47761d792ca6e2c512f20d55a63c827306718d844c621ceddcdb74cdac9b7dfeaf90b9e892c86f5e3d32bbe7577e73258ebbe45a966eccd904908f07ea5ae2a84b24bf7ecdf540ae248f4360c8ee1656844f430c01c00eebe82b60df74ad6ffe51a424ad7c14e0b92bd2c083e8c63db58e422747453f47e4584c5948f8f3461cb7a3f5e8d2a430aef4d916dcc17aba3eea42827c2cc814ddc2ecc5fe56fdc78f1e74f2b5cb512e0d02be474794826a8ba16dcad51515c7b8b7cbbd0020b31cb5035c9c0b40ea86ba4ff5d40a833a3af414450a014f339513b6a5e6806d3b975904e1abb27d92a66b9193b4e65a89c8af3fac3bc92cbc0ad05efcabb2cf903a0a48145347e8698cec42558d5746eca83a5903bea8a3e99083ea083a64203a5822e7a7bc6cc5bba9fd2c09e2280d836191ce9e91112ac73c8b3a0961909c56fb2eeddfbf6fb461a32a17a7acb613ec64066028abe971614de33efad1fc48182cac9a292adff6acc45b0644fedea3dec69ed12f03f7fb2fce374193b02c6b999a1d02db0ba004bcd4b74a1b512c78daefe34a1bd9d0ca021b497d3e50ff709f54c36375b5c184a0d24435a0e3ff641b74de5b8465f307669573947fe74825ca71a2997d9d385af8db34536c75ed37e515ca928c4157df713204b78eec7435db90f85d84b1743662889f398d2ce61bee2822f3d1a64ca681df37048d1e7c061658f595f2ff8fddab3ccc6899099f0fdd8cd8f05acd52f0287e284841ce0befb7b629224b93dd298bae7053cff6ee5a420f13ef2bd5ea8ba521eddf6986f011248bd87ecd25697c119ec977f44019f22580caeab03257e5daae0f363ecca3da78faab7d7da1d78f542760d64c507838ca8c321e27ae7641129aa0367b11aa7a20dc762e8a1896bf6a8e0c69fc7b08abdfbe28d8e735a10fd196d847d9233c865a823b080999a7c50ab03fd9c09f19ee86f6d912a781b681928bbb70958058add41ac6828032e207e820c1455503cf0f627f00e4c0c4e277a2dc3381acb56ee17d02cc6d877513fb101f27ddcd6badeff0197a3bdf00de3d4b404a8cff8c82e4e37d4697e586719dd58ee2f54bd4b2ff70a1f9625fc814a4a564f39825992a522b928f348d650e3c76e3cd1e1c4c52452aabcb6f2d4de211be9f6516394f6429f29c13f59add537d3211b2809450e07ad9d4cb84b996512587e1fcc523a610a92d2fc9de3df71bc071c7f164c396139083b353ae3b2645c120d7116911b071b291ed74d9da947432eb10c7a919a41e2edbb2aa14c09c425dfcf5c915cb8d185fa60dac079856e903b3fbad7ff38f3629ea61e363b3f20b0813eeef3aabbde7321a3390033c86786345ed92ff6e7423367372ebf585782d12d61f6154f6816e68a97f82dbf061c89f4c59264fd2d92d48d1614ce746583f1616599c652ecddb4d44b47cf0f1a1857f0f8f75eb70fff19e58c1d9cbfdd98ed833482361dc94f97d71133b76ff98230d80d9b8600d13d00f68f5251c75e445806f7a9a5c0a91822dd623094f21a18445995ed9f342206b52511590e49be684d45d6915409e1056f7d2cf69be834974fd61534a95cfc2b6ee36052023ac90e7433f9a0f3233ce85ca46add59f42184fd06f902ae160ff0bb4c2a4dc9fafc5201953d8ef302f0ab542bab331783a291954fbc66cbd55e4803ddf71f85c3aef3cc3b2c332eb4c9769af2396de60058b825f3074c53b8a23f6b2be4c51b8b2b3c88bfee6240e1019ef4413e9a1760e1b3797a1e2895ed0ff2d4d27d258691092709a3524a100720e5f87cb0c695581ed1d4ac756335d0447bb61431dc62471a723170bcbff0a6bc8acc5b81e435afddfe176f8f48e7865aba45cfc71f7fc3ae20fc5e9b35b64157bf54e123463ad9189e055a0965868c7b8807247505ee950ffdecf85e4ead87fc4054ed098ac766b0d8459633f5e61145110c799cc31c98698ee196255eb702ffa15e181c639ad89bbcd5e260cb82c7e8614af76121c02ed25290d70d5a76431c428fe51d59a777c0242522a0658838110848f178637eb0e8c4fa035f88c9064668ead6da94f355455b0ae8ba328f5825f27ed6276451a864a4ca23741ddd6ecfbd687a032262c4c26e5b39bc5903eb32e48caf7bdfe62135179338c6af755ece85ed45bd3d9f0c0f9952495e2a4958fa9374ae9ae701c488cf63139b690de1bec7ad694d42103aaea0b69059eca6e7f8efe1f38a414c9d22bf2b796594985fad4144ddb7f4ce85d03815c1e10022d3e42c4c6af5e1baa05d19ff7af3dfc8636a306c526c4414f8ad57eee5ffacf5bd871635d10a963a94ff9e5b8a187a13bf50ece81dad4423161a9a56ef31ab5f98400097dd7a6e3af92ce3b3cd9c169c3be01b4ead27f613da4716ac36c49c9ea859c167a13e1ba355d01d7a0bb4046f794d708575e8044bb348389b1f4808d5c531a54c5b28dcdfcc53c99ef489ad65cc407296e9a38168732d61bbc3362223ed6f8af982c7cd2d5f26d40398b8bf6c0496971037e2835388c2ca574faf9284d396c253e45532f14e0fdbd48e7c7cef12cf8585be1c70e76a7caeb26a5fef21a01119f3822e68cd3b77275094f2aacdb886ed31209d91b23e409c293991fb8198427223c1f34e95d7ace9db780bf10753c9dca8fd319b49d98231c664de29b01cef1044ae2ede8b2f7aded89b95f053b2384361b7c54036189306fdead30ff07e69a6acbf3d2d07d13716f8f224e7fca75794e1cb23a5375397223dbd2312a317c3e73fb3b3168b23d8241f0a8572249af8aebe612c0572543e25a3be01aa15b48a49fa123904acb53239deb06e0f0bd5669fcd58bec3b56b7929a", 0x1000}], 0x9, 0x0, 0x0, 0x20000010}, {&(0x7f0000003440)={0x27, 0x1, 0x0, 0x4, 0x6, 0x1, "d1cdf98989b61344c4dbcddb6d868a8cb3c81a92e79589836a90ab48eb0fbd505054e6bbd126e195c1f46c226883d5de16d8983f6b4813d9fa9d2610cfe068", 0x17}, 0x60, &(0x7f0000005700)=[{&(0x7f00000034c0)="745d3d4ffd9175a402e2fc7d0ff924aa570ff2339925549f1e74e8b33d4436fc298f54551dddc0b6ed48c7991e04", 0x2e}, {&(0x7f0000003500)="9d0316f32784ce84c922a46ec0911dd68c7be70637f7b5fadbfbe7464a40ba2e8095cd8d9f257cbd0d393ffe7acee55846d969d218cfb860d4820499c07c81f388bb70a0eb78b2faba12e8fc90756aa61f289afbc2815597691626797666c2ac75f9929006bbd974bd60e7d37c6e9bcd24f2cf748165c4855697c28a1fe2f4df7518204fd55bc54cf019790ae128fc514fb0d5", 0x93}, {&(0x7f00000035c0)="85dca34fd9255809ce7248c74e8cc15bfae2dda7088dcd20b5924fbf0380f4e3c26b81587ac280f3e8ae146cdcb0a0858bc1acd7c570c5bc3d1e05463ad6b29cc5a0b1c87cd4b8f30540c85a1ad2384825deae11272141d13f0e04a71457dafb6816819876cfc97b4cbadec615b6fa540ff8c2c78d81ea80aad7a805120d661dd45f56f29d34ad48dbb402e04e0f8125f0103922fd37067a349d34fd1e4c4e4db09ab95bd7c913182f6b7d", 0xab}, {&(0x7f0000003680)="3fb6b4b3d08651d9cce787a82f78a175452a00f0b3d57ff02e655094d7f3d68e07472cc2883c31d4e1194b47e3d51de488b5df85864eed0c7c990ecfe3d54048cea2a6ab9741c4ca93fdbb88943162b608c8a7f8a474d7dc008bca394e3f34aaecb5954ce02448ee7a48e8549ac66c643a92a14cb73847a3dd19b95c0b49e25ac47cf6aa174e5a0f1a43362eec5b715068427b4bdfc4abcdc6de8bb08cf73a06a61597aa3c717fc1055e6e074905a327f53fbed2b292772bba09d75bc37895535d43eab8b967d57e32a1f05de27bd233381e7d2aee0e9a60cced339384d1452c23dc46863469272c6804b5840a29601e9d0d129a94121c1e7b47009fdef444f051e674a250b82e448b07574e2b940cd0b85d94756abecf1973eaeb783bcc7cb8696daece757df8235feef66e6a636fbe953f3ee1bc6437181b2c590675646beb7228da5c4393882d0bf767f3282aaea91be6715e0c6bc3c864537a3d7b1cedd357f34159f25e86bfd8900134df6d68cea6af37eae34a3b6e67f1aeaa000fbffef5404e7bc075982e765a875529303cb1ce45e2ba2f6ee61d9a3a252b0e617391a03e9d4098d0dd24d8a7078702dca70f81519b734e8b4aa4190f2ce14f10532fe9513aa1b0599b05f8dbbe69aa827c15484006553a12e298ff258a9e714e5882d3bdaa3fd6c5d40b25882b5299ca0c1bdebfa1e638fde6fce45b09f54c65443256e633f149a53a3d604d860ea485099cca4c4f8a24e92ffe0d0654112cf2aac2ca0c6d8d38314b5104f395c22041df891e86420d24681a2cd1a8caab704ab27e40ba2f4f1ade626f1f9560f73a7282b83ac0d974169e6b52412326d371a48dee60cf9a41e55e4590afebfca9b51d9232fd58e4f52e714fb4242924d828b6fc6f16d271c026141e1d88b33892801ef448b3d4c6d5caae8115c785296b2a6a780a5375f17afbf438791a56c2ba5c70187c5a473642b46fadddb0a3e156c7368694c5169e7c97967ac5ed0263c7a7bc758ec28b9df2d9f7fc791eb237cab38ddd40923eeb1ea49421fcdb365476fae39fc1c44e09890382939ae9b038b849d3d0b231756add58b7bfeb5a536252fbf08c3a7214b9e584c1d0f54637a849873ad966e0b40509f2fa6861a0fe63368dfe26e2e148375b9bd391173e38871994666d0365650c76774c948330862dd4d5d0684f8b5355c36237fddeb620353feb7f62d49fae63292d44e2f659987152677d75454bf54504ffb577b87a9a63377532d5fba0ab265a722695afa31b978f3c977591ae54b32e245d2d3a49e2b9adf7ec0a67708e31096953dc8c0c2f795295d81393f1c4d3fde5bfbc9ccd95933ed74a4370709ca029a13b2f856db1d8c0c42f042d43fc0081c6d205e1b69cad64d767ba6ace11065e67722673d3a50761faef3eac8675f91b8c8ab1bc36016162d76e753f00628ea15ae1a76b42f0383b94f1e35104cde8b869a25cd9fa8734b2634e20768badb6693e1fc6c9d005a153cc034f21a7e60a401bd49267872a9cd585e681f99f8b880e216fdeb6a0698a21e4a1824cc3064b44735d4878de3a7c7a391a03bf36be459f689d745d2c3d2ed9c5f51b2d21ee3987135d43f0fdadaa9e4511403f52b8827d364a067cac105d847855bbf382e2b94bc28d5366576dc708d9ee16b54cdda4ce0d87cd4dd0aad9f42079a444284a0247a7d4a51db03202eaf722c674638c06b95b2b4f6c87c93e495b6a7d40c85591ce9af0f054af928a0077c09e1affb4bc2696e5ef8d95ef2e2e82ccaf6e3f95e6d10ce987eef8fd1132cb73f9922178eff50fc403cc12f9bcbed3f0ead08636a4431107be570f2347ff711b85a868a24a804fe36849db5e4edc6ed9dde30129a090613b99e47b08cf54e0aa44e25f9204aed43cd16e9ddca096b824a84648a8148c90b40ac767d921d3f4b453b4c12de4a4fc3248a2cc418d776ac65476d3efa4c9603992bb95d486b5139e5bfbe126f72b817bbee3ee61e4389d6bf4218889141e50c76245b4332af2eae65820588f583097571084ec84429dd9423ea209a2a007050a65836d05eac573834e43f28b74308b8acbfeb521856a686c68126aa990056ed3e3ca06eb01b47b30661deceeaf04f52fa0936f4721c698ec524c6fb2e3e184c31f39704e9d251a8d3320fc709e4f24e975941d724fa60bdf07eb57f575d5b4cc61d162a537930816605b6c2660457e408d2c09e7e40b2e7648c9a56823105354c51fe589c225432943abf40887080288ae6c8a8369c9431f56cb5758ae913886f90870fe3e78052e64a8a8d64a6f6d37204cb8a014b6c5d8065781aae64e46580b432a00f3f0c68a3de0248a59e2e9270363c1362853b963bf03e2ec66120014e3460e8b36691e1f6493ad1098358e2f7e02af3e550e936c321b27a4d4cc8ee0cfeebe69ff7cb7dd0174614e4209a47a6791c09bdfafba8eb06f322b13878dcf7ac9ab60c0ca7ca8abbacaec27c750754f8fdb646f7a093624e8ffa53971914896f801374ffbb4aea29f2a1480f0685211f0e44a43bd9fbed15c6affb84624c90625c7205c46c9d1546b775daed1000438e99aa0ee93fd855729b0fef5fa366e943cbe94e75bcccd90487e628fbaf643e25a0e14b745f1f2988341dbd994f18a76a7699bb5353d3db17743474ebe563c530b012cbd1169effeeadf4c1a5b762b8f2f70ff9f85d24b816ef9cb2b3632afa2e7a178dc62caa36d3e09c41abb1e820b7e6b908a08fdfe461f96e79a3b4fd1828022af22ef8ec665ac3cc29c28ea98f6e6dcd11249c3e620f4490c48d0fed7839c304be069420c53d5640517a2433636fc664751f34d168a92962a5794034cb2682a8f985e3570ca3444de0a788fb3ba04c305565a6062577d7758d6d1c8a1cd827d43d5283df250ab42cb1b86faced57ef5ce0fb641ee02c3e7de2f44d0efc8bc474c8bc4b232e4be1408631ca4e4ce3fd49b5469c363a243175f02eb2ad6020483e05a80481e1a00fb6144147e167c53a9ab3ad1d2251395f4df2bfe7e671f9419b942c0154428096db91c028ab70eb5b039bfc528ca4b6b113f92989b03579916540acefb1b1427d71ddc7e8bf7ce8870649e208c0d4f624791cc1d43ccef9601d45ace2854c99e784478d3c248d9f27f6127271ef26e0d8387310a600ae5af86f087d822ca3ea29f305a8f290a1aad9c243ca7f480ec785fbde801ca4699f7328f9b0b560d196c7efd3d57a9e692c0f461f9b67d9a047745dd1499a70eb669431813e9c7937e7e224c2464b298908beb7cc08c063f67b2f984d5bf006260961ad47dca45f15d35effa65bd134ab9741c0817076d5eedafab3ccfb491f474a9a344165ea0e84ca2e851d19334c1ce033bd3db0f2eeabe44147b52ac668f06609dec69da90a3817d94ac254fc8848de6b476000c9269b0a0661b8a1d06c2a0a8569fccbd4a7ff3fb69063ac807303f162dfeb0d69c8c63928967d7d3c16d52dd9d27aa90132491903e2126bda7b9745831b70a980bd9cc0de5c602ce101654da1f3c7391171cdd4d5a9de2a735f03a55af26765a23a339386dca678c3fccf2bc267986064a62bef63c79790684d5c50588bd9899099d2daf5319398c292b66b56f1651887de247413ae205fe319ef4923a5562d7d0e788c88b6a1d233b3634c1d7cce503985a15cbb7112718f6365fc7dd6bc7cbe0cf83f45f468f6809c5b3e304b4664d783893328eb6b45f674cf937aff99e76c1f765c4fbbf239a3501434b4710fc19027f96001030024c7b3c0dfc2faca3aac89367695bc4f0f63f9041d533403bb33e7627c5a8ca382f01d5017544ab089021edc20b5b6bf2649f0934c3f6887ff8f5b68d5ef3cd7b56e93ec1fc88d8f97cb526b98570691fa425c64d8e1274781fdc34e339c602c98c861ecc0514de019b5b6288ee8dec367eaa8d8951aabaf5727537ca10564a49f2840d556220c49a131499c406880897bcd3736cc7d9e28bc0edd33ba6f4ccecfbd5021ee616973d6f7becefcac86bec6609174d7b82c22d85a10f8a27f8e5fa472e56e4d1e51373d98385d275899f12f15f902e925679771ed9f93b02f19c9e384f9c86a845fe6be3e77cb0d80fa24f5b6d1db53c50c3e3650a3f7687102024d632c68c2fc8079d025969328f85e5f003afdcd227d1ad76e89b26c85763c1810341f8055ddd4a47a9122b26d201787eca24757fa5b95b0aa9786d90ab5d2cff26266e0d7096d298ade2b4fba2da457ae1e5f09f5ee8f1b3892037a34e3195b9e729b2ad020412800a888dd44954501fd04f27c723a4e09c4c1a4f5df1f5c7b53eaeeaa3b6505a9191ffd8ca54772e1d0a60d7eaf28aca55ad38a52a0227aec63e7647cc9d7ee47a979ab9e0216df69afd122add3d228929558c583a4a68ab122156436dfda1f91d5129da47f7f25f72391320130a4b6c1abe3b427b0eef02a696c72495b64fee1281bb06a98f1b2a29c764b551f6be9686e9c62fbdeaba15a180f961b0f091b39ab44d920801f22d44600c678764fcad0a365c6e35e9a0acfee6390fa3b093987857b71f1b279ef32a8bc9f5dc09124498c0e1a55eb489b5d7e5161dad2e9f58d1cba0de318c6b81c635276aba548093eb9a2d78b50bd2dc92f61ef2ecce0b8b9c7b1c88a1ff13228cf9786a87e04240c5bf81b0527d138d8020a6519c0ccead70bd3add5ab85de72c5447e3ad9a3fcf5287488c37be21f384074821d373cb84470bd3f22b9a6c4653eb05c4d6de12f60357cb7df2a6233683211bde2ff11c242484b71446c7369f2abdafdf9517b8966b9289f3eb9d423b52f747698333cfe57f2e580048041786bf790933eb6f99dbafff54f7ad9e5b0826ffc9839b678efc0601d5b6f98655a67baa9847dd33b3bf393cc4d7ba00e7ed7472b6f0396d7770878dbb2ee3be89b39d5d7768a1fa290ab75151f3220cc43c2b7927509d21077e287f3c917e6d56d8104503cc59fef183bddc0b176542ac8f57f9fbb499825c1e9545045f083af0c2df42d2f01abd7b827438a2e4df05c19425cdf27ec8642a8ae9d7eba78353f69157a49625f65667d856e92acb89b7e55c0d52c25553446cd77d353c432e11049cd569f8e77fbb657e0d684277405d30252e7c9db3c7daf193018be5a0c747f74307d349e201d3d1b8713fd415063c8eebddd8a75396e5724a286a6b534862cc6046b2ce325c0dfe2492b8d482036fb3ddc536c1d6d16a53147249b835181a94f6053829a7c1bef0b75192590f00623168c8d2ee05457e2cd01162160bcfad605a278892c9fb84d9912ec3d0373dd2c1304964820c1ff1e93b8b7358fb833d37ee03902f78465cb78e67eeaffa7c3882f85809a7b3bdebb18c370b6f1319586ff0ef64618318962f6754f2b33949a9e7eea9195176a0ad56f4d92b57bd0c7df8eb20efc2ce87dba9c34acb7c495c0c08ce776ec1435496ae39a4f7c75c57f539ab9235bc7daad4d75871aaaef24f01ee9792f35ce5b68a4701fa2af0e376537fbc1ea7e72593091ab653823c371ddad47863ad24e6efd0814276ac1d2ecd6323ba4025bc55edd5b4c4d270f7a212695550678fd3a1a52791462f65aa001d6fb606c8cafa97b5e360566c3dc7abdc3c51181820175999dde2153c09a7a0d636015b2578b1831cfd1598639a5502a911e9b3516ef215fdca6a59c086c4183b545880aa53976e7cb8cc983be06b0599de465dedcd13cbdfd458be8f3ca4a980d2dffda2f15184e670abebc8fbe229140145e462a6549af09006b7f5102197f8d3", 0x1000}, {&(0x7f0000004680)="4c2082f370cab70e452a1f79cad1ba2465473f5ff08f59d143875dfab7b2e419137b3a1b4146196c15b00f2d9e048490a58dea56ff06f26d9d760ab62c3fc4ced964e376a2310cbc399d0fd0e837e8a58a1125af8abe94048e3e2abf8a136c2c1cfad31b3c56a9d82ba077a7e6b3c0310c037a0f995aac31fa0eb326b416052bb95f76535d0ba59fae72ddeb5d4d95e583667dc172a67662e251dd8ef3d47f58eb6103192c6b965454101eaddd6522df34cdcb48688e483d02ceee9d6475712f6520a14e23fceefc119508c787ee311eb66b2a68d8cfcd3fe2f41683202dd54b951775d489d08baa50e94ca40bb23aa8d091f696021341bc4dde07b1d7755b6c6df56f501fca22357ac5475e6ab903a6e9ce2da1e4590643829e25a2b701bfbdb494bf85bca81dc1bff281d93339ab3d22ba2ef806f3d2517884c328850ef573f4061103ec2f6d465f51b05460142e6de72bdb8424f925e6e7915a1c4ee12308944ce0ad8a3381decf0a8886cc93e1e49ade3d28b1eb904ecff2fdcf9c1f5e5367c98024e371b31edca8000227a2ad981e16442ddea50ca0c99f56533fdd0ab48c6a8b11cb8d5cc9e41e88fb69c74ce3061047f3eaaead0c00723fec11011f6304f022b91d1c531aadfa710007bac6d9be39c14775b5431e62bb9526363ef5fae8b103df4c3926397ca99ff2bf7146ee6cad700eb26ce5c7b3f78923db0d0d60208114129418aba457a3e0b1c3c028addb5f0b6d1a8923e3bb3edd82b2c33aadfa813da959b1f24124eda4be81fd5ead8bc75f9f591466acfe639b02ab13374d2e743e1568b1de9a4c5aaed729cbf3581949a10294f3e7625680e9a827bd987a8e691e4b4edc086b11060b25ed08058950d3acd03ce404c4662c053f39b0acf55fd5f97f6eca58a5fede1f9cd421b004e0521f802bd5df5095e65f2d42eb7087fd018de75eeb61453dd9703f8b288294c5b21a15cf6091ea080fde130fd5f469ddda2c84499386d8ad781a269fd2322c667fffbc13ca4d4d29612025170de57f39358d1f521b54f2903fa7f373cb23786166737685c39c098b5a3792c73fca324f70c69d7949c039d7d1a56788fdec412decca7ca1dc56ad724541452735f08ecd7cad2e6a09863478c4066571e4e1f11925e9167926f0d4353a70c4ec5649f4c4009be96fe5beb6964a08a6b4e6bb07de240a4128a96e2b79540c864d8538614e8999c1ccb62862289edf53622a638149bb0a03a5551f8a0a36a9c226adc6b91d0f5968785aa6c3b6e7053979e4eecfaf8ecd0073401cd02ac107a5aac995a50bf2550caf991c3fa2453bbf41705958b2d886b1e184d149d798f5bf20af3117e1a55fa548503f61f59196aaa6f1ba8e471b02dd6fdae155cbab47b646fe259af6e7a3e32dc6e929f52a6447c8c4a504967e626bc45ebb1e92e693e6d07d7fafe3ed773f03e28c80281455a05a1322d1439763b04b2755c1ac17bdb768a861f0324fa5e799f5f603a7e4464800ed0fafc88fc323e4ad28e9f00eea3ca366decaa31c0436509f606c7dd52d30363344b5a2340e4e5654ad72ae206de3b4c146dc89f3379e59d34ec5cf5a06d046753313c059f7b44bf09ae3a0052191179dd75e02866564b497964477aef52ac0855a51817dafb37dde06a42751eab14cb0321c43eda436b252da682bd99930709e22afeeacf4e9ff96fc73c08bee627cdaebe7c2d123d48de9f0e24fe2bde2c7263881ea8d759c8a4d15a58dfbd1d05b53e61964419b70a8c87fe034eb471cd8f60206ec1567cfb90d177e105457a733394ca3052365c15626a4f8f702251f0f52124562fe0247a095cd9590062764764e7cffab6f1bad44d1ff0339c63d5c8a9bd4c76f320cb8b2e7422065c80a5d56e66d48e555af153f399fb82898015e08c6df403016928af9eca8ebc7b568f46f0166942568d18897168e85435487f6e1a00374c85370d97aaf81c00b10a02e06370401906e8861bed12412a8a76a9275f88ef183ec9cde8ba46bcc7ee873e281097a1e511d661e983c959cef2ff89e9708b811414d2fcce0207d53bd375fe7b6a8ff7039886dc1a028f824119fdf508de05c34a3cdd4c92aad74fa19f8a5e4908ddf569144f6eef63011cb8d93354ab4492295a832420eb0c498aaa23b90f2e56d9b0df942211768d54cb9c34b1399178d92fe7b8bd44746286f7b90edc145ce4069f3eac1a44b98dff6c32726b1ce5530ddc41bae4d8a872627cbae807d835ab035caaf13153a7f9b10384aca10d222fcea04c648c07374fa57319ebc7fd2db8876c32da856966c866dd1ff1d56c20891d2a92b89191cafedd83a9c010cef9e429136c46e3b09ce71b329a55158a01c15e7cc9054926c0fe6ba152192e40ef954c2310d8822ed7eec11e9a1ab18a916c6bf1c52606bbd7246ae44bc5d12ac60dee5410478ec88a02ee64cadc408a65ce9bcc0c9303db8b13a0c99293330f6ee653e5fbb09328860c0f1eba80f236569eadf61d340f773cdfdd4381d774582fbe76566834c69f4608b2dc3833b6c0090081c8abaee2c21ae64490c45b2ae9073037554cf9f606231360abf5e4ed0896b07c15480605e2e99ad8584bff8f60c223c4a4105b61ef55207065cb6f59c557a5db622e017e3ce47971a218ca171430c6e9ff0272c09179a19f34f34c4db8e25eecdd8c230f0f62c3a1bfdd72781cc1084917e1846365deeaff01101d95e968a730a0168d027edf0109119f1afafaf87895dcc21406ad1a5af9fe3ad23f1ecd4d995f348a0121bd927d7d99f099f88ab7c5ae58523e902d301cbf2994453f34d6452ae957551663821eff15d4df20edd60ea4c2e5192fc8ad64db44194c5a6ee7d56c24b58e7bd2dcc8c70d31bf2a46fe408317e3a5e90b0639ac3681616dc8ab3f8a6b4b3194915dedfebfbe22222a98f78551328afcc49a7895bab24033b70cf381821a4688b10a53023b8033260174b5d5398774e545eaa791218f442ab5545d2f27447c4cfbaebb1a89746e882c2156ab064022e4ba49351de6da03b89d19e6d1a7cfc74503f0995843df60aaace8fe1b89a667c88d622fd422489f5d7fdee49ac2d65d1bd83157b9f927e5db846c03eb9147d0aa6890148dbe30182d1ab728d2414e2b3deccfde13ea02df5cd754b9cc29c9f377fa246f8d7f6f5cba81a7d25866e9e4098f0ac3c67f3a633f136de9a161cd07e20d8ec4b9443b6ee0e23c42d7ba1c1bea2e345ec6f4725a2bffbb1ae644a6e4565a93fb62e1becc5086a2e005a91eaf8d1d65ea857207bc377bb6ff5fd1fa03bb978fb2b8caf03887f0b6550428650e161075541b28edc1bf1a0ae2ff421542dc94b0190d932db689c4af6ad319390eb1b5132e3978a5d763d93bbab563fdd3c255be8ae34e40347788adfa0249e9123ddb0eda096901b30af8c46f33dbadd5ea5864ac8f3d20d7f76b190e36218f89415365ba7bc3b1b951813472f4e624c5b24c48a7231952fd4d715fde21ed0f84c513ea423d57d55458e404a63b5501efa4ef8bf4d15027bbb1abb43235ff38c9563b9bd43d0ff77c1dc2dabfc3ecda4fc2e48e0bd3d41513cbd6440df02e743be6f3069053d43f265769881914ebb0b92645183289a923812779890a5f7055d8a1e8d81185537bb747084c514857e7bedcbd2a151419b746f10db0d1e8a73710774db67ed88daa11266e0f5b27f93184d6b375409824754830a6ef6717a4c09115a96d87164f5247fd88053272b6cf2209b7eecf64cada13900f18c625f09582651033ad3aa170726f0080334b34c4d5d6c8539484bbb9356a17fc55f15e122686e4ab66d80f6046d96c20fe37cd9664cf2c0af6ebfb07dc7eb5de63aa396271b150f753209787db296ec80ad4720ff44f0e58f829076b9de172dad65e0b1c56e39578d448a0b0d258aa99cfbbdc56f156b86b7006859f54fbfca765729a39e627f44c3804fbc9e0a837da2f9f480f1ea48717945e93fc6c411e926a5a6316fea5f6132c1c9c7880587c2355341973cdd2c6485590e4b03638eeeaa4b8224be14dd780f0945e7ce65a5ee75243a5af191df6027fb303ec9af352a0d70544052bb31b024c351a8ea137fbb1d5bbce9926fbb994d068d50bb2dea0781adb91564c3f7fa264316c77118f570e689810045129e4d2ec782ad9f8731565845bb042daf65c2c6ecd728d785f74faeb981690eecb470db90a05c5fa1b88d6f41770dc5829e25a446f81c27bb5aa6083c7980d24c76febeaa170dc0f53d768da44bd843ddf4de852513aba7686b5d20ea1fbe0f6af583208016988b83d71b8dff13b55a854bc72d743b83ef0d6306fac5ba75fec3260ab6f5157e9075208060c1caeccc4328ec944fc23e8554045c4cdbf6c42bbde21eaf48c44483a3c0cbe69447ce2c9f97eaa85558860de09039ebe8182720ed5cbe354c4a97248ccae6ce780b7e1861c24865643f22a34047b7bc5c2b5fd3b60cb4d9be5689ba61ab106015601974b0fc3db1a33e49c42bb2b01b072c34033096994b68df8b3681f3028e70fcf307b9ed063ab7a224c005672709d7d9d45199e7b9cb49342bace1f3edc128068a7b69838ce13f85c5db37220bb59aae692d60008b1bf0f49a5628ace6096845d1a72450b1d169c11e33b1fe40ab40f19936b0622e27d1e1a60148e730bd35cc42267eb5acf1a0761b062245e7ff0ad87a024d46fa35ec25b94ada6a49409e5be29114d39c3cc06d92302762a02ea7e1ca30bd28b76e24c67b1c9c82b2c12d8cbb33641470623953d16a0d4c5dc6a35ab6e398254eeb11ae4dd5ccab0791158cb789a0321f3e8508e8a1a70a6de0c2f8fd6860d33c8d4ea305e7b5296d5d628d9b4a32183f75a286de8e4224e163a2ac9cf6a0158296c0ee42ac521a5cfc9e2beb48e0a8a5a29050adf0dc706927c9caee84e61a14026bf56bd4f53075985d182b8f824a0b7d1cf11e3f2b9c11497d1298fa3602d0936f8f40f2c63ea3b96eb0122c255a27ce32b765b24b9993708a698ae446717f78541761a56507568566441f489b72281bfef9b82cf89895ea3e9fda2fdbee903c92fcd5bcbeb0b42876179efca172ea412d084c74a5817285ba1f2e2e0813914753cd2d886d9def45798025a7259baddd81cf6de488faa29de1eb9c2628e835f079d1df544229da5cda59b53c2e6053c326949d5a39d2a5cc4c8a8b7ab0aae8145303995ec1286a2eaaafc540914d678b508d295aeb1176495427b8582d51c7873ae709814f0d0a76aa70d93c8e8bbed7ef46fb223d8c064514c54cd8a59edef2ec27753abac23ee23347e350462f8079418e99ac1badecd2c4bdebe29b3724c9d4a6ab80ea3bfd26a9968649f774b473d1b8536ca57759aae5a3b443c3bea690adbdeee7a64e28036c7e7044d14cac361a79d7660d8c102e5f3a96b82f553e724f2aa5991fe659bef0c91a43b268d0d0c258d80cdeca654fd6df45fefd2c8dda35c75e74218b8adbca8cc6527eb9e5fb087201de86ae482f3613b6d50953c37ebf28d1b6cbb9b7d86924111adbd5dad56794d7029a2928e435545c028228953fe8e0df78c4821344272e1ca04d4de7a982e534c0c06256120f74df826949bc8b51cca9c5dc9ed2a3d60f5b1d6d9db401da0b5216ceacd4aed061537262dc76cf863d1bc8ce451e1bd1cc4fec0ac5dc63fbd5c91c4427a201da30b0442383bdcf1d47754ed5890a4f5f5f071efadaacc74fb235eda4cc9f9fd2458d265e790b74621365a6870173f7d6d1ec94ec686036e15baeca571075f1ce5b", 0x1000}, {&(0x7f0000005680)="5ee64e182c864dcd9782246d478bc919033bd35b636d69d1363130d6d088c4514682fb3f5f034a9f4b8284d400e90c6a5925fbc0919b7aaa0db4fb154455700dc4fe323a126a1766e6dd34ae74565b5248326ec27878", 0x56}], 0x6, &(0x7f0000005780)={0x80, 0x100, 0xfffffffffffff94f, "d23c5196b24e519efcd351fd746c6ac347345484f93707ce63565d25b3df943b77b06da25dafa7d092341c041e16263e5bbfb032c07f3bb48e72368406a28e2ed2ba60943fa909ae08859e81d2b59f9d642497549b73116aa65c460096f3d9306794338b45ae564db0a0704191"}, 0x80, 0x4800}, {&(0x7f0000005800)={0x27, 0x1, 0x1, 0x6, 0x1, 0x6, "faba5e36a3338d4788bd22a99233ca5b4d5e5695698d96f2a839b2ab4986de5f90a6c632697a8455e82b336d65502705a7010fee540c3457d96d56d1bbc5fb", 0x1b}, 0x60, &(0x7f0000005a80)=[{&(0x7f0000005880)="28ffb6a97d808220f835b76893b599425971344cb3e9d024f3f60c93e90b0f8ba786a4beec1e1174b1a81e94c091870555d93cd3c5ab493061179e277e41d14f2a02479f8aa6a976108413d25a2aa8dbde98da9dad788ef351a6dfdee4490a2558e295e6662c757ceb7857a4d8a08d1159e178f5c2aabcfabd688e3e03648820aa67f4887d449d5cd7afb83999c2fc944d7d9c5c159b54f3ed9cc165c29023d98a4d1660da060c7eff32efa96ed13625d324c33cf2006f0231cf5d12ac641ee4f828edd837d62604e851a819540c0eb4", 0xd0}, {&(0x7f0000005980)="2d56222873da912f98cdd9e9f6cfcc43", 0x10}, {&(0x7f00000059c0)="d71b1508f385d3b54732516840fdee555937fd9220abd32a1ffb7d3035d06f58e05d5af7f2899c033b65491938893697042b4bda316e2786c3960cf728a88961d301b668a71764531eb32512c67ae1072c56ef48a6e17eee1c84e2cd8750189cd6104b94b2e5ec9e118bab2b7425c2d93b0550b62a0b995827cb376c", 0x7c}, {&(0x7f0000005a40)="d2ec07c5df75d185545435409b5257c7a4", 0x11}], 0x4, 0x0, 0x0, 0x80}], 0x6, 0x0)
setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000005c40)=0x6, 0x4)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

03:35:10 executing program 6:
socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
connect(r0, &(0x7f0000000080)=@llc={0x1a, 0x0, 0x3ff, 0x6, 0x1, 0x1000}, 0x80)
r1 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r2=>0x0}, &(0x7f0000cab000)=0xc)
openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x6c4100, 0x0)
r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x210200, 0x0)
ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1)
setresuid(0x0, r2, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)

03:35:10 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:10 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x7000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:11 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
r1 = dup2(r0, r0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)

03:35:11 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  375.066039] binder: 20857:20858 BC_FREE_BUFFER u0000000000000000 no match
[  375.077824] binder: 20862:20864 Acquire 1 refcount change on invalid ref 117440512 ret -22
03:35:11 executing program 6:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00')
accept$packet(0xffffffffffffff9c, &(0x7f0000000240)={0x11, 0x0, <r2=>0x0}, &(0x7f0000000280)=0x14)
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000002c0)=@xdp={0x2c, 0x0, <r3=>0x0}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000340)=""/188, 0xbc}, {&(0x7f0000000400)=""/116, 0x74}, {&(0x7f0000000480)=""/28, 0x1c}], 0x3, &(0x7f0000000500)=""/8, 0x8, 0x1d}, 0x140)
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000580)={'vcan0\x00', <r4=>0x0})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000ac0)={'nr0\x00', <r5=>0x0})
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x14, &(0x7f0000000b00)={@mcast1, <r6=>0x0}, &(0x7f0000000b40)=0x14)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000b80)={'syz_tun\x00', <r7=>0x0})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000bc0)={{{@in=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@ipv4={[], [], @rand_addr}}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000000d00)={@mcast2, <r9=>0x0}, &(0x7f0000000d40)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001600)={{{@in=@rand_addr, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@broadcast}, 0x0, @in=@remote}}, &(0x7f0000001700)=0xe8)
sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001b80)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x22000000}, 0xc, &(0x7f0000001b40)={&(0x7f0000001740)={0x3f8, r1, 0x620, 0x70bd25, 0x25dfdbfe, {}, [{{0x8, 0x1, r2}, {0x1b4, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r3}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}]}}, {{0x8, 0x1, r5}, {0x1dc, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x80}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x6c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x3c, 0x4, [{0x9, 0x401, 0x800, 0x6}, {0x91, 0x80000000, 0x9}, {0xffffffffffffffff, 0x8, 0x3, 0xab4}, {0x7f, 0x1ff, 0x7fff, 0x3}, {0x5, 0x8, 0x8, 0x1f}, {0x80000001, 0x0, 0x2, 0xafef}, {0x4, 0x8, 0x3, 0xffffffffffff0000}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xa2d}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r10}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}]}}]}, 0x3f8}, 0x1, 0x0, 0x0, 0x40000}, 0x8000)
r11 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r12=>0x0}, &(0x7f0000cab000)=0xc)
pipe2(&(0x7f0000000000)={<r13=>0xffffffffffffffff, <r14=>0xffffffffffffffff}, 0x84800)
r15 = inotify_add_watch(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2000110)
inotify_rm_watch(r14, r15)
ioctl$sock_inet6_tcp_SIOCINQ(r13, 0x541b, &(0x7f0000000080))
setresuid(0x0, r12, 0x0)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)
setsockopt$ALG_SET_KEY(r11, 0x117, 0x1, &(0x7f00000000c0)="65577a1766240b313b765c94294aa0c3c6d69fee1c145262683d25d175b1d7ea8f5440f4fbbe4aecb32972f0b580d1a8490fa0426a6e7e6eddb8c2a416c8f9d8cbba9a827eb0c857bb30907f924993f8b45a1e225ee0722cee05b742e54b933be2dce192cb8a2b4aee9299e5150ead9253158fb2af1025087eac00e819a2e6a30f62246c8e63af6a106280a7ad20b31d1438ba729d925a4d32c3dfd903a0237f3cce1a893c8227337de8e890765c578505d2c7178ce8ecc22056985adcaee450ac609b2b2ba87f59b3c947a97990db", 0xcf)

03:35:11 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xd0000000000000]}, 0x10)

03:35:11 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000180)=""/239, 0xef, 0x0, 0x0, 0x0)
close(r0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

[  375.129146] binder: 20857:20866 BC_FREE_BUFFER u0000000000000000 no match
03:35:11 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="03f0630840020000d9cd7383c25e6eb71147d6ba5a192c666e35de594b211efc98e2786088bb9a4701c9f28a938c"], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:11 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000000)={'gre0\x00', 0x9fa})
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='veno\x00', 0x5)

03:35:11 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  375.294675] binder: 20887:20888 unknown command 140767235
[  375.313372] binder: 20887:20888 ioctl c0306201 20007000 returned -22
[  375.360698] binder: 20887:20897 unknown command 140767235
[  375.399599] binder: 20887:20897 ioctl c0306201 20007000 returned -22
03:35:11 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2c, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:11 executing program 3:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
gettid()
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10)
r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x20)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000200)={<r2=>0x0, 0x8001}, &(0x7f0000000240)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000280)={r2, 0x4}, 0x8)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1)
recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307)
close(r0)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
r4 = getpgrp(0xffffffffffffffff)
sched_setaffinity(r4, 0x8, &(0x7f00000002c0)=0x5)
ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")

03:35:11 executing program 6:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)="666400c871ea48af525701383bb92345d15fb542bf6da45b014095b516a2a88acaed24f5f8f66ac53ca2002d69cad9")
fchdir(r1)
quotactl(0x2080000203, &(0x7f0000000140)='./file1\x00', 0x0, &(0x7f00000001c0)="1e")

03:35:11 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x20000000]}, 0x10)

03:35:11 executing program 2:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
setsockopt$inet_udp_int(r0, 0x11, 0x6f, &(0x7f0000000200)=0xe340, 0x4)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
r2 = semget$private(0x0, 0x4, 0x20)
semctl$GETVAL(r2, 0x0, 0xc, &(0x7f0000000000)=""/57)
getsockopt$inet_opts(r1, 0x0, 0x0, &(0x7f0000000040)=""/164, &(0x7f0000000180)=0xa4)

03:35:11 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:11 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio\x00', 0x400000, 0x0)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000080)={0x9, 0x4, 0xffffffff, 0x1c, <r2=>0x0}, &(0x7f00000000c0)=0x10)
getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000200)={r2, 0xba, "44c6c11cf47cf13816b27c492e2af1ed93835d9dafdcce3088136439c1d763792722cc997fa93c523c0a6b6939f5d4d91b47232e3f066ba7b0f752d457e31fa2f919b9fe70cd7f37a97cd9e014cdafb36a28c656e1f610c09c259d0bc299e26176e9c4f050dbcd7d67b826b9275cf8db8635acdc15f51fbf1af5168b1ded24d39fbfaa45cc7b74ab85ba38ea0845749e61e8c890ef6d731a513865ce1d9beaab74c60da378a20537eefeb1f590a36444f8a7a08061502927ee68"}, &(0x7f0000000100)=0xc2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

[  375.877732] binder: 20862:20902 Acquire 1 refcount change on invalid ref 117440512 ret -22
03:35:11 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x74fc0200}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:11 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:11 executing program 2:
fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, <r0=>0x0})
ptrace(0xffffffffffffffff, r0)
ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f0000001280))
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000001400)='/dev/vsock\x00', 0x400280, 0x0)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f0000001440)={@empty, @remote, <r2=>0x0}, &(0x7f0000001480)=0xc)
setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000014c0)={r2, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}}, 0x10)
clone(0x40010000, &(0x7f0000000180)="8248121aaf1317a14b8ba5d44a4e9ed9b546444cc295ba5f3e8c007f580482f5692b83d8e35d96475e296e1a73e534a52e5d47d2635b4187e8b9bfff7f4d9df1714c39407802b8817e81ed289d8ea3ac256c2fb9089f488ec696b12786cadda8210fb9fe917b8a07b729dfff7662b5245de7767b56a150f1496b518351f8e4a5fd2e519047871509310f0e2ea46103ef8ac9222cc74a530ed661bd440b8f80216a2b1ab3e8a2b32d5ff921d11df817d2c8f6d2093ce12b654a8b51a60b435a2df23a641259bac1239afe8183d50e7469d62d998d4f6b5e8e4f0c377dc19d0c783b4921e4afe5a00465f22cc482398c91212e9f1f7a4f77200c5d0c3d46227f725ced229e31ea8c2b7b7c4aa028d6797b17d1a8ca385848b47cdf0d88eb1c90df52fbd99ac2d655a9b032b8875dba0425d47d7ebe32f9471c3f325162450971bb314acfa5fdcf9ff8963486a6f1fe2452dce36b3789fe541ee5407402a5ac971a4b6f414b083d8eede890971550f734b5a8e69269e63db6c20e58d4ac6520db5b324ca5cac7c6f3aa3a6e1ff6dff56e17acb50b016b2471a0919c9f2a9ee5946d83a8fd405c2b519ce8eb86c4cdd06f79e3d8bf476f49b587c8718b60f95c7b62ab674ac8ed51d3de18283ce1f7ed2f9374868897ad5a2604579fbdd01c98475d39c2af9f40380d1fa98b8ca9249ebc84328973becb92603e4812136a3a32afee84c203d8c716fafba8b5a322e70387b21d4892bc0aa8c1b62ecb7e0c668efda651146d0fd1d85ee959ec3ed8be469cb9df50c89573b622949ecc974dca14c2d310c5d5e97eefd64784f8f3778cc8d8184f85a67981261c4f86798fe209ac4da69beefd1b4aa1a0a0a98a14bf5144854d6190bc04e1c29dcd7ae80ff01ad2ec9ee12bbf75c67c8415eb7c7248929ac509b97a1e0825094edc63fa6d9e437ce7df64e6f6840424a6f0227fc53cb94191b9d9b26105e0a4b917339a130c8eaa7890889dd651c3f9506cb0a77102c3ae81d84922e3a1693d431d4969ac8edadc922dc1c617cf1fc363571466cd62322088d2275cee77ea9446e38066d09838a5bf27af4d3c5b617ec0bf3869e33162520478e557cb40b9f27c4486fa5bae66423179ed825aeb77cbcb5cb4b04e541adbf8d4d3eaa2bc7b3067aef6906a0076cabed8020035787a14bb8786ca90198757a6e401b0e55039f60fe2a591363a990b3b34057123d8630e5198cbd119b8b88227657844b9357393551c7fb71300dce123d8483a2a7eda366b4d00326f6caa1ef8c11b5feaf16f0d99c3473cdfb7520356f753881f1cd7c501e410e9a15f9c68cfc3c3cf1e808358428c3097826ae9505cdd291bfd6a436e92a1a8cbaf6304c26020761a06bd8e79bc5fc48553d6229e0ab425eeedaa675de87d8b69608b8349f33fe2ccc782f49063f5f4b3916c47c78d0c7a249c4ba23b312fcf072a9e68a71ea3006f94aba416058831c4cadd8dddb4b0e02f1fb9928dd1946cc3dc539c95d5a600761908459dcf23fb72816bed62383296838ae2f5884f1039833a8e9e334ff06175bf000bda53039a9935cb4c37452aa60489ac6733f2b89849b41d3e21bd597c972d2d8125c480634add8047b628797ae5538a0ed27daf08be8fd246799a032911d09e35fdca0919977f3a816df10986f14969e045551ebc3bb46b802a1ba57cfa02a142f414885d9fccaa0bea0e6bb2c0ea692123f8ec164556d4ae6f9dbd6de51fdf2ce03c0d8ab7bcc936f061414c3590cc39138fa8db36cde571e8a7c32e44f612b3b5394b78f907a3086a295726d851cba79a808575b9f04aadd88167bedc2a7cf05c5365c9e314b849e138a640d6c157a5f582b630a2c68d8c0fb6fdd3c3d189f6d5aa1bfe1851b72f2fc2966c174539cba9f5e48ac9d4b38b7534608e85fa74763c6cd0770a1b72335d5aff3d9ed0207fcc9a8b6d7dca971e51af2b827145439ee37779b3f4f71a5f6f9babdbd783a5f84d817930b29ff85c3f8afc631ca2cebb7580744073be059d05519c035e8a4bb3f08451d4aab007922752f2b96b418360f028fbaff3754e76bb5f20169fd365af948ce05a7758852d334f87af6bf65efc763f77a32a4633b5d247e6f89864fa15982e3c3ffa2467e72eb17ca13727ffdad2d7d7e5baee1fe9c7dffb4c4e61ced7b59a4a351959a40bd82dec274558d424ea26b11cf824da9b0ab5aa83bc466deb83fefc307846187ba902aec1469350d16154463b8378e82b96c3dcecc06d38e7df5236845ea4d400226fa563339a3ac92e9fea981b351b7a1982af842ad19db0a76b3bd7a2a8841a52005a6ed24a75368555cb4f375b5875d2018f5aa12bd7d07078e43c8f4794af34169c21f5dfc943c8707debb11e8c5a9471207feefe97570a86baf77a025c38ecf6b312c35f952606f41fea0976fd3ed852f8f74218a8b752a8c0446311b4703415dcb844cc548a7414f02b37f79f3b55acc96c03f604307a26483533fd8cac4fd671f8c83799f7e0a248d3bf35a5d4d938386eeaa0084430f1941299256e4a046d5bf54eefa4c2ec3ef8ea01c4648f1a44e0ac12ae79f81dd63df773ccd34a39c72390a29b734e279089b3ec427d08dceb4ee45113cd6360092f7d0969ead1d35af221e3d321ee212acb308c02ac3f297a967db5ff41d54ab414a48865e3f4fb81418bafa7c1f9040c341feb5af16553f941312f29ef6bb93b856d15c4e7682cd0d5522c2b22ac7b8b77fc8e4676c372cb82b3672eab7239acfa47c064a9028ef4ffa6796375d4c3dbfdc413ed36ba93eb3451e3e3de62c091619db5a1944eed03d46a3c85b78c2fcc5bb43c7d70240bdff0b43ceac5a10ced44a3ca2f53dfc65210e60fd2b17ab0ef67bcf4399a91fdecd9cf8214ea8a7c3177f384c6c8cd26cbf1a4af6d00f86d2ba08788e79c2aaa2583fbc9b49f384fcc986f4287f198dea1f44ca270abf037957a683da681a69120c0bbf49db10b7d64cf84d75429acba598c860c51eea03a37efea6b2952b2b0cfa64082b1aad7896b60e589310e856d16a1dbd589242bfcfcd10cc86201eeaaa504fdd21d9245f8003dad6504d69b6702ba87c57ffa51bfff7709e6fef07e2b08bd96c0641201ffb20fd6a062469933182fb64ea1f8da112344167ddcdec2843d792a7717131d3fffb39f6d970888bbee5a069b581a63b78be099f80d17674f7d5e7695135627051308ebfcd02da53aa800e694052d8d128ad9f6c15689e850e7d1fee4a729bc006ae7e1be50728787b0ff9d2f183af07e9b1b80698104a01f1fc334bc582553a12d6f04983c58d04086ddc8c71d3f144c3ff7d066e2c34744a80ef742a7a0251780cbae66c952d17c031889f28e9491adc5378fb97d2803e4f3c7762614951e91cf4a880fda74571f0cc4f53026749615815562a9eec028c94dc2b3894f8141023af344d99cac3ab6cd35a799456cbad681b42aefe20db386b6e60c9b93e35b5bef7d8072d0cfc4d81e2aa069e253332ccae29bd84da27014c995e4b68f77438e26c7cd7b61d0d943c5c929d13910182a741e9ffa5efd5b81fc2089308ac3d39f3cf8f65edf75433825d08aa1b7c0d1b27c0f96317294a071bc5b68143f78663a0dd1995a6a5818dd508d4b615a7bed98fd2ffacff40b0672bc02e2800e7bfa81e038d022fecff2a3f48a00ba73e55420fce2ac82096063b0313a1ab38cbf4b0191e3c1ffbac1899a558e1dc9f42150147e3cbfe7005b50be56d29b9ddd1811c224b8bc55814a4fcfd69777e4270c02493257d270ac051e7ca3078ea9d05ec363aef098e99b869fcabd996524343fb9d67da331eb5a423e5a76892a444b51e91ea6068b7e198fc80c123cf35d89331e924ad9e9aac58280937f5eac5114badc9f8caf6ccde6d20f86b5a46b6edabb733f5f3390307d4f7b7f48c39b46647e0918682184a3d0f9655e3c84e6092adc83d31645def54e5ea14cf6bc90efb4b8bf83c252b0f9780cc7b8a173aa090d198a8a7e234e75392ddd56577a04627577bbed4b9d9c92d87dc6f4cdc29e3b9b713286627930de39661f6f016a1f14109aeb6728e7de7dafaf9a0cb117ce1fe01ad2d5db87a41889a311706b5373c4f3b121bbfb60fa105988e301bdf302b4d8cd97acdea5223e59226a6e920b53d0097bad30b936f00fc87c45a45a6cceace8e4ab035b7e577aade3cb47d8b5dc0dc45a5639a12b09fa3d2cbf4173007cb9d9dcffae5635c009a71c73bbd4896307f3a7c5eddcd2e9c41e1ca28c58748fd2c5abcf5ef4ee595a8d0f9c5c49692ebbf01cbdad33a40c2cddb70549b5ef5de1b21f558bcd931067b083801b44481f79ec8637735097b8afc51336bf7696257342e8e48a665e2bfd9be920914e8629398050a7b0514b9faf461371a21f804b3e738da2300cea97fa8f34fec21556f228fe6f116e7e59d710547c9f453f8b0cd7d4e24d6876bf19511150215767192c0e974754dfa674e20f71a18061feb6b5cd40e0491feaf62fef1b60fb9f039f74102fd34f77e4afc7200d4cc55ef892c5c7b55d9baa1366b9f9702c2d76df741f5b6b34e63de61d7e123b367d20d6f67fd12e156fd57561120a568eea15140e9e59d1ea9f2466138a4254f6eb4a524b6e8b14f6f1f744af4395c93c994593e61e5f31890e7e4e8cd8f5e02cd95af6af8d62faa9f33a50648f676e1c117cd2e033a8329b3efb91591129f67890925837a6a9ac0b18814c3a417e3246a6b51e22e83a2d1f87713ad22b12d0ab70d635b9f404f4f48f07e4e17c1cfec192b966bbc6b0bc7ca60a51908e68f4f4923a47fb601d05824328b45d4f266ef5c89501d07ac19094660fbb27b9925ed909c2cb1222392721d1d303f5e91c3d4ef8d8dc03192b45fbcd95bc8788086ce154c861a1da10826259b1f1158e01872dbbc7c918a6d661a0c5c492f1e369a90a38de8eae94ff763d09c1c58b3507b54ca7e87349ba72824fd16b3570716c92398fa80917c3762769967ec98951e464be657d55a61b7806c226ab2e35be0c120fe1f3b162920644dd8d6afca60785d8ab74b10fd3bc52bc51e39566595fcd942d5e857c4f990c84324a95305162b9466a33641cbb3f995171f8f55436fe609bd4d2ff2aaef5aee5fd7e7c60932cb9216d07b9406374e421b2a2c3acf00e59d3040a48a9c39d79cf1108749d62f83eec7410d78367754da33cf594bf6d0c1439a5b53f2c2743bdaa751ecd6de624557b7f6a5748f44ba38acfd2231fa2a42f2faff1185828418cb9e82bd97f5482183c6aa46a1f54cad97f93d0d80bc826e27d2672fa53d6f07ab9ae093c84ab43f4b9ca62a0f7babd2b47ca1db035a89ba6a936aea59f2917fb53cc6fbc61655f8ccc8dd993487d27f24976e07b2e91aa5f30291d5e101b6dd1d6a26d3a11e72f2e393f86c167d0befe3b2b1b73877ab842bc56cc4ba88ea4ea672b2759f67864b55b7e4373931aa96bf72456b1a8bb93b6b031b486b08a46538f43693da497cbc89c341a66e5480e2737f47bcc0938890de6fac7fe68cec66f8e14edf2273b587d75e580dd28dc6bd0140d0d99cdaf8ceeb67c07680f29102258bcbd42ce01eb3e5be05bd461146171dd31e6599f98f8f500eb55a0113df940981ad7b6059bbfa3f1c26957d31fd8fe0960f27d6a0dbd760dcea5ec667f71cf5cc2bb85355aef94d746bc74cbcd97800f20bec4633e3ea1cdc38d2db21af4e54d199d21a61fc4d8f5a10e8aa9b8545df620612b43ea6dcb6e21553b34238daa54a328d191bc93318debf0e677b6", &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000001180)="729b66ff2bf450d839721e1570fbd0343c45ece0ffbc826d8e633e40956301263a39965cc967e5f6efea274c8a5691d0d48ea3203af99ff77516af0a2dcb034d16b6ee987263a4ded87e28cbc9784f5305c45e787210be61b95aacd7d1252083c171aa534c8608ecaad36afc2cc2e9f0025fa23dea2f69d259eae123244ec3619451b21178cc6186132ddf858357c2466f5bae46edcc51196208a5960486211af33add83a613f493a7fb0b121a7198a70f11d490e0624ca9eb1da52953dbcd150c51567bf2426f283a8d85e89b0f8b")
ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000100)={{}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x50)

[  375.938203] binder: 20908:20910 BC_FREE_BUFFER u0000000000000000 no match
[  375.968300] binder: 20908:20910 BC_FREE_BUFFER u0000000000000000 no match
03:35:11 executing program 6:
syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0))

03:35:11 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x4000]}, 0x10)

03:35:12 executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x1}}, 0x0)

03:35:12 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  376.068364] binder: 20928:20931 Acquire 1 refcount change on invalid ref 1962672640 ret -22
03:35:12 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x40500, 0x0)
setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000040)={0x7fff, 0x1, 0x566}, 0xc)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:12 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0363084081000000"], 0xfc7c, 0x0, &(0x7f0000002000)})

[  376.239292] binder: 20950:20951 BC_FREE_BUFFER u0000000000000081 no match
[  376.302199] binder: 20950:20956 BC_FREE_BUFFER u0000000000000081 no match
03:35:12 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x1a000]}, 0x10)

03:35:12 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x0, 0x0)
ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f00000001c0))

03:35:12 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000000)=0x1, 0x4)
setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0xfdf6)
connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10)
sendto$inet(r0, &(0x7f0000000b40)="ac", 0x1, 0x0, &(0x7f0000000b00)={0x2, 0x0, @local}, 0x10)
sendto$inet(r0, &(0x7f0000000040)="b9", 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x0, @loopback}, 0x10)

03:35:12 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x16, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:12 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:12 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{0x2, 0xfffffffffffffffc}, {0x20, @local}, 0x5, {0x2, 0x0, @multicast2}, 'lo\x00'})
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0xa000, 0x0)
ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000180)={r0, r1, 0x10000, 0x4, &(0x7f00000002c0)="57a94495febb2d94c7ce917efa3aea28b87f76da371329070e64caf6b02fe02c04bfff906a7927d933ef8641adb51caaa1406c510326f286b55363fd25d2c99425868dc4a37d94a576d82c121b3f56988cd6425783ee40b7f13e8d858be84f6d389f65ee3d3b0f78dbfff2f401cf59cff9abb18e894c76571574b21154e740cc3cc001d933854db722d933798bc8eb3b3ee42405f5d976430c580000000000000000000000000000", 0x8, 0x7, 0x8, 0x9, 0x401, 0x0, 0x6, "d538e22ef462d4d903b292575c9d7e6e879b8d4516e6bc1278ec75176a0f7556821cf4d07acb4f3d74af8b6dbcb3cf6a0138a27598e2dff6c53bb7679c4ac145459408b2a72b4e923ad155a8a6026fb8794a45"})

03:35:12 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = request_key(&(0x7f0000001400)='big_key\x00', &(0x7f0000001440)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000001480)='!em0nodev+\x00', 0xfffffffffffffffb)
r2 = add_key(&(0x7f0000001540)='ceph\x00', &(0x7f0000001580)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000015c0)="99af887505c165d21446d85cfaf52485e7c0197d54c368c66b0a907f023ea7bcf61ae11635ccc565eced18b8da6be4ce698e8a4c64839ab95c22915aafaec4cbab225f6c2dcc97d4289df6d86f29cba9a5920f31e167cd09bfdb243d959bce15ed7d43527b694e235d4a9875b6b3660aa2ab482ac438e2c462db36a7a97dbf4b231bae3b84231ccc871f36e9f5c48895761bae9f36b9c66fde506f604344363c2541ba7ba9b914038502eb4d23e1626d8e11a32bf4b51f254ec8281f808b94eaefd769f876c30e74aa102c8dc2c2572ecf32cd169f9ae25c1df380817b1aef43780bacbe2e4e872c6976bc7f7144", 0xee, 0xfffffffffffffffa)
keyctl$search(0xa, r1, &(0x7f00000014c0)='logon\x00', &(0x7f0000001500)={0x73, 0x79, 0x7a, 0x1}, r2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})
syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x3, 0x4, &(0x7f0000001380)=[{&(0x7f00000000c0)="6bb9abb98df9d05c26874f9814a0686278d32569aef573274415dda05a9303b5b0a2c07305a5d9c3b420fd5adc665b93dc2ef7780de64a85a110dfd13cbc53061d21e30d3cd74565a613072a4c107ce6556ceaa8d4072822cc19babb89b93c0bb160ea8bd15d9b39f61b", 0x6a, 0x2}, {&(0x7f0000000200)="da8b22262fb134a6e2a5de10f13c37ed68f39baac17a9c611558fbc9e2399a5bc7d7751954feb27fd741d5918c92ad11ef4b260c5d3a7926dbaf1f894984c7ae604dea2f34318ed2dee252d09dd9ac84f25fdc78dc67732649f160dadc500649f8374a6f4db648668066bc9aa1f2c701bc924813390469b21aa63dcc5e4973857d02ea16d4a50df4ecdfe4a091ff430548f11bfdcff03bfbf51f2dfa877853ff4333a9ee6f936fc29b0b732b89f214c09c459cf6ba9e0943268aefab13dd56622368b4084ac0fff2f01a8e323835b27db1d8c7daf16d6f061fe812a9c3c64fe0366d30ec6f98a2c693bbe49966eed393fbf19b62c5e7d01df9a1602009a889d0e5f0a9f8221e45820affa9b5532a7f6615759956e17377f5c3d622cf4808efb337971d8d9754fdf9ffc534c9fa6a4dfe9489aed9927c217f1957ea11e3c99d187b2841fbe578829c541bb58a31fa7c1a82b8310ad22d4a47d14eb0d20746558665072d8b2b468f397d2be8719b7975a455bad02dd1c4a00c57d042891809abeebbe3ee40eebf39168e309b5c8c793f89109aef0fe97365b739b95a594c17b97bf05136909b30d9048ce58da015d8b1b9cd61ce9399e4597c6614ae786378f0c5b52ce8003ab246aac488da18d301466a52f98dfcbefc008cd409435455d90838af1c1c0fccba50a1b32bfa50c6ce30ba9ae226bee640f4c94de254f93acf514b67205a4957380f1532d741bab30c5d3973a563ae9dfbe2f9a2085a851caebe5b940deea63c2bf81906a2a75e8c9c0e0cd41ba55a65ddb9a40c06ef80da7751a26b7f3183e1bb9eee99d41373cb20d44f7865b3125880b179b7d406ac70f06f56a6a4df60bb07d42dedaf5fa20f3f34be7901b2ef05c7a8a59178f4caaa36d43d7bcbd3252c8444774e2c62cf1cc61b9a39e1ef4c7b68e515c6aeb9e5e15427a0d7fbca23407746449a8c89f832f89bacdbcdc913f70e5723f5ecbf6af11c22a9f018d11c49e14bd9e322af4f6b2a7aac58fe3f2205a4656050025539624686c36c3c0f61a2ccf1ed6bb8a9d45398df5129cb19ec0007b546c1e02581c91acd74ee43d09651550290d4c10dddeb4e8fee91031714e8617c359f218354970a6e81a227aead6e9deed214313a92bbce2b6f345ce7df14ac321801184c6b25db7c457a040815f207a34c5ff19f566fad0a4d9306e2f66bb1d8988ff9f41c1b54f1b93f215dd6319e03bc79618a59d6ef5784cb3ffbc0d333fc9703107fa8aafef26c55978e4a4303c1a76ac642ef35f83569c62aa466a14d045dcf383e4698bade96c37bdcd5c5fd043a307c39ebe05d6eaa5808059d518bbf17924a5e913e877e00b40858f55a8747d44edd5d5be367c07764c145a2e0e9eea2aa26abc85917193590473f2ee13ebaf491ec5ee1b3a1d0975e5b4cf9d408832ba6c512f6eb0d13cfa2605cb41dd90c412b4e813b5a7ad39bd5bcd6697aaad268a5823a7056db13451b7a0451c72e0b41be7a3a5656dd74c07b2f236caa6f29c2dc57858f6cc406db8b516bb39a644ee643fc68123a56961727a1c3ee55e7d0f02fb4eada25c1f9716eee503a2f7ac60b6fd1b4a829798e645fa3d0fbd21497a5c4d3e7a608944bec91b9e537ebcb4c033aab6e0c44b90bc687fbf2f427fda7cdae59461c66879aa0e9f8ad8622403b9d31e3ac0a676d0956fc778e35567677bc0e3728a9dc4fb3144f3769c1a425b8acc7f2ed6dd07345f80167f75ebd022cd94d43a80891b7a53b4338e6712625613ccf0df5c88e74b153168093bb96c75481a24bd14035db41a892287f8d701a4c1eb730bd45ee87baef9c6c7353c274fc022eebb873577d24c3b3a7d91f4bc684b68b55d2a59bd0876c445b9c09f52c8f5b4313b49c9ddda1e1fd8b90c5389b5d947b862bd9284b1530a6a53d6bbb4faa0fc6697d312c08ca845af73714435778a5b23c92d528b5af8b748502389bacb0662cf2254cb398fa308b0d513f99c0e7acd7ff65a27534047f487999fae41ee34e1b861794e8c1fe85cb9010e4fcca4907be4db0b6ca71d42ea7cbef1937fad8cb9626ffc85f58274878594dbfd35933f01d9890fe9933d37f534af73cf4a1bdbcbc479a976cc2df9b9090b23b627eaa969f9032de00c6206c66e89f88bf2a8231750e538e826c0b75cef35558b99b0285fddc36b19da4859ab198c6d0183032de6916c1fccc6d886ff7f562cedb0a494adf8b469cdb17f58885f949ba0839692edc371d2bbcb40518b383897e47b0212047a2f5673e6d74ff3d4a8464cdbcc7045a8e7c17e63c1ab89002595a44c791d55e48a4d8ac00a3a0413061b2bf16c01e27ecade8b03cfbca0578d6c967a7ed6ee167487c2a2758755faf7afbafc283c3035c8fd1667c0f90d0b32c335e3204274a839951ea7ed826268e7e65ccccbb79bca827d677c4e3431cf7051f93fe05479c4bcf2941edbc87ec49551fd36bfff7c3043f9993e41f65383982e30841a4f7672b53df50778967978285da380a4c58f0e6ac99669a670964146ec1c8fac7b4142118bafb8cc307ec5c28accf305711bc2586120151b8d4d21a596bf5d1ddf9d15684926f12668ad6ef541fd107e4978d8893d753805338c16c6a70df6a75383bd1ffaca06e081b98473f20459c32c36b19e22b4280160628bcd7f57f1ada7e3418d36b9fa12bb72504561cce41c9bfc117bcfb55d0c457481a4fac7843cc4b73fa9249b838a83f25a282ccf6f60331829504e659cb095600f075b2970c57ff492f36b71d7cacb6350e1ee8830941cb90c8b5c659b503321e5ea3c2bd44726eb54e7e508b275058c81f30a1cb43653239c29782c13b1e48953d88eee0bb18d6f629a7b5cd986467ded1336602ec90c07e7fc03ca14ffd55f7a76781a482120aa6a19d770a3ac80ed5542da6bca1c65eda14e9771322d43c61391cfc05022074aa4d241f45d4d00c1fca574e0db28e9a416bedf0554fadf61b892ab69d7b9e8427c067939e74edb92060f42a9b619bea468f608219ace3d60feda0f8bb48222fa0a2cb7fcfc81bc79eee8df025b1f94494f5149fd9271023ad87d23226188ca94b07b397134a59495191d458e5e172a98391264ffebd505bc3af20ca7d17174bd377fc4353cdca46a18554436f5e10b28dc5471cf438353db98f6863b014dfa01434a061c6fc5645637f1062d87e63995a63372f8c87f156d19fe89849b9b1469a823ec1aa1ab17ef70f3838b1637e1b3386fb0e31dd28341a0b0592980713db4318d0aabb797524e3760d334e60fbceb3ce77143cee7de506db73c0a4c1e862a9aa3d2b65cfa9c085b659f06804fae479eae6b80365390946a1ad5f90b2aaf6c5954b3e68dfb74479a06363c1e9d48f6ad45acd2e057e52cd8e21bd246215af0c5f4a5b0edcb3d033389a6f281259de5526b4ccd1889dede1f85a83c202abca9a198884b23fb1e71201a6a33a0aaf1a32dedf071866821ab5bc02b3c35a1aad7b823dc6be06d9e9a302cf6666afdb8364b6a23fc36ad4f203787ad35d49dd45ca6030e6be1fef5a4210ab37a57ad4a0b7d030f6318b549e60b32b89a5a5c9d694edacef6735c717f8536cdf8f4cea34db9e68988cb371b26e6cc2d0450962c74b693d188ade945d4239f3889bdad3a4a4f8df2960beac93828638cb78c0ceb11d321e033c8c464604367c3e030af42225412cff6784173efd0ea539ab80daf10d219fb45067cc18db7a07b04c2072297586d1ec8d6534afece02108e5d3f47a31074c6508f71354a6fa34dd5eeac1f0c4f5d65d7ee31914094f359f724887042c7a45faa1a194bcb838466735509cec358809ddd46036cc703db8441fd98fd6db99727d7b051fa27aaae69d155e45613ddb055673a2dde9d743fb8aaf88df7b2630357207df3173e190699f85568d723bde00090ece429de11543d14f32241fa76a6843408ad4a530340c106b174f4d68ba3dabadb8918bc6191de9f7a797beabd8e1bc6557f91237c3af312f56bbef8c92863150bf1c4dedab9da49c7a7ae7d9455aa525b704101293e91149db5929145461ab8a2de317e5edcfc5f8b5518ea56302d61918020f4e3647569c299c0d77092fd091789ce723e00ca0b760fcb64145318c66038a1825fa146f68e1a1a849a81c885385dc192f19bad99f474d6b9a02213c2d27a49fcb62409da36c2d00ee1233495fdbabdb5d6598d61ae046628281c671bc8ba5af6cd3a07a2ef369f9ab3567a183fa57ed309c680a002b0e51c0883613332672102171b3239c096735a2dbfd07faa4cc136b3b132ba23020288bc363b249bfb6559f88b87ddcff4c56fe877180aac2a48a6132e8cf6b85c5cacfa581fbb187a2348e95808399d22afc744e17a5263a49fc8ab1960c7a0d9b8550bd784451401a5e5e98e2431e711b32b8093b8b317a5664c33e1d8eb713b2ed17c144c9e05145db6a51cc5e12e2e92d2d0dfc8e8a8aca717b10078c60fef1e776b521baaf25d6df211768a87a8a04a0ae206e914b13970d9e5ec58d2f3792bfda68ab591599cce150ac58bee3946972acc70188c14566a2ad709beb1e7e5e3b228dc683b12cf386556516e4f78c09bbe8536d54d7f03b918f8edc864d236e9a01f79a6f98964efee7657ac6f5c11bd24797e5b5f74c3b7c605610256c230d93afe8d59ea88f60844bb1a3497b3e1d56b095a137137f8c279257ccd8566bd627f07005ed86c9651f3447d0fe2db1e603a5d5fcf49d8e707977891f2f0c784e502caac01e8458ad2b8df3501c62087fd66450c7861394ddfc73a16a32754290c39c204d7b1605208699cf4e88a606601aa8546cf18271dc0bf5873bc305a9a195050eca62e5839c01342a4136e21bee7e79fce7727acb73c38abfbb0423f572dde509c694494f23aaa087700e698961a7133b133687f8b0b1ce2072507434220fd6ae9e1aa0c454b4d8f5c73815bb8cd544525e57fc4d1316666205ce45f3434a0019dfd3586108608ca3fd4467efcbb7421e7fedf575b07d17a23e190e432db6d468d312dc9beb06dea0f4b4929924fca5e2313579536abeeae488be29c1a19fd777065dc3b82ef9fb33d2fbcbbf65815d571288e7ddb696bb9d52d0293c02a78bdce92f1a109f91ea2bacbc3873aef12b29b1bbc3516b1867a01ef34c83310b99c7031146c9e97c842c1f4632c2988e4a0ea1f73ebb9082b9819fba0e6cd02fc0294f1e7924a66ba0750bd59630a615e41cb4f19c2f8027b2cb37bc447ea03f3cf24138b29529d15c6d02d9763e272be72095f70e9fb3e7e8be1627211b7778695704f488ccd41a039b7f84335e61501dd23d28a56b35cfc4e081273706a2038a660d0d7dd32d352dce0b7f594994f26b6eab2be7ef6ea7bf51302d7cfaaea61fee779586c1560129706121ae78b6d97dd5f09557433d99777a8b1233f0d447896c66e3626ddac02301c97f4b337d89f244cbde4efe4abe87d7b91f1e395a6778f7c6aa1f36db9efb36634892440f4a3e7091e07c568cffe8fb5018df45065dd901c85a4a23d5b7ca0ae99a3169d9e1a03bfe1690d3f17cd4510476b208ea89ff4ffc27c1a3dbc4ca8a7fcd6bf56f7605bc1dedade99d1ef4c0a4174ee581d2bfa53b38494a5a0d1b03e79ac5c354058f037854cc90919c73c6a0781b0601c34c359cabfd2f264db73746bd2e81361fccd649866665d7c9a23f5f842ed4f4675fe73423ac416c69fa0617644326841c0071d887d9f097b8f4e9d32e75cb2779fb3103f47a0b990f2f2f5f99b6dda1c1e13324fe8d377224", 0x1000, 0x7}, {&(0x7f0000001200)="878d881bf09159abf8168e3fb2a1cebfc61899e8c462317584402228cf0e738e7e7da3d2182340575fd661851c210eeaf19c86f8e4bb1fcfb4f341394f728cbffae3b312836e7b675c6b9fdcb0e3b20441ac400b3741aeb5e1c09b52c9135bd208b059a798c2cebfccecafa64cd036188947e011d7e405773996621d5aa9096e9cfa53eeec38fd4c7b8849a07cdc8afcd6adfc7160fe89b563c1ae3af7331df6ceeecc9315bf1eb50d15c9920dd23ab4954cd2ed2cda678db1dfce56f15529feb1f6481cf4c2ab0cd0783ead14f5b5d4e9", 0xd1, 0x8}, {&(0x7f0000001300)="2d691f3532c25be2e465c00f41aa8b1c02c2f325f7c2496d9cf70f9a902812932ef281cd465781b52d560a19e627accb625176c0a020f434b821a45fc64395fc8e7bbdf60f67eaa771c2517fa6f641365eabb1", 0x53, 0x3ff}], 0x8000, &(0x7f00000016c0)=ANY=[@ANYBLOB="6e6c733d6d6163cf2293aa350087aacf8f1398ccbda39a726f6d616e2c00"])
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)=<r3=>0x0)
ptrace$poke(0xffffffffffffffff, r3, &(0x7f0000001700), 0x7)

[  376.827648] binder: 20961:20963 BC_FREE_BUFFER u0000000000000000 no match
[  376.860491] binder: 20928:20980 Acquire 1 refcount change on invalid ref 1962672640 ret -22
03:35:12 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xfdfdffff}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:12 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:12 executing program 3:
r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x34, 0x3)
ioctl$int_out(r0, 0xc0305720, &(0x7f0000000100))

03:35:12 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @local}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:12 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0)

03:35:12 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xfc]}, 0x10)

[  376.938788] hfsplus: unable to load nls mapping "macÏ"“ª5"
[  376.944572] hfsplus: unable to parse mount options
[  377.005262] binder: 20961:20963 BC_FREE_BUFFER u0000000000000000 no match
[  377.039595] binder: 20998:21006 Acquire 1 refcount change on invalid ref -33685505 ret -22
03:35:13 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  377.051771] hfsplus: unable to load nls mapping "macÏ"“ª5"
[  377.057545] hfsplus: unable to parse mount options
03:35:13 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/mixer\x00', 0x68100, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000540)={0x3, 0x5, 0x5, 0x1310, 'syz0\x00', 0x7})
ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f00000006c0)=""/4096)
r2 = open(&(0x7f00000000c0)='./file0\x00', 0x20000000200100, 0x400000010)
ioctl$SG_IO(r2, 0x2285, &(0x7f0000000480)={0x53, 0xfffffffffffffffc, 0x79, 0xf6ea, @scatter={0x1, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)=""/236, 0xec}]}, &(0x7f00000002c0)="892b2f9e6896eda4723d39fa8ba93cfa9315a34d2b41ccbd7395e6b5a862a4f87f57c51cb88f193814674f430efca0ed7a002ac82c562985e23cdb23ba8b9c1da35313b6c243b75f99c416a6696a8f06db855087dd20c28caee976bdb97ddaeddba1ea344ed009a45971a7a9e56613bc7acf7ce7b78fbe15f6", &(0x7f0000000340)=""/223, 0x7, 0x1, 0x2, &(0x7f0000000440)})
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={0xfd, {0x2, 0x4e24, @remote}, {0x2, 0x4e23, @broadcast}, {0x2, 0x2, @loopback}, 0x40, 0x1, 0x7f, 0x81, 0x41db, &(0x7f00000016c0)='dummy0\x00', 0x1, 0x0, 0x3})
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001780)=0xd)
sendmsg$xdp(r2, &(0x7f0000001840)={&(0x7f0000001740)={0x2c, 0x1, r3, 0x2c}, 0x400, &(0x7f0000001800)=[{&(0x7f0000001880)="3904f87f945bdf3c025b3f141771458425a96690e854a40900ffbf1788e61e187b7e416dff03a36878cda53021cd5efe9885df74cbceeb8dd042e58182b2d1f47be9645637e4812629431667e9ec8912f2f7cffdf676cf5f73fe250896d3", 0x5e}], 0x1, 0x0, 0x0, 0x881}, 0x20044000)
getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@dev, @in=@multicast2}}, {{@in=@rand_addr}, 0x0, @in6=@remote}}, &(0x7f0000000680)=0xe8)

03:35:13 executing program 6:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0xc04c5349, &(0x7f0000000000))

03:35:13 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x2)
getrusage(0xffffffffffffffff, &(0x7f0000000280))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0363084000576e1c37f1ace8fc6cecef534ad1ebecff007d6b60643d9abbe6067960041f088096ab30fba5a73116c28d78655ffce188b49e3fd8656c1ea773b21a65b7d9b498c4f72dcbe793c8a59f9e08ee27d17465b5bf4f5fb1e3a41adebed43c975d2ccabad87e70e9be1a50e97dee25b588d947b42c28c368c9c799aa92e5bb32307010a4b2f3994a00aa692c84b4e1953fd524189ae11b69a1ca15db23b201a39365653d1d40892da88669568e75ed9d046ce3"], 0xfc7c, 0x0, &(0x7f0000002000)})
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0)
write$P9_RLINK(r1, &(0x7f0000000140)={0x7, 0x47, 0x2}, 0x7)

03:35:13 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xa0010000000000]}, 0x10)

03:35:13 executing program 3:
syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f0000000080)='./file0\x00', 0x1ff, 0x9, &(0x7f00000015c0)=[{&(0x7f00000000c0)="fd9d855e9e89c12849de19b6c43905e59e01804ce73136fd05c5ab9968e7d102a6dde728382fe5f160f7c8a71ae5ea2501e55b81ccda65c5ac1b1e6f8850ac1f0a307475cc1aa60b188aa2f6592aabd27466360d9d96332380bf9661151be3d52cbe7435f7d8543ceb67ef82dc66ce7b412ce2f21b62a5b9b910acaf92c70bde21de45ddddcb288288fb9949e3fc2b04ee816fbb209278b69930c3fb1df69899b183631ac464cef27a906e7121692ea9de65b4bf2761ed53b0b4d0220e723f", 0xbf}, {&(0x7f0000000200)="74538bb374b9a07721789e7ba676214163ca26473769188c392a3639fe2a1e6a252da610cefddad32c43ab1f1a6c032cc92fbebec9", 0x35, 0x80000000}, {&(0x7f0000000240)="0a45ea86ddfca671edec14058db7271d0ccfbf3757550f8fa2e6161b0fc05ec9e9bdd2376442c6e32544ceec2a415fce62b9ad49392be5d4682fb0aa9b86c9e3bf5877283d4803992a354a7d7c766c3ad8c7446aa75655180100477e90636bb526f2bfbbde2f422a8e4cda418cbc7ef1ebb7d54526fd9d645bcd9aed35b9f33ee643d91c237c2d2a9c4797ab6e03c5f8f28c2255a049a320a219345d1e6741edeb16752458ec7b0153ce409ffc60eabcdbff2377305a10931d496030522020407b", 0xc1, 0x6}, {&(0x7f0000000340)="93879986566cebeb32ea364645aec2bd142d6c873374be37973e3b65f46a2fd4c855f55eb266ef3abd6faced28eaac34f32fe5e190f879f7dbb204b75350907b1d3d8dd794b56c9eb1f3f88cec007e3a3c6801b1677305aa11a792aa7726ba72dc996f0aa94e05ab7f4a5c440c9a524f68663fc03a9fb3dea840b7d2d7e62186ae4fa160f9d591f1c56f3a2e9efcaea23a7c4df5481b02d40ac49aef8d48c00c195107e6e57f10b053e65defc48189c9aa115f4e811e74e5b720d0a9363ceea4b74945f29bd3903ac0194c09853741ecb67b4967a1dbe378911399983ae04240fd4a4eeca8c35474df831e3af6e4ee4d901d37a36d5d7195e194303b0ede20dcecf9ecc5a15d34123ba22101c077b6b46f5b9278a735b2c8c9fe12b8cf40480ca011587176b4e37a572ab7f2fe252e2af2beed8f0f35ca0afe223d9e67b8581e555d5d8fbff6ad391e3da058670821b2898f7c51315127d64735286ddf77b3f2f3dde0232905eeab2033e9f5759e6ef1dbf425a934e08804d59db48171b2ab214d42396b04e5bfce4aab6c810196a4eb182faca324856852fc0b59c10c9ba2208f27915282ff4320e1da84d147e25850afff6822f5a6ded99910b9945307476deeefdf4b78c27d434871ce19e36121c20de7faf08e229d74fa18917447cd3bdb16ebc5c7e318481d505957034090355b42fd92cc7c0b2f0a9bd143da19262619dcdcf7793029db6281996a75610c7c8537b993dafb5a5073f97f7b3e243da5e151b7f23de6abfaaabb5620685918e468afb945b690ddf6d1656ea0db4aeba02f7ec1ff8c8c702086e6fe45b5cfc1c8eb3b9fbe8ee2e016edb5664407616ce5b43a2315d3be1c3d5ac07d7c6e1ba235c81f60641398e83c86ea5c98dd5fa4723647d153d70f241a4673818add6b1ee69e503323ca647edd9b814f63c0d19111c229a607415990231945f49746c18ad5df8891d8f8c688aa54c87484fbf8015534e91f091170fa515d24f555c52fa656b0d32eb01aeb2ca02684ff43a50004e8d012ae47f3c51f1363e335473071f670765764e00de2e6ed53e2eb49e54c009d4ead49e3774c8cbc83f1f9c1075ba3f0d12b3b2a7898a50f93825142a1b250b033ce7dac2fad8c95118d4588017565295b5c9b1e9419c9238bbe54ee5a499c59e1b3fda6ed7ae552d55584a896c03939314cb5646ceafd06011b16395494ef9eb5e528655feb16f35190d767057f1721550fcd9bbd0870e40658d2364baf64aed5d978d1dac87b6393b1a14f97038ece64f53560630dd92f1968b11ff295c43c3cfcaec2e3c011b7fcd822a7cbc8f2449a51a5f8389280666a4e6e6177bd757cc9bc68b402fdb434cb88b169fa9a66f331290ec83ef1f8ff26fbd977c777dac8a4f20d99b400abfbead2f181453ba4f001ffbf516c782d71106e3df753cb1416ff9de8b7620d2506ce2d66bc90c8a4504c4e156bd81e2b665594aa8e150ea310dfc10a87a33a16e85704516a2502d413be1bc86d3a514a00902a1ebacfcfb1404047216201ad62e774e515572feb7ff79bde45c922f9a9efeea7985ec2bde752150d432f9596c55f879b868c9b601074d56f790260ba3c8aecd00b158b4224f8720c020a8268021b9f5d783b8f6494cc5d8f1e2e62b8be4dc801517d9a82a3bd4d25f4c2ecd32d601517ae67eeb45eb078dcba3da5c4d6fe6c621d290937aea77fbe6778b654cfda27e8cadd7d19f23d9c29217c4ceb393b1e28218fc99e0c9d3a037ce6d8620c3f73a886b6e2e55e7919d816d7fd32dd467d3a35b152d64c6719a70700aafc9b47b7040683b8dea0f39e9076e07deab77ace42b262b4911dd83a6b5726dcd36f898b4be970bdbc6553e40d712573d0db3c6c5747f66b2aeba4256c62bc325a65ade4c5714e2bc53f2798a5272e44e79ab5ca5f2efaa33088cda5e5c2bd16afb62ce0e768a0ba65adb87d5138bcc73ba558e2d8dd273eeb114443531ba8afec4f4d1731580d8bf16c80550d2a97244c8c8ed9f34cd3852cbe75805b350ca9470b94a24daae83dd3bbd50a038a60ace9d92f7b2c5102fbde521395a0411a29bbb7278e44ca23a9205903b74c5a25812739d632f91e168ce1c8c81614fbfc44c84ecdecc077b892576d71927063dff3b19126a725c8784ba7229b75c89bfa970eeada1f9fe1007a451be7b9bfa03f922a63069625667d412e5a69af074478de321e82027facacfc1a854f0148339518d5d2968464c2b1e797840a46f1a626251eccc50e5dd88d320f1beca4e4bece3460cb751c22bcc51a3fdb3fc4815c8a3b69ee69e2311cbfc24780d51bba509bdb41160bc08b757dae5d768c7a88d9dbf7dd23fd5d3343032a12fecf5f0cc056f9faecdf7836ec28dd3c32adc7766f2c4486340173ef4b7bbe04245954c62458065237f93c3aab6ca52426d1e24d3220f6724961ca01b8ed630b5328830fa3a1d46646a3f89a595565cd19cb10b957dc8d8343d833ab35ae7a20ae265835435db4031517ce3e3d113a3615ba9786324fb32011a63e558cb72daa579a77300540be6d0d573c3dc9ea3828ec9aa62038579462058aee6003e397346bf693d0839164186e3daa230f764b09b8bf527d2e0bf72514453f0b1aa59746109de25cc8a45903654900440f2b637e773594abe468cbd0a7837a22a575a3ba327acf3a62d975f3e4bcab9593d051e020bb4073e12d6e4bcba157aafb323a14b15a99ecad4cabd21a9055a52aae2e15b7243cc1c8f2b05fa7d1a5e98517ed1d63ca52efa5b414df3bfe60a2eaefab47d2c93f17833b07bc7f18e0a4da65d253dda3221a0af95b9ccb2b3aa828f7d8744f977b9eb7538e23b45dd551a8e546d24e6ed93b517b291a121dcc807ebada38962e818e42eca5bf98b76479267be5f60b1fbe22e7de398d4f8dd28f5887957fbeed3bb94a2ffb75959b9b0660720b912ca3e70045b97fcd3938840d768fc460fc820b8eccc859b3e65bfd22dba1cdb97a4a30b65d22bd894bbb6a0784664cb9e186657d5660b243dd85e9e14589707f6630f434eb77932fd63da8e0a0e7a3fe24e28214b3400c9476e63c58428febd63021037408fa0241e24f05195ce3cabe1ff74c4012d36b779828ee2e325cbe49025b08fa90fc527cd5c4f361af9f57c95c284bae7ae11e03481e2f7c61ac362c1ced838fb25e7d1ec840a3562289c349df572cfcf601d77f99285f7dab520ad744afa33bf5b14d7a032c94c1798522787f16e5496796025d1b850c17fb3dbefe92ebf4a6e6483fdcb9d4f210e6cc9f0cc7ee6df042de5182ee1a8e8b7cbb93e9a841fcde5a1e9642198e35f55cc640255d3c5d3edcd33dc2a66ce3babbf1b0738655b74fec81cb6fcab4993b3416d8e37412d162061042cf308911f7beb111a45359b66bbd14cebf9a19c2b2cc7db25c1a0c502d8b7fd999bac59eabc3371b0ff4b8b305a618597ad1200a4bce8e98a396839f3280001f1687215b20bff329db5c015314e46cd6d1c1986dfe5996db367e9606ed635ccdfaff4fe699d7525a89442c62ae88efd402bff4b4c34db28d56e75d6165bc20aa48bf1feb9f895c9e74a47943da48a2d4f110efcd892cd968c1fc80716b2ea511f54ca91519d967a28643d2058afd7c753e5c7c28f606a68490c8d10278e2ee04bff59a79cc75b91f7db0ea0877e99e7a1cae28c2b782552fe38123e0b431e8424aa0eedfdddaa3988f933777afba05ed4fe072ed6275962947a108e3f93b914164272f2ec0b61a0de3023234b8413f9e925c0318697e5430cf928f12019bb989645b35202325d80fde00010c96e70a4d12d13fd2153b8898189100467fce00cb3fd5cf43e6ed9c4713eec639fc543d8a6ad2f128df870cac0b61c27faa7597afb357aa7ab288ca15416673cbf264f78ba437a82f86807b507f6cc64016ef95844ae8fc4cf6523989bd78ebd1695fbf618c98c5394782531bbd6cf0ba56adb41a6c1aff1dffe5eb236a1c057b01688121e6b93f0bc5b93031ffae8f817f6b1c7fbe5d8bf989a33dd3a17e4c60b4d75f0ccdff99f09b563902ffd5dce6ff79c11d14440da66e0a8d2d7492245fd5667e63467634b05963fd1b18a57981df45bc6309d5ed89e89f3495bb3296aeca427b6efb381940148d5626d4d16f22769692c28cacea8f9525113dd9108f6d6d1f31fba3f2912b7ce966fd6c1a5d40e96924cdf37fb5f98e06ecfb1f6d484f3301996f96f46f0a77fcc57fbb25bf283f0d970dbaf3e4e8e69098b00064182e3dbf43564acd1a5d462f3a26304eb6a056723e904569d554f2be9c8a45371fcce62e480f566bf3481b84ebdc1f40171d526a7ed5e8adf3e5f83aac2e77bfbf059ec28386dc0587fd7695c121a10123f2df5e357b21359fd9e21714ba762b113d0a6f401e3fb2114f473c3094bafee0b11dd481a8cceceb387af8f4ada67919b62fa24db22e031196d248724e2af503908e7a7774b0ef8c4e8ac105835feaab037f5cbbfabf85fde4908f24c55d8c340f91b9473a6395b1e6b6cdadd3d6bfdae70c1411ae70b46fa211eb55f5bffcf0449f56627b9b92d26e061f82f691a4920cfaef5774ad666c176f242f339d2751428bc543fe96c6222fc09109a982ee5a776a7fab2969be0c4e673ac167438f7619c9f649a7b280ed3d831e3f1826325b4d8761bf5062853beb907b56b41b467e9f9ae6fa87e525afd936b8ccffcbe67a137290f4e9a8dad6d36d04e7b790393f6a7a367237dd867f398540ab028715cc1657d6e9d9b2c964265a5d6893273d6b282c9ff38a073cff07a180c6ee0ca5d04911dc360e40912532bbcd13b21997346f64e4bcb9cd2d20117cbe6bdd6b2f7105f80f9c5d2df0fa5108bbf30431ee6b2a6f9bdc79574b7f8787cd62c543a9ede8e6f0c6143afc864d3cefd0aca8b3a5da60cd3225f27d5addac9f19c987e35cc5aa1eb9a8f2d0422cd2033b9a9b0a257252b652614a9af055b7a3baeb6534d61b8506333e37b00637bd17b7de7bf111d00efc4138d6544da27379789a78d2fde338fbf2ec9a43ab6a26e91cab33847244b7ac2eb3cf177ec9f17c7675226495b1a03456907c542f26d6fb3888258a0fb921099dafdd8dc3bc6406b5e81ba8687c29be8cbc04f7e3c669c067dc513eb5228895672f43881e57e4f6e7aeca4609525675af49f6fa841a8c8d5de62e23c322b48fb21fbb34761d6d67fc8b71d99cd232e86a98be542b97a73de00dde8f2250632e8abe92cdc9dd691c756930432c759aafb91b2b699ac6c4b8621cc4235b0bbd6798920025350046319d7626c16ad57cad80602804142d251fee43be8b74ea4021926a977f1fcdeed7869b85460da4ce0db112e6487e80e4dc681877994367d5cc4197d4e996bc046aea8e9d55d91de51faab2ec45f65f8ec96e379768179c399b778e7e6cb2b18aa9dfad50c6916c340f20dc193c2feeee20af139d73a62076e432ed569f84f0b8dfa5ba767f027939cd33066de9db2bf7266ef87792c2317372653f3cf23566e5a8d98e0eac8c3c8448e6cab47e74aed23baa03f448e5a43950fd946ea5d3bad2598d28cca93735b2a8795bfa9108e422541f8cc5b1441708a51f481f3e8eb0d753406822aaa579274d083d88f6f3233ad1af9ca69b6b59158d3ac0582a703c468aa76ec2946d6ce7f476d9232658f0ce59e3b70e5a31ceb939674d8d491591ec91fd59722f906cfadd7ec05a92d12788e1dcb789f1717c3faa86085d65cf064e46a2acc1658229589be07b945a36d2acd5179341433039", 0x1000, 0x2}, {&(0x7f0000001340)="23a3fea792f61bf42ec1baf343695fc19884b4c6437bb77538e32287706a770a91e791a80b1448748f2b27aa226a9d5dd6420770be20ac875010757b05095aba8c4fa56fc0e6cb", 0x47, 0x1}, {&(0x7f00000013c0)="e85d5c5001540c1380f143e8b3fbb6e23348652a48b1cc6789fa86d88fe179e99ecca9b60ae1b2b2db63593f4f5856e8be4e6cead73c3a352d2d6dd5956124400304f8713f2f91a6d7cd2e0f8e7c4bc6a64ed81922807ae3b0eec1cec4d730badd45fdcaa370d69285b722fc9a14310e9a43c558cae55590aa2d64b624d225a2b8e0", 0x82, 0x100000000}, {&(0x7f0000001480)="f39b859b108d236f3b43fe4b0cfab6660b2cf8c6b271f82b94bfb06366d01d704091f12de0a1c95b7c04494b3d54ab19ace76c786ea1447549c3ecea51818fde6ee24d5ddbe97e8e865c3a61c8c2c51906f0d39956b2f68a75c3f9c083ae8bdb64f86841f653331adbacf2fe5c7585a53530202df24f51191a1813a7584fe212", 0x80, 0x6}, {&(0x7f0000001500)="3499e80530aea5d2a4ed2652098f15f211213686da5c4e400eaa716a0b7c38186e8f84895bc55831b4549c267256c540c4e9459258cfb4cdf75fa1e03bd49e17756ae9a14acd3e3e33145176f55831c93a542014c42574c2c8542712cb5945d68e97185657cb3d7fc9bb69cb", 0x6c, 0xffff}, {&(0x7f0000001580)="7757aa06d4c23609d66cf1643169b8100f34c1868f0ea741a3", 0x19, 0x89}], 0x20, &(0x7f00000016c0)=ANY=[@ANYBLOB='dots,check=\x00'])
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffffff, 0x3ff}}, 0x0, 0x0, 0xffffffffffffffff, 0x8)
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
recvmmsg(r0, &(0x7f0000001980)=[{{&(0x7f00000017c0)=@hci, 0x80, &(0x7f0000001900)=[{&(0x7f0000001840)=""/176, 0xb0}], 0x1, &(0x7f0000001940)=""/63, 0x3f, 0xfffffffffffffffc}, 0xff}], 0x1, 0x1, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001740)='/dev/dsp\x00', 0x2000, 0x0)
setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000001780)=0x5, 0x2)
r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f00000019c0)={0x7ff, 0x1a8, 0x3, 0x7, 0x40, 0x7, 0xf5a}, 0xc)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="0363084000000000f9b912b6e7005a988679d2e64eb906b7b7d5"], 0xfc7c, 0x0, &(0x7f0000002000)})

[  377.117217] binder: 20998:21011 Acquire 1 refcount change on invalid ref -33685505 ret -22
[  377.273164] binder: 21028:21029 BC_FREE_BUFFER ue8acf1371c6e5700 no match
[  377.305718] binder: 21024:21033 BC_FREE_BUFFER ub612b9f900000000 no match
[  377.313072] binder: 21028:21029 BC_FREE_BUFFER ue8acf1371c6e5700 no match
03:35:13 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x24, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:13 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:13 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x4c000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:13 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xfec0]}, 0x10)

03:35:13 executing program 6:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x1d, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:13 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={<r1=>r0})
getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f0000000040)=""/126, &(0x7f00000000c0)=0x7e)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:13 executing program 3:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x200000, 0x0)
ioctl$TCGETA(r1, 0x5405, &(0x7f00000000c0))
ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3)
ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d34438f760070")
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
futex(&(0x7f0000004000), 0x400000085, 0x0, &(0x7f0000001ff0), &(0x7f0000004000), 0x4020000002)
r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x7c, 0x0)
ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f0000000040)=""/9)

03:35:13 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fchdir(r0)
r1 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x0, 0x80)
writev(r0, &(0x7f0000000100)=[{&(0x7f0000000080)="d2bfdb", 0x3}, {&(0x7f00000000c0)="1752f2ac305641a97fb501d609e16d53aaf10957a09d559ba94d91e2b4c04a4e1fa8cf5767abc56369ccfc7beca679fe", 0x30}], 0x2)
ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000140)={0xfffffffffffffffc, {0x6, 0x7, 0x7, 0xfa5000000000, 0xfff, 0xc216}})
open(&(0x7f0000000200)='./file0\x00', 0x20840, 0x40)
r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:13 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x9dbd475ba1f21573, 0x0)
bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r1}, 0x10)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:13 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  377.710771] binder: 21048:21050 BC_FREE_BUFFER u0000000000000000 no match
[  377.728089] binder: 21049:21052 Acquire 1 refcount change on invalid ref 1275068416 ret -22
03:35:13 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000380)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fsetxattr(r0, &(0x7f0000000200)=@known='user.syz\x00', &(0x7f0000000240)='\x00', 0x1, 0x1)
ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x541a, &(0x7f0000000180))
r1 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x1, 0x0, 0xffefffffffffffff}})
ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000040)=""/27)
r2 = syz_open_dev$sndpcmp(&(0x7f0000000280)='/dev/snd/pcmC#D#p\x00', 0x8, 0x40040)
ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f00000002c0)={'eql\x00', {0x2, 0x4e21, @local}})
r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
fcntl$setflags(0xffffffffffffffff, 0x2, 0x0)
kexec_load(0x0, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000040), 0x0, 0x1aa9a1000, 0x1000000}], 0x0)
getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000000), &(0x7f0000000140)=0x4)
bind$rds(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x10)

03:35:13 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0xa002000000000]}, 0x10)

03:35:13 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000000040)})

03:35:13 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={"766580615100", &(0x7f0000000080)=ANY=[@ANYBLOB="3b1f00000300004006000000cd0fc716e7000000030000000600000097000000"]})

03:35:13 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:13 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x100000000000]}, 0x10)

[  378.497335] binder: 21049:21106 Acquire 1 refcount change on invalid ref 1275068416 ret -22
03:35:14 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x3c, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:14 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4, 0x13, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0xfdba, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="b8710e76e71c367a631040", @ANYRES64=r1, @ANYBLOB="0300000000000000"], 0x1028b, 0x0, &(0x7f00000000c0)="439122a7e7a0782c0ccde4efa8fbc5fa6e6ba8e81c7abaeaf4d58970a1c3d3c7179b86792bd4132493a0bc28ae76b97a520d945a7fba23f5ad4dce9ec83292431a08326d8d9f9ef6ef621157506700a332cfee8b275e727bea930368f460459452b0d362d274e3edbaed9291e4344ac98ee9ca6e3872e2984db65f576eab9e"})

03:35:14 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:14 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x20000a00]}, 0x10)

03:35:14 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0)
setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000040), 0x4)
getsockopt$inet6_tcp_int(r1, 0x6, 0x11, &(0x7f0000000280), &(0x7f0000000000)=0x4)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f0000000180)=""/193)

03:35:14 executing program 3:
mknod(&(0x7f0000000ffa)='./bus\x00', 0x1000, 0x0)
r0 = open(&(0x7f0000000180)='./bus\x00', 0x800, 0x0)
ppoll(&(0x7f00000000c0)=[{r0}], 0x1, &(0x7f0000000100)={0x77359400}, &(0x7f0000000140), 0x8)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=<r1=>0x0)
ptrace$poke(0x5, r1, &(0x7f0000000040), 0x16)
open(&(0x7f0000000600)='./bus\x00', 0x5, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r2, 0x29, 0x35, &(0x7f0000000180), 0x3)

03:35:14 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x8000, 0x0)
ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000040)={0x42c, 0x1b, 0x1, 0x3, "b8dff406559656a59037d030cae3df89c1756850de9480ae45a3a16213e179e5"})
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f00000000c0)={0x3, [0xffffffff, 0x8, 0x8]}, &(0x7f0000000180)=0xa)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x1, 0x0, &(0x7f0000000700)='+'})
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0xfffffef1, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0xffffffffffffffdd, 0x0, &(0x7f0000000680)})

03:35:14 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x600}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  378.599953] binder: 21113:21114 unknown command 1980658104
[  378.600665] binder: 21110:21112 Acquire 1 refcount change on invalid ref 1536 ret -22
[  378.613639] binder: 21113:21114 ioctl c0306201 20007000 returned -22
03:35:14 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  378.642200] binder_alloc: binder_alloc_mmap_handler: 21113 20ffd000-21000000 already mapped failed -16
[  378.653786] binder: 21113:21114 unknown command 1980658104
[  378.660261] binder: 21113:21114 ioctl c0306201 20007000 returned -22
[  378.676774] binder: 21121:21131 unknown command 0
[  378.686189] binder: 21121:21131 ioctl c0306201 200001c0 returned -22
03:35:14 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x10)

03:35:14 executing program 2:
r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff)
getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000080), &(0x7f00000000c0)=0x4)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x3, 0x101000)
ioctl$TUNGETVNETHDRSZ(r2, 0x800454d7, &(0x7f0000000040))
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:14 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f00000000c0)={0xaa98, {{0xa, 0x4e23, 0x1, @loopback, 0x401}}}, 0x88)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x1a, 0x0, &(0x7f0000000400)=ANY=[@ANYRES32=r0, @ANYRES16=r1, @ANYRES16=r1, @ANYRESHEX=r2], 0xd0, 0x0, &(0x7f0000000280)="20d8b21c8f538a4749cea2350f2baee67064a3a639bafad427ac98331b1979b65ab0b360e95e0893c8480acd24dfd324a42ff80042b906c2acd8633efca0de7d1e767494c6f72561c0ee35bb807d1ecd963424dd0ebb5c3cc7ed8089e1ff7ce0b640e6b58633805c3f336827c9c6b13bf27578fb3206797796585d596f843dc9e4a28387472a1bec95450388d75ce501e8a6ac99c217c7c80f809edc4c4ea5a3f0d321a52f06cb9abe6bab2b447679f6f04059f6db5ef01380a7d8f1558fe38fabfc3c1cd1fe95bfc7f72a733e7fc6fe"})
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r3, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070")
setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{}, {0xa, 0x0, 0x0, @ipv4={[], [], @rand_addr=0x1}}}, 0x5c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x40, &(0x7f0000001fde), 0x4)
r5 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x8040, 0x0)
getsockname$netlink(r5, &(0x7f0000000200), &(0x7f0000000380)=0xc)

[  378.694296] binder: 21110:21132 Acquire 1 refcount change on invalid ref 1536 ret -22
03:35:14 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x800000000000000]}, 0x10)

03:35:14 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:14 executing program 2:
r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x2000)
ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f00000000c0))
openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x200c0, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000000)={{}, {0x0, @local}, 0x2, {0x2, 0x0, @multicast2}, "6c6f0000e245f44303b68bc300"})

03:35:14 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x3000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  378.803111] binder: 21146:21147 unknown command 4
[  378.811582] binder: 21146:21147 ioctl c0306201 20000240 returned -22
[  378.888732] binder: 21146:21152 unknown command 11
[  378.891012] binder: 21158:21159 Acquire 1 refcount change on invalid ref 50331648 ret -22
[  378.904936] binder: 21146:21152 ioctl c0306201 20000240 returned -22
[  379.417722] binder_alloc: binder_alloc_mmap_handler: 21121 20001000-20004000 already mapped failed -16
[  379.427991] binder: BINDER_SET_CONTEXT_MGR already set
[  379.433410] binder: 21121:21169 ioctl 40046207 0 returned -16
[  379.439994] binder_alloc: 21121: binder_alloc_buf, no vma
[  379.440241] binder: 21121:21170 Release 1 refcount change on invalid ref 1 ret -22
[  379.445658] binder: 21121:21169 transaction failed 29189/-3, size 24-8 line 2967
[  379.453370] binder: 21121:21170 unknown command 0
03:35:15 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x3a, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:15 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:15 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xff000000]}, 0x10)

03:35:15 executing program 2:
r0 = creat(&(0x7f0000000000)='./file0\x00', 0x101)
ioctl$KVM_SET_PIT2(r0, 0x4070aea0, &(0x7f0000000040)={[{0x4, 0x0, 0x10000, 0x6, 0x10001, 0x100000001, 0x100, 0x7, 0x100, 0x80, 0x8, 0x10000, 0x4}, {0x1, 0x20, 0x7fffffff, 0x46bf, 0x253b, 0x84a, 0x3ff, 0xf5, 0xd1e9, 0x2, 0xb86, 0x8000, 0x819}, {0x2, 0x902, 0xfffffffffffff7a7, 0x101, 0x5, 0x8000, 0x8, 0x1, 0x8, 0x8, 0x2, 0x401, 0xffffffffffff8001}], 0x1})
r1 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:15 executing program 3:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070")
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
r2 = epoll_create1(0x0)
flock(r2, 0x2)
r3 = epoll_create1(0x0)
flock(r3, 0x100000000000001)
openat$userio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/userio\x00', 0xa0200, 0x0)
dup2(r1, r2)

03:35:15 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="036300000000ed38"], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl(r0, 0x100000000, &(0x7f0000000280)="66270d245946d70cb6960eaad722ea5acb10b05ba9df90860e2b2f26a79d18cbd42deea2d07b6fa4cabd887c215d057520dc13a2b6ddc6641c2d138e2ce4f7d745d9490b48704317e16cc95010d3b58e32b3991f0047bbd0e63cf4d96ceedb491bc5694712bdcfef80d3aec5c8e5d827e9bc8dfe160106673794daaef7971b6e59c46e3c7912cb5ee9729302e569a6a0229d4668b1b097f0ab597da19898f34b3ea95866caec150f80ba98678b6daae6c41c1725f69ddf92af277a66b06a001275fcebdc51c5544b82")
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/ptype\x00')
timerfd_settime(r1, 0x1, &(0x7f0000000200), &(0x7f0000000240))

[  379.461106] binder: 21121:21170 ioctl c0306201 200001c0 returned -22
[  379.474272] binder: send failed reply for transaction 92 to 21121:21131
[  379.487528] binder: undelivered TRANSACTION_ERROR: 29189
[  379.536833] binder: 21175:21177 unknown command 25347
03:35:15 executing program 6:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/mixer\x00', 0x20800, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180)='tls\x00', 0x4)
r1 = socket(0xa, 0x1, 0x0)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000340)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x108)
ioperm(0xffffffffffff2c39, 0xcc, 0x200)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)

03:35:15 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:15 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x80fe]}, 0x10)

[  379.569542] binder: 21175:21177 ioctl c0306201 20007000 returned -22
[  379.596272] binder: 21175:21189 ioctl 0 20000280 returned -22
[  379.611687] binder: 21175:21189 unknown command 25347
03:35:15 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{0x2, 0x0, @broadcast}, {0x0, @local}, 0x0, {0x2, 0xfffffffffffffffc, @local}, "4ece00"})
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0)
ioctl$VT_DISALLOCATE(r1, 0x5608)

[  379.634612] binder: 21175:21189 ioctl c0306201 20007000 returned -22
[  379.654813] binder: 21175:21177 ioctl 0 20000280 returned -22
03:35:15 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0)
socketpair(0x5, 0x80805, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000000180)={0x4000, 0x7000, 0x800, 0x6, 0x9b7})
r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
ioctl$KVM_TRANSLATE(0xffffffffffffffff, 0xc018ae85, &(0x7f00000000c0)={0x7000, 0xf000, 0x0, 0x0, 0x9})
r5 = dup2(r1, r1)
write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={<r6=>0xffffffffffffffff}, 0x106, 0x100b}}, 0x20)
write$RDMA_USER_CM_CMD_CONNECT(r5, &(0x7f0000000200)={0x6, 0x118, 0xfa00, {{0x0, 0x0, "243be6eddfd69e1e90edc89f75a248f5850f583b5f0301dd1be9df2d52666635984e8c10eaf9bd6174260809f0f0492f3facd58305104a3c0d5eb6c0b248c2d8f4597428217b1a14accaa75028d9e7c31f757838d6fe6eaa3df2ebd5e28ac99c57945e61c2d36ca49957b7136836c319b83539676f31878c4091ead13036f1855692beba04b1e71bb8d789eae93fb4443cb933885615244210f68772874711770f19b1c1adf0ba331c73e4b400d9a27ca4abd71b3b852b6b104814add8a99139f85bb4c894f5ae9658e4b2b323c6ebab3f341a6c8b8929822297601fc48cd82c1df8a581cadd166031c0e2ee4cc34bf923a43bdc5799d96ff0ed36c29de71d6d", 0x9b, 0x3f, 0x3, 0x101, 0x9, 0x62, 0x8, 0x1}, r6}}, 0x120)
syz_kvm_setup_cpu$x86(r5, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000340)="b80c008ed00f017200f2ad66643667660fd8950e000000baf80c66b87ce0098e66efbafc0c66ed66b9800000c00f326635000100000f30d9f166660f38402f66b9ff08000066b824f0000066ba000000000f309d"}], 0x240, 0x2, &(0x7f0000000500), 0x0)

[  379.682819] binder: 21158:21199 Acquire 1 refcount change on invalid ref 50331648 ret -22
03:35:15 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="03e3084000000000cf7a077ba4c3cceafd6a2029d7d0dccd6436d34cfe3b38d095db8b7544cb7655bc973ad6bbcfd1a141625548b694a57895398b90748b14e65a2cb30bb81b7b75d24a4e027606c4bacf084cb0b233aca9282de6f86d1d90d471af59ea0ca8e04fea4656cd1a0bb66e5438a6c862b9debb6d5efb4a8263a76afd0db4700eb2c7b71ddec1b7dbaf006cfada2c00563be525251ec497b17f9758f240b8a320312d12aa078bd433287db2"], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:15 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x2fc74}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:15 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2, 0x32, 0xffffffffffffffff, 0x0)
r1 = inotify_init1(0x0)
time(&(0x7f0000000100))
syz_open_dev$dspn(&(0x7f0000000200)='/dev/dsp#\x00', 0x8, 0x105001)
fcntl$setown(r1, 0x8, 0xffffffffffffffff)
r2 = fcntl$getown(r0, 0x9)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000180)={0x0, @remote}, &(0x7f00000001c0)=0xc)
fcntl$setown(r0, 0x8, r2)
r3 = semget$private(0x0, 0x5, 0x200)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000140)={0x0, 0xfffffffffffffffc, 0x9, 0x2a})
semctl$IPC_RMID(r3, 0x0, 0x0)
ptrace$setregset(0x4205, r2, 0x206, &(0x7f0000000240)={&(0x7f0000000340)="78ba774c1ac3d7c57c217fd90ae2d6dcea5f7be1916ef366808d51a6df482333d32ea1d8289f8f8b5f24332b34b037eff85747c7ef7b801ef5564a9faa98abdf36b04c8abcaa796cec0511991916ab9398935f28090c92a6d5ff84503fdfef0c6f1b3ea176d015cdb4638604aa72eac2d39ccb7311ca39b500f113508cfb84621576f811025c528371965237a78c7a6f0a1b850054ab53c582d0a350f7e07bf9fac33fcd5307bd39bd3fdf31d11789a75a25d1b21f88a091acf9d9e78fad", 0x359})
fcntl$getownex(r1, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
ptrace$setopts(0x4206, r4, 0x0, 0x0)
rt_sigprocmask(0x1, &(0x7f0000000000)={0x3}, &(0x7f0000000040), 0x8)
prctl$setfpexc(0xc, 0x0)
ptrace(0x4207, r4)
ptrace$getregset(0x4204, r4, 0x1, &(0x7f0000000300)={&(0x7f0000002100)=""/4096, 0x1000})
ioctl$void(r1, 0x5450)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000080)={{0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, {0x0, @local}, 0x60, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:15 executing program 6:
socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f000000dff8)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
writev(r0, &(0x7f00006c4f60)=[{&(0x7f0000317fa3)="b5c5242e283536f05dfcf3c925d43c6cf1eb17fde04dfbf2b3", 0x19}], 0x1)
write(r0, &(0x7f0000805000)="346bd71b3c015b53c0833e97df6312f9b0659db5b29837caa9", 0x19)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000080)=ANY=[@ANYBLOB="020000b041bbe39255125ad7b78b00", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000040)=0xc)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000785000), 0x4)
setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000000)=0x80, 0x4)
writev(r0, &(0x7f000063e000)=[{&(0x7f0000a66000)="da", 0x1}], 0x1)
sendmmsg$alg(r1, &(0x7f0000000280)=[{0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f00000002c0)}], 0x1, 0x0)

03:35:15 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  379.815056] binder: 21215:21217 unknown command 1074324227
[  379.864935] binder: 21215:21217 ioctl c0306201 20007000 returned -22
[  379.877107] binder: 21223:21224 Acquire 1 refcount change on invalid ref 195700 ret -22
[  379.892305] binder: 21215:21227 unknown command 1074324227
[  379.899444] binder: 21215:21227 ioctl c0306201 20007000 returned -22
03:35:16 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:16 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x3]}, 0x10)

03:35:16 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x25, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:16 executing program 3:
r0 = memfd_create(&(0x7f0000000000)='bridge_slave_0\x00', 0x2)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f0000000080))
r1 = add_key(&(0x7f0000000300)='logon\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000380)="aa5b47656a315a16f07e63943e070fa54b122db311e32784146bbdbed0e54f8112c283e2d4445174ee40332390b66270b9805bb82f785cbf85fe1ebef24e6a653e0d4f08509a16901fb861a077dc00aa9a06546eab4738331dbe8ea52753e547ea2a66299e9ea7294d5564dcbe44f03a8c5cec40dd1eb6c8afc91597c972d6c136446ea4c51564ac1b07dfb6067f966ade7a4bf1e160d21e01686e690e9fc996872e406e50459813f64953a574857c0fbf30f4021848a41e946d5b3b8a73e13bccb87d7947ad0fe6063a2fa2fc4b4f65bf78a5778427be12ff10da3b875fd508dadca7fb4504864731e542e199c07392efed1e0ae53476f9e96620e29ac55903bb90b15898bbd6ed1d94b02cabda20b56938b719920ac53eb26d47640718488f72f0e77c242ae0340967c9f833887ed7a79f8b0da986a6760ef9c07c4e2bd55ec8804f648e3c67895db9fd99bce5bc66a9a29b6578885c428d4dc1cf61901728de91b6c26f2852b30191603548d3e2a3b981c29d1c5ccc3514ae0d27e5bad54f1a2a77b8d2f4528b0d86f8438bb5780d12cfebcac9695f3a83f2e2652352b9daebe081f9d35e692875e37609191c2283cc293f9e838ec2bd41e1814003f057d44a19f15ae2570d83f477f291581722cf944d3b82e76c568f7dabca9f1fb4681bbff626e9d6be7427a6c5a2d55846cbc8c31dc0dc4b444df7f14520cf02f4b70e91436f0ec95115c08e3844558fbc2586f70a553ccf1da24c90e764de836a17ce7dcb5cad18c21a8a56a2fb8396d416cc9c94c6fa153599288fce92b8565e15889afa3c238fece04b0bf92144e9b5ace139f7e43dfe5312f62b9d36f29ac93166c2f0070597d29f4dc1f0e2ffd77036623b0c44c7a597ad661fbf50311a9754f4653d6396e16dd0ba7648d29ddd482a8ecf75e3a7312eb3d8892b45ea92f61ab61b61d83b64e0f97ef3e4925a4223fc54e13f4f2c410b9286e704889d5cff630dae3253de3c2ab81013a5bd3f84f32be331375ace78981fbc4c090ebb032fd9581402f200984c1872975d62d11eb61f46950ae80749a9dc7690142fb07522dd53f6048c1022e458434144ea94557f04763f864687566e70aa2ee974cec971f7f23f74839ceade03a886bf8a602ad3d0d7462343e1d5d7d4199b30de82e26bddf1a844900cfe9c7dcb0dd1af2b79c9f10576b904225806e6c9b12cdcbb0a43b96772eb507cf8d4402f8adccae2cdba7f9b9e790a990f5d1151ba0955e9181fffa853228968f286cbb7cee9b783b9996ffc93f04a0d1c87e3deb437c421c8b3a7f30e1eda72e499b8119187c501d04e5cc358b6c750c3c12387ccb5b4f3ea594cdbe59801bf5594bf94184739d0713fa21d8f70cf6f3a0860cdbe20cca3fa5942460ea8ef2cc3cb232d43454d9a717c3deb28ffccbc6af7879c6579c28524d8910a271704bb66b2d1525a061d48cc98a5a97c35a20f9fe5a19924c384ed84ad544e9030e028de63f16422207bcde6eb408c407bf66a09406e8153515eaa1592ee90cd6c0d199f4afe7adf3d0636c9ae33a10f6921dc504b946e102da1b12030d88349e5c7ce736ec67402f6816c7730cab072c7271f9a9a20d017efba4e4de588fd66fb27225b2ae767f4b68decbd2fec9c3d1a1c9f9e8cae5a8560a20ee2cf2209f6d014daf9fdd2eed8d57baed67595e1ebf35bd8c5f78fe4afc87a5fcb02b51fb460bc5e23630ee578aeb58b6421bc88e82a5fa75602fbdf5468785468c533075af207b1dc0ac3d71691beaaec25e811bcf150215b77a3ad598830df908b33584c003b319c64767a80f8d305a9212d724a774346c7f939b957e2a47a4730a554dcd013df3a57f5b53fe20209e1b0908586eaff59c0fe203e6d31dc7ffcc044558f337c8eb722b305dfb6227d6035d9849bb57456c37cc08e8f0eee7b58a60129a59b7a43c0a88fd5b3fbc2f73124a717098f6c1d3ce319f45e76c54bdd6f220925f56411fe9e42a78fa14fe5211dbccf21aaddfdf930448297d2386f579b2095e1ce261b3b1b57bc2c348c1bd7d3d498c3fbf26ce0e0c6841ab59186f18fdd07cc3b7054ac05261ac079aa471a4a9d5498bef9ccbb34b4c9eece98cdab64c90faa7193522d22b9c9c90cec32eed7c2c7f8a5ff2438c0e8770edbb2875d9418f730966335ba138835341e8a012ded4f8c0f1451fef2c0eb433034ecbe5ef6fc120a4c3798da878d520090b315b9e94d34c5ab3f4ee89b25b4d50c85fd6323f69e2e7616c324e42b6384bacc4dfb39ab6c555cefe6863ebe197ea23b4656f23f019c9f71db0994ce1a95ad57ba14fe507e5f47aa19286242b49838e946a485733748eab74b812e473b15d944ac361efc63851b606d526c2096f8ee4b657810ad893b2ec37c47f7ab23c09e09011e8b3c2ffe02ab7767d08a68eacde6ad4baf561d7d8ac965daa654c97a9c2109b6bb404fcff45b0befccd63e0a7bc7f72ca3480450c0e055f7a39ba87f7bba56fd97010729c71131dedc7d3e2a6b1ace0110e1b9970c7ff9210baec14d8a8989fcf27503ea8c6e282c4af838feaf7e5503e30c04eccc73746200a563f2e5c050df1a7ee53d6af38e9bd566e1ba79e51cdbedf1a827cc5c1c58ab723b4594b672224b35b2907e97723ac89284ecb4995cd92e92f86c908d8c4bfdb93e1152a7e56783648a79dfe638d4424d25fd39279feab9532c4e7326e5711e1781969b41caf7350af92147437849a16db46df258406c7a748b9601aa17900671ff4c1a6cac9a5295483fb08486f808863a32ae1a61a820b5e1ca78466b1ff6a63d63acc517d1f2c660adeaa80549f39bb2403fe7ff79d9c56545330659a9317466df5960e914e97369ae2dbeda853b26337ab7eb12f11d2de2d550e24d4d3599aa73b686f1a2d6a8a4b489795fd9e88fc976de107a19dafa413f5be01b2e5365b8b1a8f699a0a037a5c2e6992fa916c993318ab36cb5a92a2856d0bc21b0549e30eda7acd3f39eb4ea4d27f095dc41238016f81b14063a426648f3b35285c3fdc7a376b5c74a29baa10cbd8f7f4c3640e973fe1106db64966fd6b078c1bf62944eb6b14ee18938ee18d78ec10e8096d2ed8d1c99a4eeedd3386f380a675d7505f16f3940537917e7c9e785e731554e20f0a28860c29eda5331e8b18b8d1bc7231be789692e60f89e152975926ece62aa3f754cf3699c442a0e4a64352934902fb08b84eb1e1d753c4a81a5a159c6cac86c542bbed8f9c272ae9872aa05d1315fe6d183b9099d2e4d2be580c74a1dd79d84785963d2a1f9f4262f7eef54062eb10a6697e8c7365929c9369a66cfe704916f3479a0233ce9a58766a33b90d244bf490fece0b003b6b154f067029bfd2e93c89c0876aee3d5574bf7cc2112a18b03710aa08117077b3e2df2b71be09c7dfbfb7621ccb8aa572ea76e7f32f17ff19a32cf344ff1205949d3dac93e139626434fc89bcd2ace7ae016e534ab1abaf2d21781448ebbf0249f64b707aa4530effaf1a5089619820b0f54597412332f0e8d3243496dc8450364cd10cee960d069ec21550e2953e8b424ed894f5b038de6e341dbb717ea9ea63e4b568edd7ecba1459ca2e4c457989101d34b2cbd315f38c91487c0d7582b8e0ab25f1cf9a20e586b9195ebe56129530f18a42bece740c31401303d7135c56759a110d8843848a1e0f1494d9761a1fbbe6ffd3cf410015b6a71c89462b50caf5253b4247dc1ccf9783a01fbfed2ce309986a4d2b44fd197d8067f22f918848c7a0cd4702cfbfa315579501b1b9af101bd7e88d3d249330136ada46dba6d59e2fdf18d07aedb074985ccbd83a0049a4b829fa497eaef68355731f6746fc1c882652d3dd5c9875cde72e90f9c5895f5328ae8576a5930092db69d685bd0e0433dad1b11e8f45e6970f80130544f492cdb733a7d898fa9c265b7a2d2a4f0b28cd6ccfb7c4a5edb9a5fd3715e745b06d872dfae8361f53bf4d192b4d5e2383e6e7f5ae859335d138080286b9de88276337ebff263ebaa146a3173521bfe1a4659c868398e369abb49eb038a4e24a60d7aef76a4064502b8c977516c76356bb4d6de4540159f95badac9c8bf9c876d5b777f5eeac55e2a4ff22be04abdba049c001c5c7e076c1dd2276f1b5160e3f59a1278b3a98ac3c53229ab3bbb1138e251f31bcbf318efa2ba4ec4716a264490f756fe6a6394c9988120c79395b89d34a4bb4c9f7207a632e81dfbfef3396c2253961fcd5cfa5ee76b135f4f7c8991b45f11345f7d9f734bf6ad04292dbe35147b3871e41c9b44da744f04a2c8357f4570a375ae4d04bc9c26d006b5803ea0cebe2d6cedb130276519ce6c7655b5ed2f4c2a77d696b52ea7262aeec338bd6bfcbb4a7ed3b45d6b668c220db26bb50bb0c879974bd0c14d4b7b7d5652c861455202fa7db5f188e93a27a12d2dde41650f45b4b83bcc32e3c4cd590e14f4513b8d0446d7b1906cd2d1f5f3a4de4f7f74e098ea8132be07be0138a75ebd7536a31c2eef103401a9f4545d963c704c8ed219ba026c1ac3820efc0dd40a9d8509a899834cb28ac9300dffa416b8363aff89fa9da7a9521e88128b647a98019490b66f03d554d24445bcf60380f6027e163385a7e0112ca2cd275ae19c68d89f97a42ba661ceb2e85072bc7ef8e4b2cd9a79a26e5d35627123491fe2bed5d0604bd684e0bb251552e5eeab055c2837acf5ae619640929a2a87faaec1f7405586f10e82257eb5602d010f5eb053e18b2b938e4c40f8f899e59d52c9cffc1a0fe2c00454dca3ecd1c95950f70de035f9256c51f7ded9c779313ce7c5d486759f8b529d6ce7b79366be2e281eb89fecc3e9d78979fc84a1c00ac3c9e551751b107c3702ea1317a97496a9b2d36c6a1bb1d97450ea75f75749c23844af9d4999c6be7035e093a97910200984c6c584267713ba755d706191f2a068c5c8d96dde78d2c16de5711d0694187db2617e905ae2bf4e95526f1f31d3dab1628e1e739b4763620bce972093bab666925a838dd724ead77af51fc12dc2cbd7f32c0b43694fd8122a70f86cc799f73bbcca40a9516a88fd7f7a402c5b981df917d7c9005a1b71191801f8b60eee95896f65c22146bddf17a66e935ade3200a04c050bb57d0e4a60a80985b1dc14352a77c619d39fe244620675f752523ad585f677c81396b638c53b10244ac678aa58a2019341fdca557882e9965f8e291becd54e49a662258155d344c47a58551e752956075f2787c587e8ca64ab637a35e4f42d51c2bde4121ec652e4f3ad49d2ac726b51cb777707247f7a944be5464304cd5220d4981ac84f4879a34713215f723abbbb7e4c2ef847a206cff350c49bd77feb09dc4ed018626ac3417f54327dcf05c0255ae3e8d6357bc6d1033a563cc5629f2e8e2a5c2d9270fe41d14cf6f2d8d69742c479a34e610cc817a2bfe62109c62145d8aae5fa3f6d824f95ffa0ded9f01b57c003d932a59ebfe109e3b0bcbce351012af9e55583434cd0620cc683725dcafef0674ba9c3031666ba144e387e4a5a84efa4ff2e1ae7e7311d67a41fc431fbd3f04b42abe627d251b7e5f000a40763f8d49784bc63fba7674cbfbb2a2b4b85a22b328db80fa2143cbc143ef3703ff953226e0a48cadbc56e507c2dd486db020e87bce3506416a42cac6ddf85b97147f1c66a02caa490673228b2a3746b2386f10d9782f151c844fe45081ee529588b31d68ec866fa32b61d7967e66d4eaaeb55258d2844694de0bb99c8176ac17ea20abe20a2580b160e704a145b5f", 0x1000, 0xffffffffffffffff)
r2 = add_key(&(0x7f0000001380)='rxrpc_s\x00', &(0x7f00000013c0)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000001400)="b8a0b004213c4c65bb477ee61d36d764d36b45b29fbb6a348f91dda28068da5140680e8ef307673b3e7336e074c499164e1667ded84ee3bcd079620dfd24d89e769f680e673f3f5ed333fb832e530c8af4498a03d5592cfdad9527148cb5", 0x5e, 0xfffffffffffffff9)
keyctl$unlink(0x9, r1, r2)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r3, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070")
r4 = socket$inet_udp(0x2, 0x2, 0x0)
write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="7f000046006b"], 0x6)
syz_emit_ethernet(0x1, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaa8d1c000700bbfe8000000000000000000000000000aa0000000000089078"], &(0x7f0000000040))
getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@multicast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f0000000280)={@ipv4={[], [], @multicast1}, @remote, @ipv4={[], [], @remote}, 0xb6d, 0xb, 0x4, 0x500, 0xfffffffffffffffd, 0x1000040, r5})
setsockopt$IP_VS_SO_SET_STOPDAEMON(r4, 0x0, 0x60, &(0x7f00000001c0)={0x0, 'bridge_slave_0\x00'}, 0x18)

03:35:16 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000180)="0a5cc80700315f85715070")
r2 = socket$inet6(0xa, 0x80003, 0xff)
setsockopt$inet6_int(r2, 0x29, 0x16, &(0x7f0000fcb000), 0x4)
r3 = socket$inet6(0xa, 0x80003, 0xff)
close(r3)
ioctl$sock_ifreq(r1, 0x8918, &(0x7f0000000040)={'ip6tnl0\x00', @ifru_ivalue=0xffff})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:16 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x9, 0x0)
getsockopt$inet_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000040), &(0x7f0000000140)=0x4)
r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
r5 = syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x0, 0x882)
syz_kvm_setup_cpu$x86(r5, r4, &(0x7f000000c000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000080)="f20f2d7e00c4e3bd40ce630f07f7cd0c000000660f01c90ff8cd0fc7588ab8ad6e00000f23d80f21f835000000c00f23f8c4e3cd6971f500f20f08", 0x3b}], 0x1, 0x0, &(0x7f0000000100), 0x0)

03:35:16 executing program 2:
r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x1)
ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x4)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

[  380.414384] x_tables: duplicate underflow at hook 4
[  380.428675] binder: 21239:21241 BC_FREE_BUFFER u0000000000000000 no match
03:35:16 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:16 executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0)
r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=<r2=>0x0)
write$P9_RGETLOCK(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="260000003701000303000000000000004600000000000000", @ANYRES32=r2, @ANYBLOB="0800747275737465642cdc6c7b0a41ebeda76d6d1853c77a8c73e65598a08379afedb6d1bb00e056bf5dacc3120d5e06046d69d5202eb891fd0cde32fd9272568d1574b3e44e4d0ebc619909e8805cbf2bcab4f74382574496f2836f939d6b64281561ff45411075004a74014d1feaf9a185f649ee9cea7f88845b4e250d80cacae0089734fd286e4b4d82fa48b86297884077b029ffa861dbc0f1e2310332061cc1f31c681350ed3ca8ff0776220b526d655034a71116840fd46f100613b2cb86551d8f589be3890d55c62a9e259c94fb3bee3b93e0a4f14d4834971305f7f2c6677a77852b92a3b1f14690b5845894d90badfcce43e3ddedd6d6eda742a46d9ec55700de3a599c4ad1c6ce647b80b223528855d96710538506bd1900b1e726dfdbc792862cbee1fd03f1fc6a7620"], 0x26)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:16 executing program 3:
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x2200, 0x0)
ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000100))
futex(&(0x7f0000000040), 0x1000000400000085, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000080), 0x20004021fffffe)

03:35:16 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xd0000000000000]}, 0x10)

03:35:16 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0)
connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @random="115c76c75f90", 'veth0_to_bridge\x00'}}, 0x1e)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

[  380.656947] binder: 21277:21278 BC_FREE_BUFFER u0000000000000000 no match
[  380.665365] binder: 21223:21281 Acquire 1 refcount change on invalid ref 195700 ret -22
03:35:16 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x7a}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:16 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0xfffffffffffffffd, @local}, 0x8, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:16 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000001680)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d09403250c35a7d2276c3e34d2a2de59cc0b8b5d7ce7191a1e2f2eac7982811dd70c92795813c9ca36a5b07c644771170fb9f54f5214970690fcd8700008cdc0aa506794b982ec98288c453664efecd48c7c755ec376f5ee786dde50e92650805a8a3bc76f54fccdcffad8acb46390eab596840a683e762d92410f52bcf6fde0d51602db0c312052c819a1d001181ef871433e2de27cf652bbb8590353b6b78d5cf38ab0dd0b23f379fe7872bc6c05e987e703aaaad992a5863fd306bbe7d7434b414a1319a46bf311440c14f7cd94b", @ANYRESDEC=0x0, @ANYBLOB=',\x00'])
read$FUSE(r0, &(0x7f0000003000), 0x4ea)
read$FUSE(r0, &(0x7f0000000680), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
read$FUSE(r0, &(0x7f0000008000), 0x139f)
lstat(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000340))
r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0)
write$FUSE_OPEN(r0, &(0x7f0000000640)={0x20, 0x0, 0x3}, 0x20)
r2 = open(&(0x7f000000fffa)='./bus\x00', 0x140042, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r2, 0x0)
ioctl(r1, 0xffffffffffffffff, &(0x7f0000000b40))

03:35:16 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:16 executing program 3:
r0 = socket$inet6(0xa, 0x1000000000002, 0x2000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x30)
ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={0x6, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x14}}, {0x2, 0x4e21, @loopback}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x19}}, 0x200, 0x3, 0x9, 0x100000000000, 0x7555, &(0x7f00000000c0)='vcan0\x00', 0x1, 0x1f})
ioctl(r0, 0x8912, &(0x7f00000001c0)="0a5cc81c797b79d5545deb9408c1167136e1d2aee4be7521016fd4cc9f53d35df6b3e5a956018e6972dbde9cb704453a1bcb015f79ee50f509357c762dceba345af317b1740de12c880b8da16b9c4b9e4215741650168e63aeba546c6b30e9bc132d935f8f52f3bb00fa82ca2a6c1061375ec00af47e24e7f9dfaea2f10e4c0132ba422f47a16be340f1777fe2da6808c8b2c5bb4871f233ce543671f07f65aa1764c6d1846e75e8dcd05ec6f2d5e325bb3f8bb3d81f734d2376f403b904f57df9dbcf5c985fe0eb287bd9d249d3958e97d308d3825a63a71e2b1434e7deaec724a6648b836bf65a055dafe7de96d98401cd5840b8d30cf904c383b304ba9340601f56eba01399fa484d1e660e2e3191da4db724a532bd9aaf2e0000000000000000000000000000")
r2 = socket(0xa, 0x2, 0x0)
connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[0xfeffffff], [], @loopback}}, 0x1c)
setsockopt$sock_int(r2, 0x1, 0x1, &(0x7f0000000080)=0xff, 0x4)

03:35:16 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xd00000]}, 0x10)

[  380.732897] binder: 21277:21285 BC_FREE_BUFFER u0000000000000000 no match
[  380.807887] binder: 21298:21301 Acquire 1 refcount change on invalid ref 122 ret -22
03:35:17 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xc0fe, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:17 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
socketpair$inet(0x2, 0x6, 0x2, &(0x7f0000000000))
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x2)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00')
sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x462000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r2, 0x304, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x200000c1}, 0x40000)
openat$cgroup(r1, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0)
ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0x10001)

03:35:17 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x3e00]}, 0x10)

03:35:17 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:17 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80200, 0x0)
ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f0000000080)={0x7, 0x8})
r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f00000000c0)={{0xffffffffffffffff, 0x1, 0x5, 0x3, 0x7}, 0x2, 0x7fff, 0x7})

03:35:17 executing program 3:
r0 = socket$kcm(0x11, 0x3, 0x0)
sendmsg$kcm(r0, &(0x7f0000001540)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="c10800000000000000021fe4ac141417e0000001", 0x14}], 0x1}, 0x0)
sendmsg$kcm(r0, &(0x7f0000000a00)={&(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x4, 0x2, 0x2, 0x4, {0xa, 0x4e22, 0x2, @mcast1, 0x3}}}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000200)="1d42abc4f1e726974f5d94c40910f26b950fb0f505f53bf245d8f42932097cd2dccf4c41a29fec191cfdf9ce2cd5c6860dd0f65eff2bf472306192224a792fc1609fe67a989fda03587f910f39ad0e2798ff4d5a7f067825da8a4e7df0e157ecac1926b5e36272735825e9cc1710fd91126905f55c20608376e7b19c557e28a35071bef94c547650c1d0fbd3f8678d83b2dc0d6f5d20c920a6d658d5989cd108c8", 0xa1}, {&(0x7f00000002c0)="3bfa37a1821da6eb43ad5463539d68790bff5bb94ba7c75e07f7b7c99ef3e58e37d1a5c9180a97d5d5560653c1a003fb811b6b7e0af065a09f93bba819bfd90f862d7617932d981f85b34fd8a214833453bf8b3cc2abfd4313a0a0774bf60a5b1147385e2a39639334a69ac308e0803c2e8e1c5336f987bb55cffe8f16528fef5f98f70448f4779236587aabe8b51cc0c3c0847a5522e5b0bf897447b9badc252ccff0ab591c474659f3dfda17", 0xad}, {&(0x7f0000000000)="7044418a74bd2814bf1cc312cd8175bc764250f38cf4a2d3661dda884038d7d49400882c360702eff8f1a0996a61383194192944fe0f4a9b8d1627d9", 0x3c}, {&(0x7f0000000100)="fd55cf6ee02a95beb9160520f28e4011847f344d27302dc2256a590cda53", 0x1e}, {&(0x7f0000000380)="68e72c5156d369335d6a5d0fe8e0127c0acc", 0x12}, {&(0x7f00000003c0)="ea8f34d59ac7212e1c9266f35230ff0e463fcbd737b1bfcee1a29068f68ab6c1f6abbaf435b35141b32cb6f167de3f1db5bb6f5ee5fde945", 0x38}, {&(0x7f0000000400)="b8ad145e6c1ed62860563cf37fd9dccfbf903ada08a4e5ac5d4ca90e2b30158d5d2a4c5e566d91cd0b5a5daad581f4b341f1f80a02311b380debf36c49b587ef018cb16c90adbd6eba61471ff7ed881a16e6a99b3fa176cd96af5dfdfb261cf481f8595501622c6722c41bbdd9c92db57d639125b27b378ce5d1cd96fd9827575b1d07241637a074465305fbbd25c7662078322e9093451db62f71ddbdd790579a4bbee4d0680dbb2eee3d4a263fce00b6d911d2dab3", 0xb6}, {&(0x7f00000004c0)="56084c74e749ed3140db2b8f9c10b4c847c15846367520e67124e50fc28c594b12abbd4c6476ad4436b765112a4c62bd8f8ca83385b7366f26424403f914e2c0cc61cb8d88eadd84347ec7141a3a55573e8c04d140979afb0955168e696b798f74071e9afa7790a66db276c911da49afc568e47ee48237694ffe2e47df72d810d7fbbffe49683c9dcd00ca07912fa733cc3a8312f2fc056092150fe6c05039", 0x9f}], 0x8, &(0x7f0000000600)=[{0xe8, 0x1ff, 0x61cd, "f8d013f032a2c0e0fc61789684907e809d1c4bd613a9c7bcccd0f280844b723cd4d9495fcd5613d33f1039c8e7d6bc1ac96838b5bb46990f1fda54575b5f83f077d277b836b1b76b6e44872f2911f381785703fd67e9529b822b9687142aa6df94f8dbb291c2d22e6a17b0c090243dead049b05137d70e8a48aa557a29ebd0575b5d464a628c4f9763330c347f0b76f77b49a3ae5377467780aac1785020451082f1cb2499623d0c969d65f466700dbe8a9bf662e02977ac78142245c654faae650ecf3fc81709f79ac0e375d758191586fd19a34d"}, {0x110, 0x115, 0x7ff, "95f28e34df0a2546eb1791b2376d588ab2bd0da6737c04967999516d59dd640f674d91a0e6faa992343721a2de3f21472f1e0a48bfcf03165e89dafbc72158085c08adc4dbf5b2a0838027c74692155446145ff07dca75a544777b11882fa34360b0f5c97594f9d22d1aa0d5d072de53a53863c89a8992557815469314dcc6949ecffe145048034cb68cb1618fd94bb9192d4b723cc6f73099833dd5456d77ff3d2f037ad9e50e6f098686cd3a0322f3e4eae22218dc9c8cc6a5e6b894c9ed2278fc51917d9b2ca3c09b18cf65b36e87947de8c22c02041b39547fe3e12dd70010e9d15d23e4d1209f0c59225b33b5765b3faeffd10ec13915a9a22e"}, {0x110, 0x117, 0x3, "ec96e9f3d09a37fb1c81c9705649f9447a9d2aa396837804f285bc132434dce77e26eda06f085454f4b6d5000769f8d4f341f99f0520c2c258b07f1c38909f41db2636859afa108994a5290978cb6d2459d34fbaabda388e1ab4d82a6fd73d1aafa075ddda9cbbc73144c6bce6ce221bd3a726eab4c502149e33a19adc5e1e1a10d51632916a28858d516ba0f195d59476888b66fac05c2f5f8c583e843a239db34a63ec768a00b4110e5c0a57d23445925f8059fd8571b4da5e532e6a5141ee8f0e3efce9b6fbb23fbdfb28e71891c6d3835494f482f77541b5ff959882bd2641060a9d30341904e68b589327d84dd0a277fb69a06dbec005"}, {0x48, 0x0, 0x5, "90f345dd8416a1fbb5f6cc8e98a33ffc19dbbef4349a39291867d64ab06a513928c69af864a17c9ffdd0366afb31e12c8b"}, {0xa8, 0x29, 0x8, "e47d4050ee08c8f6b9a96e88e72081c4a51e9a765e6e2b4334ab390d1f87345ee882f0b410716502f21833c241d8c27e9debdbd39348f1e336b801cb2f7fd567a2e078b44f0bc8c8c9f4e74a44bd3eea5aac6135789ab011f9b2c230e196ff2f7be6477517f6b052ac8cd6b07673ec49bb4eb0c9e12ac67574a52e4415c103267febcc0673ac00552a7063c45a12c21bc9f4e39666"}], 0x3f8, 0x8000}, 0x4)

03:35:17 executing program 6:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x7f, 0x7, 0x5, 0x1}, 0x2c)
bind$vsock_dgram(0xffffffffffffffff, &(0x7f00000002c0)={0x28, 0x0, 0x0, @host}, 0x10)
pipe2(&(0x7f0000000040), 0x0)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x2000, 0x0)
bind$vsock_dgram(r1, &(0x7f0000000100)={0x28, 0x0, 0xffffffffffffffff, @my=0x0}, 0x8)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={r0, &(0x7f00000000c0)}, 0x10)

[  381.324656] binder: 21312:21313 BC_FREE_BUFFER u0000000000000000 no match
[  381.348975] binder: 21312:21313 ioctl c0505405 200000c0 returned -22
03:35:17 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfc]}, 0x10)

03:35:17 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x1d, &(0x7f00000002c0)=0x2, 0x4)
getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x400000}}, &(0x7f0000000140)=0xb0)
setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000100)=[@in6={0xa, 0x0, 0xffff, @dev}], 0x1c)
r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0xf, 0x4, 0x9, 0x9, 0x0, r1, 0x3}, 0x2c)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000300)=ANY=[@ANYRES32=0x0, @ANYBLOB="3000000048741ca889110cec5de4773101000000000000009aa6d587b3f849486e2bfea9f3660173ff0000200181ffffffffffffff000000b399e6220a004f9abf4f124b90574aec4d01c6afa6468d363e2cbbfd918f626150c36c22027b36f77ddfb0621ed647958e87975ef16ca035bb635787c744329f0156bedb9232c7061b427e3d41cb0062e100481e929b01d349bc0937700823105c9a9c"], &(0x7f0000000200)=0x2)
getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000440)={@loopback, <r2=>0x0}, &(0x7f0000000480)=0x14)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000004c0)={0x0, <r3=>0x0}, &(0x7f0000000500)=0xc)
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@mcast1, @in=@dev={0xac, 0x14, 0x14, 0x17}, 0x4e22, 0x81, 0x4e21, 0x8, 0x2, 0xa0, 0x20, 0x2f, r2, r3}, {0x9, 0xff, 0x7, 0x3, 0x8, 0x6, 0x5, 0x8}, {0x1, 0x4, 0x9, 0x2}, 0x1e, 0x6e6bbd, 0x3, 0x1, 0x1}, {{@in6=@mcast1, 0x4d5, 0x6c}, 0x2, @in=@multicast2, 0x3501, 0x3, 0x3, 0xaa, 0x2, 0x75a00, 0x1ea000000}}, 0xe8)
getsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000240), &(0x7f0000000280)=0x4)
getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f00000003c0)={'broute\x00'}, &(0x7f0000000180)=0x78)
setsockopt$inet_buf(r0, 0x0, 0x60, &(0x7f00000000c0), 0x0)

03:35:17 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  381.378245] binder: 21312:21326 BC_FREE_BUFFER u0000000000000000 no match
[  381.411956] binder: 21312:21313 ioctl c0505405 200000c0 returned -22
03:35:17 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x700000000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:17 executing program 3:
setrlimit(0x8, &(0x7f00000a3ff0))
fstat(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, <r0=>0x0})
fstat(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0})
pipe(&(0x7f00000001c0)={<r2=>0xffffffffffffffff})
connect$bt_sco(r2, &(0x7f0000000200)={0x1f, {0x12, 0x81, 0x0, 0x8, 0x8, 0x7}}, 0x8)
lchown(&(0x7f0000000000)='./file0\x00', r0, r1)
r3 = socket(0x40000000015, 0x5, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040)={0x0, <r4=>0x0}, &(0x7f0000000080)=0xffffffffffffffb6)
setreuid(0x0, r4)
mlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000)

03:35:17 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00000019000008000700000096f2cc10bf4bae9e91baf829f2ac48548b11c2664e05cf"], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:17 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{0x2, 0x4}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:17 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfc00000000000000]}, 0x10)

03:35:17 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  381.588080] binder: 21298:21351 Acquire 1 refcount change on invalid ref 122 ret -22
[  381.659247] binder: 21358:21364 unknown command 419430400
[  381.675980] binder: 21366:21367 Acquire 1 refcount change on invalid ref 0 ret -22
[  381.697929] binder: 21358:21364 ioctl c0306201 20007000 returned -22
[  381.725720] binder: 21358:21368 unknown command 419430400
[  381.739244] binder: 21358:21368 ioctl c0306201 20007000 returned -22
03:35:18 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x3f00000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:18 executing program 6:
sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0)
r0 = syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0xf059, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000240)={<r1=>0xffffffffffffffff}, 0xd7df303581ad5d9d, 0x8}}, 0x20)
write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f00000002c0)={0xa, 0x4, 0xfa00, {r1}}, 0xc)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00')
sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x6400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x90, r2, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x73}]}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xf539}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4624}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x90}, 0x1, 0x0, 0x0, 0x20000080}, 0x4048004)
ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000004c0)="fa792b993b85266e7570fe4b9f768e712f162dc023780cae644b302556e877a74ea23e4e5cfd51ad356159cfe268c1b5ba0d0ef73250c820262c3643601cdb1fbe701111f7d38c879ccdfde153dd10c3636e7a37c34bdf7c3e62d3cc6903ec11f7a5f941004225217fe2548947f4c8aad440cb101c4531f1c7398f135a907f1459a5c66060dccde25ba2369c0d81eb8fc1ef79615b662759504ad578a8b022b9e31bcd1bc9b2bc157dfc62f839a9e6c66ca7f14196c80c97cd980ab9e9a806225c41b6bdca336104e55fd875133907b2dd5956271b469bf4852d0a4aaa5172a423c2dd4547d5bb7bb97f53193716e26bb12f56b12c681dd6c35350a8a0038ca3")
poll(&(0x7f0000001080), 0x0, 0xffff)
fstat(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
chown(&(0x7f0000000040)='./file0\x00', r3, r4)
socketpair$inet(0x1e, 0x1, 0x0, &(0x7f0000000080)={<r5=>0x0, <r6=>0x0})
write$binfmt_script(r5, &(0x7f0000000000)=ANY=[@ANYRES64], 0xfffffea2)
write$UHID_SET_REPORT_REPLY(r0, &(0x7f00000005c0)={0xe, 0x0, 0xc9, 0x2}, 0xc)
close(r6)

03:35:18 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:18 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x10)

03:35:18 executing program 2:
socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = fcntl$getown(0xffffffffffffffff, 0x9)
fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x0, 0x7, 0x7ff, 0x3f, r1})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x30000, 0x0)
getsockopt$inet6_opts(r3, 0x29, 0x3b, &(0x7f00000000c0)=""/3, &(0x7f0000000180)=0x3)
ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
splice(r2, &(0x7f00000001c0), r2, &(0x7f0000000200), 0xfffffffffffffffc, 0x2)

03:35:18 executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev}, &(0x7f00000001c0)=0x1c)
getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000000200)={<r2=>0x0, 0x81}, &(0x7f0000000240)=0x8)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000280)={r2}, 0x8)
r3 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5, 0x1)
write$P9_RFLUSH(r3, &(0x7f0000000040)={0x7, 0x6d, 0x2}, 0x7)
vmsplice(r0, &(0x7f0000000440)=[{&(0x7f00000002c0)="2de41bf0654e9d5c20f8695f695707a111306d6089dc7deaf5a2079fad9997b51b2d8402f8fbac9f7ae80ef46c7cd7e63c394b09e1bcafaea54ec4926608c52e7780fd2e3ee8ac85abf5fc2d3823b1ba6ae352bd269e20e6a5a153", 0x5b}, {&(0x7f0000000340)="5982fc4d16586a0ff81e5b32cc8660ec1eda01ff82c00a648ac5345f", 0x1c}, {&(0x7f0000000380)="8dc0b9700a6b38e7a4702e4da95d51ff90d1ad43e840c1ccb7f00af9983341ebde93cc58251c15636a5485115683", 0x2e}, {&(0x7f00000003c0)="77abf58befd4ab6ea5ed7228", 0xc}, {&(0x7f0000000400)="a6cc5783262320f01206e07fa750ced5574b18a47a01aff3e90c99c545ce2150afabb58686", 0x25}], 0x5, 0x1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
r4 = syz_open_procfs(0x0, &(0x7f00000000c0)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af300200f5abfb9845f9e19859c9693206f2c60b0000000719e1d66e970123d893d974e5b9c3285677b2139823e5500c92ab5b94da3a7de19f063bb765b02bd5b660fb7fa898c6f5c6369c3f363068d10af833f6475bbe8b7967255b177607ba100f6c4654718232dbda64aa1f69cf9ab5b3ea3ed63452b7ebd37c9dae664e322e08ad8f6029fe8fd0b34c7117480471aeca0a3fc9eceb28509ca8a83e4f8b85131808bc5cfb4cc24e1901769c084c082712b470666b6dddf74ced693973ba1ded8b")
fcntl$setstatus(r4, 0x4, 0x6800)
pread64(r4, &(0x7f0000003c00)=""/4096, 0xffffff4b, 0x0)

03:35:18 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0xe5d5, 0x0, 0x8590, 0x0, 0x1f1, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40086303}], 0xfc7c, 0x0, &(0x7f0000002000)})

03:35:18 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:18 executing program 2:
ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
eventfd2(0x7, 0x80001)

03:35:18 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x2f00000000000000]}, 0x10)

[  382.248768] binder: 21374:21386 BC_FREE_BUFFER u0000000000000000 no match
[  382.283919] binder: 21374:21391 BC_FREE_BUFFER u0000000000000000 no match
03:35:18 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x20000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:18 executing program 3:
mkdir(&(0x7f0000001000)='./file0\x00', 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4}, 0x2c)
r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rfkill\x00', 0x505000, 0x0)
r1 = geteuid()
syz_mount_image$nfs(&(0x7f00000004c0)='nfs\x00', &(0x7f0000000500)='./file1\x00', 0xffffffff00000001, 0x7, &(0x7f00000008c0)=[{&(0x7f0000000540)="b40d81b61b56c67e90bb26c966097ea1603b14bc81d84d9f57454beb5f43728d99ad610038197a36af669adbd55740383f58e714a08e0d4439738856d63d96c23f8752603dba28355f9faa56cdf9b044fc15ba41d9115560bc", 0x59, 0x95ae}, {&(0x7f00000005c0)="d05d0bd068dd282d261285f4cec9ce3f8d290e49b3b223e614d568285ec0f64b14050476e206d0f708d9a901aded668306f9921a1e898de1122217d60179a0986974b4820931c33d95bfa8b587096f19a08d6ea3e9a3a37b9d7af83e64e43adf35a6b5f59d0146c66b437b3fc8f7cfd304286b5d48fb3151e95fdf584319d3a5b963103646c70e8a112b223743f8", 0x8e, 0xae}, {&(0x7f0000000680)="2d74e2c67d1c4f95a66b69b5d8fb6958d69dd8192a4b3428d65e3062d0dc4dfae9cae3c0d1eb503bc59526a7254c0cdfbbbca3fffda4ef161842777184c40229035ce0f331364ba2c752d3b1bca1bbaddce7e8fe3206be907ad04f2c3a6282709df9bd526ad90f871ce1279930bdcbc31c7bce50ba710a9530bb6aeee59aecf7aec12d903f24d5baf4632b510697600d25de3345490a539027caa6d3e35b757b2c30903042272b728d38f4aec0b737ce35f992eed594a715", 0xb8, 0xc5}, {&(0x7f0000000740)="1d8bb9a8d1c2d62148d49582385b9758377bb587f00baf030443b674650b0b2a26cdb3455249bfa65d76ed02ec72efddf8fbfeb068399ea9b6c1f94f4f66f985da0c2863286671fd94e31b20a438bab21dc0c8b0fc14add27a4d908ca59658ef014d6127d82982d5ea13ebfade74e882cfe53fe67ed968723d1d2eb1f8616ac2467839ecd0cd3104acc1f014ee19d186f9c3f97d9b760ee1b330122aa013c8659de9796fed8cbacc1131eca6f3b8f23e97675fc6d00b3a4a9bd86200e6d014100e08db12c3480ab7f731f483681b4953928a9784d077642da10903ba5f4ad0d3967bb571dc0c49dae3880760fb18bb152683fe89e08623412ccf", 0xfa, 0x9}, {&(0x7f0000000840)="990eeb45c184be18a4", 0x9, 0x7fff}, {&(0x7f0000000880)="439d3e9ca08ca460d6fea4cbeb0eba3f4b511eaf4fcba54e1849baeb4812dc222fa75c46ff362529", 0x28}, {&(0x7f0000001040)="7cbf0b1e15866ab33f421f35aed25997bdc36fccd119b06fe116347189c38edb5d2dba3ac1ee60f9e8b2b0f4468242979eb66c91dd66a12152a9ef3b5658276f1ad3b8451e3fc1f33c17f7813fe83f29794c58a45b2314c5b53ee935f53591d2fffbdc897699eb0cb44d1ce5eb260a6b9f037503a4bb21b5912a4193bd8240b3dc097a2830b2214700e0c280884cf3afd0cdb107d8b6b35e23fa6fa279486a444cb0727ec9bb1b192b7f74bbbf5b1bf8acbb7e79e7789a9cc4aa32b441c27e89590ee3d56862ef0d4022546843c3cfe59085685fa5b7cb19eed40f2033558ac046af55d4dc63725a81088c27043b2cf9339973919b2802dff36ff5ec2c1660c43e0cb25fe9847272c45e1e12313855d9307651f9f3aa2e7f142ff2ed96689753b5487c189e94efd2b8b5acb6a9e45be712d9e3412acc9e64fd2c68245a528d6dbe6c69b1e32725477ec896f128c847046816d268ae58de6aa9fe1147d1a6e1c4048675bbccc195115a985909da2def44efbfc38d868a46bd8602dea98a827ef96dec659ddbcd3df69fa4163c71316bc282c14861a60a1b93841d0e7379e9b7b5f548079ed8a6e8b70ae5ea83909219f13e10a9ef1940c9fccd5b929e5bd32380959634ed67743366adf597d8a7f9b5bc20c06daaa6749c3aa91985544f13d8e0f398617a22eec1831120c892894e9fde53d047daa454c79ffb8a0b47864e0cff8faf4ee46ea772ddc27b7656e745d175eac20b3b406fa8b39e9370251652ac5f723f6196ba77684624477dad8a5fff857cf9e5bbb53e2094338eb3508295f316265e2b01f17a9843b31675230fa364698fee13c6f8e35d4b71e238170f33c4c4c37334e8ef180b1dadc933bf192a3e9f87735246d47d3176288e09e3cc68094d71a9f9857ce6842f6f36f7242bcd1a1db0da7e42047cee909f8ee06c9499a186963b0766a067fe57ab7b9f4d5cb81330014eed62c2ec6c9df6f41adfb9226519ec1a9a1f89044c7e49ea417ec4653fc2830b9ad9a88829c491ee88545be7ad91c59be89e5dc8bb9c1b6c990da142c3a8aea5a03930d54ce57e80c242dbf393eb8ec54e1095c06ef21e7045cba2a146b8bb0e29365d08433788f530b81966ce2b84ce98739d307de8d6f3fcb4e9e6373de4da9e074d8691571b3368b00215204634d1cdc21e2798a19cbfb6b78bae8f26af9af0c62af4598cb3a802a13a6f67a376424efc4a6a5522a98ff5694f640df43b156c28921d98204c9fb7ca28b17ef3e7048cf0dbc44fe92cd445b3c7284f1b2755eb24521a4b825bd75a5176b93bd989198c626929c46d5836800935dc9e099d68a4b5be7ed1a855bdc271f33d7c17b77609ba2458fec63650fdf40da86654d8b0a820aad0c1d2812893cc01435facafe8a875a6e67fc969a72afa85c7aa2f530dfc8fa9785b40ba29df12f759f7b9f1b54478e0198d57ca680453d5f5e4d1fb37b568505fbc3b4db00fa19ec622dc4ff0fc90ab906ff02c1fcdd7b2ce22efebf2793fe73a6b27025c474bc7c1c62bd54555c1f50f0aa277e4c6f1ffa1f373167bab7117e5c6942ca8063c0597ae1fd5fd7e5e6d9dd11c082affeae60ce55265817d8f6bf21ef4b61ab40cbcfcc480349cac27a0fb64bc67ca4c422a2737faeccdbf412efc598378df24c749bb3e767a5256dd9eea5efe98d0fb6af5db23cac79cdf8446c775354f914e903df9a0617cd15093ceca9c7f72897ddc9b31dd048b09bdde3755cf26543f33ca5d16f6d8fed13524072eff3009784cbf991b6110862e2bacf295771f584914bf94274d406a5b749df6a7cf07bb5a773ccb0a8af907de1807654cb6834be548bd763a0ed1ec95573f6c9dde06258f2fd407dd88a6e7e9c9a518d45501dfb57328bf5f60e88ad490d607a3d686939b69e88e8b6974d1757f859742f588233a26a1e4938d8239658c403185d7e5057173a9de4c50692dfe34dc67b1d45a1138e31850b5376920fdf51bbfe9dbf5e7b2ce9df2f439a95bd3a4f9ae31527fefcf7b4e574b6d6bccb990dd68c79df5432e96b075d8e1ed106a1881d1f87712a79b7235da5c7e9a0c16992aef9cea1ec545fb9df54aeedb77e9fae3b066eae81e2953a58e1a25c40917f999a3873ffbfa9af3fbf2ad321d2deaf6873e52b15b0864cac379d4f5eb29129095d6b702d055d9534a9b3230eaa80e11331cc84f25c47ecb6b794822417011983c5f6412ecd349da5665dc8ee68194b6010f2e705f2fb95b3017678a388e8f5f708c989ebea80ab0f9ef6a8fb4f58664394e63e390b073ae604186445b2916ee5f9e2499c0f1278efb96c96489baefcddca0eec125961413126f0028a05a2a8fdf6cd6a20179df1095e773a5235b993cdd552a10dd512ffe955eb8200eefb0949a09b8d4ca63b5c07af04bbf84e7772ba7c32f5cc99e4a6b9c4724f7b7eb8fc9861ea3147f3ca6855941c0aee41c8aa5041c0d90a0387952b89ab9ca227823119ade142251b26a6b7ecdc5151192c8592895fc0ab7da1f613cb63023ac6f84c794729d51492b04cebf9f9d9fbd880997d65d4bec5261a46990443c93adbcf9a2dffdb847c1ae415b669d574cae4a2eefd0912e8a672c0714386c5bb58cb8b7b9bd300f5f79d87c78f54c79771166ba3c510503b7f608bdc944203daaf90f6a245ae11e6a9fea27af796bcb7f4b3a421d54ac55a8e5a639e40435a59b511f112e397a7ef5e6b5c5e81af0f8a6108924d0a7b4c1d781b7ed07d0f5475b2ff8ec6f44802bb1a479ba188c20c82df2846e362cddff40f7058957a50d7dcdf8e973b85d2c9b14613b11f349e9988e25b61f6b3037f3fe26b720bed50f792acfe111a564eef8027852061744add36225f61d1dbfcc319412202db9c3c93a31e1cb22a6c1f033f14de671cfd715981e34178806998ceaaff8e59e3aa91c1e37acd3213386724769b1985d415eda32180a97b6dd5245e7a065ea02e7e981c31b56c644c89358d12a8501200207e59f79e277ae3ef80fe16a68dda33ff2ca4164a124f74f120908d30dcf5b07657651285308209e402230432f1db59329c18e0cf05cd37e7cb8bf427c2e808f4ae1c48b1ce6d5133e67eadd249f11f500817a31359fe8945c3f5280808b68e7f73a84fc51b65c26bea764bc6117271b59126524570873ced45176c0311f9385ed6f720788e7b650584bedc1aa764f24634a1238e85045ffd806d9f47805c8b5a648b49c85691eeefa8ffed554a8509c76fccee251d58bb82677a0fcf7c7e1a8a90e88bf1859f6c96af14cfd9097510e16fb0c4f09c4e00e243da169ec9e6af77c69cb0253367826509403e7a22bea16db18a555912ea850bb67683953cf5680b4af96d4ae1f1f6c5d8f628905a4635cb938094be8673e43b195602b966cab63df8f6afeedaabbceac5df55a35b139eb4ba10affe44daaff9cf86af2f171791c31800e3d571f4ca310ab42276e8343b8fca6965144d39f92434dc763b6a018064179f98b98efdb3a9a60f749883e55ac0835e47d0bbbdab607dc1203a789c6a1872592b05e9926c77b2afa5b666b0397bb930ac4269916f0cad741d476705e69145bf022c10c20edb39ade5bab650d98aaeea4e49472d9626f2640a34e0fc0ddbd3f2ac066c00bb79526b89801811e87b627dc80a88b1153f60505ae39a28b9bf8af89320629301045183bc7210c5d4006f5939ae465dcdd1448977c3aa9432ec4af7bca4baf4b671cedfb7a5a81881949efe078a0d0c5e15d9081b06f77733b7151563e62716dd8cf9b45591034a6547ffdc616d20ede4141f3c7a7f393f398c67eba15969a2afd458499cfddf458629df49c65039be7dffbe1d6c7288e864a9e9b1f79c8f31297a225b82f4059e00bd183de9aaf8f3fee43a2330419e446ba23595d38862c5a1bd9381f41215d1cf0631632820d3117a27f3a6c768ae7fb4d787f1e27aafbac5457b4b5667487665eeb8f8c26c2aaa17d2d061a5fe7144d04d22feaf59af098970ad4e3a2ba762a19ef226381c9da8fe0090ce6eab794070cf6292e64685edb6a9fe4c6b02488c6eee50be772824b2808171f0cb3cce9c20389ba9119040354d76d131deb248b45b92b9291cda0d66772dfbdeaf3423b293228d1aef9d1969a2fd2a98e1148c1868a377ea16002437f9215700531f77b2c23be4bff1a4d4b342ed544db6ad3dda9cfb06bd44b443eebe665aebded9f33740d1234c94a842308446f5e6adb6b8ceb3f82a7e708e00736c42d03504e9becbcbf9a3b81cb446b5deb4b39fd69b652d0915c2e584185312cf613432a11b39a7a4d70725389a15ad5274ec261dbf9cda0f8f30fd163fb4a8ef0a21f186b068d8ea7d8e41b25169ee53bdd244fa39d3cc05539b7acf6b075a7a0731cd78a2b8118b23f81d3c21aefa10b0b03684c55ba2bc29f00ed54fe7f4ea642e0b83c2082f1db49d62da97fa338dca3f67ab819d9826df12d9e268bdd66c3fdaeb66cfae46803f85553f88dac8efd989755eb7561c2df5905525684e3ea9135d858c7b3d45d7e39c1b0a78a3253c5aa5137263e55bb321851e6e37f2a2849766cc11513160c6d7e2b361ffa8fa608d36128186e284dbefcf3ac691b4a0565d5f00fda52dfc75d91d9e54a794ddf0560725c618342413cbd615254da22ad9edf13e1f0fca9ea96101644efdcaf2f717aad1307050bfd17420dd75725893ad108248a8a6a80183e93138899560de131155b4e58c5e7985f2bb77fcbb4558c29de11296988e3f7e4af97ef33220b9081d8935ef9e848717cc87103e1f4329221457779f2335108a442be289750aad4a65af7462dc486e1dd6bd6fdef54202066e2be5561cc67dd559cdb22391724747098e15070e325fe57265cd71dd21d8d97097e820d7f7c6eb909876abbb5604e8975fb887c4f79c24289203333f3b23a6be5b7050310005944edaa6aeae6d301965c9458e6a059d037000ff8d7f6620185c6bd556b53975a7590aaec7d00b579d70f6301589bd969fedc323ae78df9e0f57665a454dcaf65ff87bc7ca09f0f5182e3ba7db5cea5789b02e462882dc8959520389ab33a79180f4c0b575b7a2ecea9307300f51756c09ae67b1b69a08cd20f3466aaea4582a7339bac83c3361241d862dc7adfbb5875531308d875654e01a4c402a411936296e2ee1cfba53cc959e1e3a75373c0d449fcb3132123e2df9a77c572634dba522ebac286fb138d395bfd8a3161f39e8dbc170c49d2d3afbfc4e88c6f6c7cf2fbd83ed8f91ef10d7328989a71cbd8c8ab3f0ebaf6dc683b0406906a2e38a9ff41550c19b7cab2d62b8ede615f6f1edd926e4a728cd1f6c74c97ff44120152ca085cc88d53078683855f9a1d1ba9cacc1677b47be2017160ea46afb0672ab42cf957a2bf8cdac41ae1be8a46ae8ce2a997e27e516da0fccac758c8efa5d091cbda13f6c639045d18d3d069f6485008db88371502f87472a57f94a4993f4d53d5deb35174cbc595b78092328190c72d2d86be6494ed005de6e3b121eb44cc7688a6ef856a58f7b52494c07c52d809a91d917ad8efc673212f769b62066d31bdf3d812dd0f3cad7831c310b0d214cb283552b259714151b0691962390fb49aead795726caffc7cf4de3f409d7bea6854c46477a0b0dcdb13239f956e101464ff29d05082cce28e2c130fab6188b15bfc2fe01ec0e317a71ed2f792709cb7c13c85bbe70a2694c6e81b3bbd2fe09583e478c96082256471daa4111c69199f2929473ad0803ce59eb6d1af74bcaa38e47a2eee3ce1c3f3c0cd76", 0x1000, 0x4}], 0x80002, &(0x7f0000000980)='/dev/rfkill\x00')
getresgid(&(0x7f0000000340), &(0x7f0000000380)=<r2=>0x0, &(0x7f00000003c0))
r3 = getpid()
rt_sigqueueinfo(r3, 0x37, &(0x7f00000000c0)={0x20, 0x2, 0x4, 0x11})
write$P9_RGETATTR(r0, &(0x7f0000000400)={0xa0, 0x19, 0x1, {0x1c02, {0x0, 0x0, 0x6}, 0x2, r1, r2, 0xffff, 0x2, 0x1, 0x0, 0x5, 0x2, 0x8, 0x401, 0x3, 0x9, 0x5afc, 0x7, 0x8, 0x263, 0x7}}, 0xa0)
ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000a40)={0x2, 0x0, [{0x0, 0x5, 0x7, 0x8001, 0x7fffffff, 0x1, 0x6}, {0x0, 0x2, 0x6, 0x8000, 0x80, 0x0, 0x2}]})
rt_sigqueueinfo(r3, 0x3a, &(0x7f0000000ac0)={0x33, 0x1, 0x7f, 0x3f})
mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000343ff8)='./file0\x00', &(0x7f0000000000)='nfs4\x00', 0x0, &(0x7f0000000040)="01")
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/vga_arbiter\x00', 0x80080, 0x0)
getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000100)={{{@in=@rand_addr, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6}, 0x0, @in6=@mcast2}}, &(0x7f0000000200)=0xe8)
r6 = getegid()
truncate(&(0x7f00000009c0)='./file1\x00', 0x0)
write$P9_RGETATTR(r4, &(0x7f0000000240)={0xa0, 0x19, 0x1, {0x40, {0x20, 0x2, 0x8}, 0x80, r5, r6, 0x17, 0x7, 0xfffffffffffffffc, 0x4, 0x2, 0x6, 0x0, 0x8, 0x602e, 0x3, 0x9, 0x3, 0x10000, 0x1, 0xfffffffffffffffe}}, 0xa0)

03:35:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03630840000000008deef7143acf6e7d4a91685e0a566d03ef1c2151049fb06edf4909b6f5e4908bfec45ccba7f205837dd8792e9ee78b254e1f70fccde25c76a43d87230729eece774d4f59162432ed9a71f11aa665cd4637093c5b1efb82af6c680d542766576d06a6da02c99aab34aac7c4ca5d5b1168c50c9377ead109bc60153b3218"], 0xfc7c, 0x0, &(0x7f0000002000)})
sync_file_range(r0, 0x6, 0xb9, 0x4)

03:35:18 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:18 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
socket$inet_udp(0x2, 0x2, 0x0)

03:35:18 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x10000000]}, 0x10)

[  382.471339] binder: 21366:21410 Acquire 1 refcount change on invalid ref 0 ret -22
[  382.520311] binder: 21416:21418 BC_FREE_BUFFER u14f7ee8d00000000 no match
[  382.537306] binder: 21416:21423 BC_FREE_BUFFER u14f7ee8d00000000 no match
[  382.579844] binder: 21430:21431 Acquire 1 refcount change on invalid ref 536870912 ret -22
[  382.659730] binder: 21430:21435 Acquire 1 refcount change on invalid ref 536870912 ret -22
03:35:19 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xf00000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:19 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfc00]}, 0x10)

03:35:19 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:19 executing program 2:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{0x2, 0x0, @broadcast}, {0x306, @remote}, 0x16, {0x2, 0x4e21, @loopback}, 'lo\x00'})
r1 = semget(0x2, 0x2, 0x1)
semtimedop(r1, &(0x7f0000000000)=[{0x2, 0xcad, 0x1800}, {0x2, 0x101, 0x800}, {0x2, 0x1ff, 0x1000}, {0x0, 0x1, 0x800}, {0x2, 0x10001}, {0x4, 0x5, 0x800}, {0x3, 0x0, 0x1800}, {0x0, 0x400, 0x1000}, {0x4, 0x3, 0x1000}, {0x4, 0x7fff, 0x800}], 0xa, &(0x7f0000000040)={0x77359400})

03:35:19 executing program 5:
r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x8100, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x8)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x2, 0x1})
mount(&(0x7f00002b9ff8)='./file0\x00', &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x0, &(0x7f000002f000))
mprotect(&(0x7f000041b000/0x3000)=nil, 0x3000, 0x4)
mbind(&(0x7f0000289000/0x400000)=nil, 0x400000, 0x0, &(0x7f0000000540), 0x1, 0x2)
r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xffffffffffffffe0, 0x40000)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000580)={{0x3, 0x7, 0xfffffffffffffff7}, 0x0, [0x7f, 0x81, 0x5, 0x2, 0x0, 0x80, 0x3, 0x5, 0x4, 0x0, 0xfffffffffffffffa, 0x1, 0x3, 0x4, 0x3, 0xfffffffffffffff8, 0x1, 0x2, 0x8001, 0x81, 0x4, 0x1, 0xfffffffffffffffa, 0x7fffffff, 0x115, 0x81, 0x7, 0x1, 0x7, 0x1e17, 0x7, 0x401, 0x7, 0x20, 0x8, 0xfffffffffffffff9, 0x5, 0xd4e, 0x9, 0x4, 0x6, 0xa5e, 0xcc, 0x7, 0x1, 0x1, 0x3f, 0x7, 0x80000001, 0x9, 0x8, 0xd2, 0x5, 0x1, 0x4, 0x100000000, 0x3, 0x0, 0xfffffffffffffff8, 0x6, 0x1ff, 0x80000001, 0x434d, 0x5, 0x3, 0xefe5, 0xfffffffffffffff7, 0x800, 0x9, 0x8, 0xa426, 0x2, 0x6, 0x1, 0x8000, 0x5, 0x8000, 0x0, 0xffffffffffffffe0, 0x5, 0x3f, 0x7, 0x8, 0xbb1, 0x8, 0xfffffffffffff9ab, 0xffffffffffffffff, 0x0, 0x7ff, 0x5, 0x4, 0x387d5c78, 0x6, 0x0, 0x2, 0x7, 0x1000, 0x9, 0xfffffffffffffffe, 0x81, 0x2, 0x6, 0x9, 0x4, 0x4853, 0x9, 0x9, 0x5ea, 0x3, 0x135, 0x2, 0x20, 0x1b, 0x6, 0xffff, 0x2, 0xfff, 0x7, 0x3b, 0x3f, 0x7f, 0x8, 0x9, 0x2, 0x7fffffff, 0x5, 0x1, 0x5]})
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f00000000c0)=0xffffffff, 0x4)

03:35:19 executing program 3:
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82)
r1 = memfd_create(&(0x7f0000000380)="000000000000000000000000000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30254d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6287c64dbea37a", 0x0)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00')
sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x3c, r2, 0x200, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x81}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4800}, 0x8001)
fcntl$setown(0xffffffffffffffff, 0x8, 0x0)
mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x7ffffffff000, 0x0, &(0x7f0000ffd000/0x2000)=nil)
r3 = epoll_create(0x9)
r4 = timerfd_create(0x0, 0x0)
fcntl$lock(r4, 0x7, &(0x7f00000000c0))
r5 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo/3\x00')
r6 = getgid()
ioctl$TUNSETGROUP(r5, 0x400454ce, r6)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000004c0)=0x9)
sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x14, r2, 0x0, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x48000}, 0x40080)
preadv(r5, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/246, 0xf6}], 0x1, 0x0)
setsockopt$bt_BT_VOICE(r5, 0x112, 0xb, &(0x7f00000002c0)=0x80000000, 0x2)
pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000100)='\'', 0x1}], 0x1, 0x81806)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
write$P9_RRENAME(r1, &(0x7f00000000c0)={0x7, 0x15, 0x1}, 0x7)
bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', r1}, 0x10)
sendfile(r0, r0, &(0x7f0000000240), 0x20000102000007)
ioctl$LOOP_CLR_FD(r0, 0x4c01)
epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000400)={0x2000})
r7 = socket$inet6(0xa, 0x1000000000002, 0x0)
bind$inet(r5, &(0x7f0000000440)={0x2, 0x4e21, @local}, 0x10)
ioctl(r7, 0x8912, &(0x7f0000000100)="025cc80700145f8f764070")
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000480)='/dev/rfkill\x00', 0x0, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r1)

03:35:19 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x5f0c0000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:19 executing program 6:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket(0x1, 0x5, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r2=>0x0}, &(0x7f0000000200)=0x5)
setuid(r2)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000040)={@remote}, &(0x7f0000000080)=0x14)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000d1c000)=0x2c, 0x4)
bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c)
alarm(0x6)
r3 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4)
bind$inet6(r3, &(0x7f0000f67fe4)={0xa, 0x4e20}, 0x1c)

03:35:19 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  383.153550] binder: 21450:21455 Acquire 1 refcount change on invalid ref 1594621952 ret -22
[  383.163581] QAT: Invalid ioctl
03:35:19 executing program 2:
r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x400, 0x0)
fstat(r0, &(0x7f0000000040))
r1 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:19 executing program 6:
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x20000000000032, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000080)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439efc53decf2f7ea39101d2da75af1f0200f5ab26d7a071fb35331ce39c5a")
fcntl$setstatus(r0, 0x4, 0x10000000006810)
pread64(r0, &(0x7f0000003c00)=""/4096, 0x1000, 0x0)
connect$l2tp(r0, &(0x7f0000000200)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x0, 0x4, 0x1, 0x4, {0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, [], 0xd}, 0x2}}}, 0x3a)
epoll_pwait(r0, &(0x7f0000000040)=[{}, {}, {}, {}], 0x4, 0xdec6, &(0x7f00000000c0)={0xfffffffffffff84c}, 0x8)
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, &(0x7f0000000000)={0x40000005})
ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000100)="8979003b268e62b4719a9e8e079455045d5fe13ceed054def26d8ed242b480253f81e6ae9aeaecd24978298a715a1cad5eeae880d76b4283772873ef2274a02616edf3746680e3f7e8873c305fd443bfb5e7d982a76ccd9cf5c95301bad1a0c68c876291caf94e09cc01abc50159521a476190b8f14d748e22a7d77912c0b2842ffd7e69fa26e193dc696f56ca22ccd678d3eb1326b179ff49a838fd06b6ec82749eaa2d6b3886d66af6a5117a6f736647dc25d7e7aba65d5492e80b4faeaff536cb8ef28d096941b6c215534ee21963a366c29922e8104ff5c7aa39a299e71c0670da8f4f1f85f8e6778242f3d56aa1cebb862d54d188c109fb688ee6fd3c13")
ioctl$UI_DEV_CREATE(r0, 0x5501)

[  383.206317] binder: 21450:21464 Acquire 1 refcount change on invalid ref 1594621952 ret -22
[  383.240392] print_req_error: I/O error, dev loop0, sector 0
[  383.246208] Buffer I/O error on dev loop0, logical block 0, lost async page write
[  383.254282] print_req_error: I/O error, dev loop0, sector 8
[  383.260054] Buffer I/O error on dev loop0, logical block 1, lost async page write
[  383.267806] print_req_error: I/O error, dev loop0, sector 16
[  383.273678] Buffer I/O error on dev loop0, logical block 2, lost async page write
[  383.281537] print_req_error: I/O error, dev loop0, sector 24
[  383.287387] Buffer I/O error on dev loop0, logical block 3, lost async page write
[  383.295122] print_req_error: I/O error, dev loop0, sector 32
03:35:19 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:19 executing program 6:
r0 = getpgrp(0x0)
r1 = gettid()
rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8)
rt_tgsigqueueinfo(r0, r1, 0x7, &(0x7f000058a000)={0x0, 0x0, 0x4})
r2 = socket$vsock_stream(0x28, 0x1, 0x0)
r3 = signalfd4(r2, &(0x7f0000000040)={0x100081000002}, 0x8, 0x0)
readv(r3, &(0x7f0000000000)=[{&(0x7f0000000540)=""/4096, 0x1000}], 0x1)

[  383.300987] Buffer I/O error on dev loop0, logical block 4, lost async page write
[  383.308725] print_req_error: I/O error, dev loop0, sector 40
[  383.314574] Buffer I/O error on dev loop0, logical block 5, lost async page write
[  383.322298] print_req_error: I/O error, dev loop0, sector 48
[  383.328157] Buffer I/O error on dev loop0, logical block 6, lost async page write
[  383.335876] print_req_error: I/O error, dev loop0, sector 56
[  383.341730] Buffer I/O error on dev loop0, logical block 7, lost async page write
[  383.350020] print_req_error: I/O error, dev loop0, sector 64
03:35:19 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, 0x10)

[  383.355904] Buffer I/O error on dev loop0, logical block 8, lost async page write
[  383.363618] print_req_error: I/O error, dev loop0, sector 72
[  383.369502] Buffer I/O error on dev loop0, logical block 9, lost async page write
03:35:19 executing program 5:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc))
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000001c0)={0x2, 0x2, 'client1\x00', 0x1, "d772b7aca8e9f22f", "4e4093b485d3f6592abd6cb85393a5b3d6c1baac3aba46aff602863833635fcf", 0x0, 0x7})
r1 = syz_open_pts(r0, 0x2)
r2 = socket$rds(0x15, 0x5, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x8001, 0xd4, 0xe40, 0x1}, {0x3, 0x800, 0xd427, 0x5}, {0x7fff, 0x0, 0x41b, 0x1f}]}, 0x10)
r3 = fcntl$dupfd(r0, 0x0, r0)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
dup3(r1, r0, 0x0)
write(r0, &(0x7f0000c34fff), 0xffffff0b)
dup2(r1, r3)

03:35:19 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x1000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  383.567693] binder: 21493:21494 Acquire 1 refcount change on invalid ref 16777216 ret -22
03:35:19 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfe800000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:19 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:19 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfec0000000000000]}, 0x10)

03:35:19 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x8, 0x100)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, 'lo\x00'})
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x4)
socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000080))

03:35:19 executing program 6:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000651ff8), 0x1000000d7)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f000079efe0)={0x4000001}, 0x20)
sendto$inet6(r1, &(0x7f0000aaff09)="b8", 0x1, 0x0, &(0x7f0000ab0000)={0xa, 0x0, 0x0, @loopback}, 0x1c)
connect$bt_l2cap(r0, &(0x7f0000000200)={0x1f, 0x80, {0xfffffffffffffff8, 0x869, 0x3, 0x7, 0x1ff, 0x400}, 0x3, 0x9}, 0xe)
r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='\x00'}, 0x10)
clock_gettime(0x0, &(0x7f0000000100)={<r3=>0x0, <r4=>0x0})
utimensat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={{r3, r4/1000+10000}, {0x77359400}}, 0x100)

03:35:19 executing program 3:
r0 = socket(0x40000000015, 0x805, 0x0)
socket$rds(0x15, 0x5, 0x0)
setsockopt$RDS_GET_MR(r0, 0x114, 0x2, &(0x7f0000000540)={{&(0x7f0000000380)=""/48, 0x30}, &(0x7f00000003c0)}, 0x20)

03:35:19 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='vmnet1\x00'}, 0x10)
ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0xc0305302, &(0x7f00000000c0)={0xffffffff, 0x7, 0x3, 0x3, 0x7, 0x1})
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000100))
fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000140))
ioctl$KVM_REINJECT_CONTROL(r2, 0xae71, &(0x7f0000000380))

03:35:20 executing program 2:
r0 = dup(0xffffffffffffffff)
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={0xffffffffffffffff, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, {0x2, 0x4e22, @rand_addr=0x5}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x13}}, 0x0, 0x400, 0x4, 0x3, 0x4, &(0x7f0000000000)='team0\x00', 0x7, 0x6, 0x1})
r1 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{}, {0x0, @local}, 0x0, {0x2, 0x0, @multicast2}, "810000000000000000ad00a5b6000020"})

03:35:20 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:20 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xb0fd3f00]}, 0x10)

03:35:20 executing program 3:
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="45965a5c4f0f00fe000030492a4797623745e0043bd9ebafe12924"], &(0x7f0000000000)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6", 0x0, 0xce, &(0x7f0000000300)=""/206}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000028000006a0a00fffffff6006118"], &(0x7f0000000080)='syzkalleP\x00', 0x0, 0xce, &(0x7f0000000180)=""/206}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0x5, &(0x7f0000000040)=@framed={{}, [@jmp]}, &(0x7f0000000200)='syzkaller\x00', 0x80000004, 0xbb, &(0x7f00000004c0)=""/187, 0x0, 0x0, [], 0x0, 0xb}, 0x48)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000440)='/dev/autofs\x00', 0x8000, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000480)='tls\x00', 0x4)
r1 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x200000, 0x0)
setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000400)={0xbef, 0x9, 0x3, 0x3, 0x8, 0x1, 0x6, 0x1, 0x2000000, 0x9, 0xe5}, 0xb)

03:35:20 executing program 5:
lstat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, <r0=>0x0})
syz_mount_image$jfs(&(0x7f0000000280)='jfs\x00', &(0x7f00000002c0)='./file0\x00', 0x916, 0x8, &(0x7f0000000880)=[{&(0x7f0000000300)="ab2f116094aedaf91d3324a0a80517c347353c1245fd20a4be11946b740f0a58", 0x20, 0x4}, {&(0x7f0000000340)="e5d4fb700911858c4b811eb45973d9a09456f25c5ef0bd7d892519d1c7e312fdd4b02a9cf15b21a6f86f796b806cdf8c1b6f60645f5004a0a9fb2c6fcf27bb8bc67b003ede0d7495aec901eb3a7bf2e96c1f1654b09bc1bdbdedd2d978f47ee7e54c921a16e476c59d0e0205a4fc60393675afc844cb9223eca8818588c652dbf54e58eef5dfae4553bfb16b28108f215550d99a270ab8679bcec8a3c007abf90ece7e4c92cc20ff627bc4248a8de980affc2f8db9ac60453698697050e16571378d03d9beefaf66adc0c66a8c2682fa95fb4b1c7a7beb9ba871b80402b4", 0xde, 0x40}, {&(0x7f0000000440)="30184395115e5e4f209c7be08e4deb2bd818909d991d6138510164a6c4cb00e55b98754bf1b2be78e5c98ae80c131c7ceccb205ddc5813c3b2ed31964fd047bda8ed3a0d399dcb429b9c27cf1ac8fa139c65b60f5dd6210a2650ce648517231cde45557cec58920ad463bcf09b23b44d3a44dfde4b31f211eea996140808840ff2b90cfe81875f4cead711a3b84b6eaa8a299b5fc9af3f5f42103039fbe7fca72a628860ab8afeeadd3a4cba7290", 0xae, 0x2}, {&(0x7f0000000500)='/', 0x1, 0x5}, {&(0x7f0000000540)="dda17cf268ab1a78f05267e1af822e99f4d93064a82ee9b0b3035ed3dc9125baee50fc4794f08d42ce2a9f6fc94ffc5b688d2b19dac6c6ebdbcac08508a5063232f445b42977ada7c7f69a4b1e4dd5e6e25eff9dc4640a4f722361df693dc501fee999bdc32fb76c1085d766b850f833c601c44ba99686f04b1db5aafa5fd773bae3ed60b79f02699d5eaedbac34927f1299a97056d5", 0x96}, {&(0x7f0000000600)="759645033e69a218b329fe4499e9660846f58c751983972be89d5bd96b8489e9b937b861a4353ada86c6fe93a5a5cbb28200887166f8418c7cde26d0496a7149bf883b40a9a68f51829915ca491b1fec5e7f909d5a380048d45db5cf7ab1b976a3b54cf8519eab1719ab89ec6af62159c140ac325218b32569084bcacb5b5f97677a2c0ff015db6dccf8b3b9a85b3416c89a6ab694c8dab8dd36c454b366c1a4444ab357820bc8201a869c46f3d1142afb560bcd1b506d90127c706ab6a2f6185ba3652ef0cbbdc3c6851496aeeec8e9ecc1308ba2451d086650d581d5b8cc2a8886369fc0b4fa104447b6b6a9db2cf5f5", 0xf1, 0xffff}, {&(0x7f0000000700)="7322a16162b0427f29ae8dee57a06f19271e449b991efc6d562592ee6941bba851c21ba6d23a686cedb95876ffde2fa1348f0d97e4695374a143cc7d212105fae4a257a66957b9e4", 0x48, 0xff}, {&(0x7f0000000780)="8917c39b8b050e708ea3043abc43f50792f6ebec544170bac204a7c07716459d50490e6285851d32945070ad9fd9f0f7f8f7bbdf7be5cbefd649b5b6610b6d316889d229174637a80b33777d9a9f04092bc162f9079e4546019651b33cf23c403de14e539e44fcf1ffbd448e0477aaa81cb51875632636c0d9f888c084fb870903ced84c662425b1507d969399faa7747a89736a8a80eea4db122dd33736ab4a357a75f09e08c885f11362b99b7ac1fc1f11773cb281322728c7048a87e1f9fa0f69bded80b085", 0xc7, 0x2}], 0x4, &(0x7f0000000a00)={[{@usrquota='usrquota'}, {@grpquota='grpquota'}, {@discard='discard'}, {@gid={'gid', 0x3d, r0}}, {@usrquota='usrquota'}]})
r1 = getgid()
lstat(&(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0xa090, &(0x7f00000001c0)={'trans=unix,', {[{@dfltgid={'dfltgid', 0x3d, r1}}, {@nodevmap='nodevmap'}, {@access_client='access=client'}, {@msize={'msize'}}, {@nodevmap='nodevmap'}, {@mmap='mmap'}, {@dfltgid={'dfltgid', 0x3d, r2}}]}})
umount2(&(0x7f0000000040)='./file0\x00', 0x3f00)
r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/userio\x00', 0x200, 0x0)
ioctl$TUNSETGROUP(r3, 0x400454ce, r2)

03:35:20 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000100)={{}, {0x200, @local}, 0x24, {0x2, 0x0, @multicast2}, 'lo\x00'})

03:35:20 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:20 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x3000000]}, 0x10)

[  384.214056] JFS: discard option not supported on device
[  384.332972] binder: 21493:21560 Acquire 1 refcount change on invalid ref 16777216 ret -22
03:35:20 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x6}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  384.466217] binder: 21567:21568 Acquire 1 refcount change on invalid ref 6 ret -22
03:35:20 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfc000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:20 executing program 3:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
setsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f0000000040)=0x7, 0x4)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket$nl_crypto(0x10, 0x3, 0x15)
r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x8040, 0x0)
ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f0000000100)=""/81)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000000)=0x2, 0x4)

03:35:20 executing program 5:
r0 = socket$inet6(0xa, 0x1004000000005, 0x0)
syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="020055355ac5950e54aeff07000000000000000000000000020000000000000000000000000000560000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])
ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070")
writev(r0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e85312c35c0236f98435132539ee938f6b2f8c910fa333badc661c2fb7d7ba5b692e16dddd5f71e05d690d4535c886547371e2b57a3ffe3f92ab592eb6e3e54ebf5f5a5e7795fb6f58b9c60aa2e67cb7848b0aef8ee874b5838d23d9b6005bfe44bdd1e0ceb229d1ef60b7d18f3fcc4d79ef189b384c69af60d5bff0d14e8b13df80ee23a1c91563108200f97bce8776d0b4aa173a9659055cd9933acfd8ca0dd5f6eab6e07c79f283331ce9ea149880e92a6f5aeef13e10e8a2edbb2434d123948966e82bb", 0xc6}, {&(0x7f0000000100)="9865044851dd7d8833f5e354f718f3756b7a205fe4980b298e8f797ae8768331d322f96fecefc3a62ef7e2036db90049fc3aac524e89abbad2d3af329e2fd9acd7a3fc20e48839", 0x47}], 0x2)

03:35:20 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xeffdffff]}, 0x10)

[  384.852701]  loop5: p1[EZD]
[  384.855923] loop5: partition table partially beyond EOD, truncated
[  384.864118] loop5: p1 start 2924744341 is beyond EOD, truncated
03:35:20 executing program 6:
setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000008000)={0x0, {{0x2, 0x0, @multicast2}}}, 0x90)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @loopback, @dev}, 0xc)
getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000008000)=""/144, &(0x7f0000004000)=0x90)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfffffffffffffffe, 0x10000)
getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000040)={<r2=>0x0, 0x74, "8676672c57b0282e9a165814a0339c2e231865ee661c90b9a24f107627abdf99f0b8f0c807b7625c9ab9cfe0d99cbf129b1b39279f877b8f3b17177a490ee775e2caa15ce0709bb2025a6c17fa8440a80e366d82054910aa05d826f6a22b2a2a92037dc0b80679bcfb48acb39bc97159727d1263"}, &(0x7f00000000c0)=0x7c)
getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000100)={r2, 0x800}, &(0x7f0000000140)=0x8)

03:35:20 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif\x00'}, 0xc6)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000400), 0x0)
fcntl$addseals(r0, 0x409, 0xa)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x4002, 0x0)
setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f00000000c0)={@broadcast, @loopback, 0x1, 0x1, [@local]}, 0x14)

03:35:20 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:20 executing program 3:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
bind$packet(r0, &(0x7f0000000240)={0x11, 0x3}, 0x14)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x0, 0xfffffffffffffffd}, 0x4)
syz_emit_ethernet(0x315, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c2aa97aaaaaa16dbf95dbb8b98275e0800002b080092787f000001ad1414bb00000004000890780000f40f000000000000efad7fb21e66a391dd2be92381f0630769c2ec9117913a930b49dc25c5795c9ec51de5618843fec73a69e91252e54a6bddaa969dca230a9234cde1e7c587a956a20c86760556899578724ef443a0ce7aba8188be1daf632bc9a6be24d209a747047e1b1e3f223d1ebf91ba50a0"], &(0x7f0000000140)={0x0, 0xfffffffffffffffe, [0x0, 0x65d]})
getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000040)={<r1=>0x0, 0x2, 0x7, 0xff, 0x19, 0x98f6}, &(0x7f0000000080)=0x14)
r2 = socket(0x13, 0x0, 0x2)
getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000000)={r1, 0x1f}, &(0x7f00000001c0)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(0xffffffffffffffff, 0x84, 0x23, &(0x7f0000000180)={r1, 0x200}, 0x8)

03:35:20 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x2f00]}, 0x10)

03:35:20 executing program 5:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0xaf0}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000080)={'ipvs\x00'}, &(0x7f0000000100)=0x1e)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x81000000000002, &(0x7f00000000c0)=0x78, 0x4)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e21, @multicast2}, 0xffffffffffffff97)
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000540)={0x100, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e20}, {0x2, 0x4e24, @loopback}, 0x4, 0x1, 0x1, 0x8, 0x0, &(0x7f0000000280)='erspan0\x00', 0x66d, 0x0, 0x8})
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$inet6_sctp(0xa, 0x80005, 0x84)
r2 = socket(0xa, 0x2, 0x0)
ioctl(r1, 0x87800, &(0x7f0000000640)="c626262c8523bf012cf66f")
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680)='/dev/snapshot\x00', 0x181280, 0x0)
r3 = socket$unix(0x1, 0x3, 0x0)
poll(&(0x7f0000000080)=[{r3}], 0x1, 0x401)
recvmmsg(r3, &(0x7f0000005180)=[{{&(0x7f0000004e80)=@pppol2tpv3in6, 0x80, &(0x7f0000005100), 0x0, &(0x7f0000005140)=""/10, 0xa}}], 0x1, 0x0, &(0x7f0000005380))
shutdown(r3, 0x0)
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000440))
connect$inet6(r2, &(0x7f0000000600)={0xa, 0x0, 0x0, @ipv4={[0xfeffffff], [], @loopback}}, 0x1c)
getsockopt$inet_int(r2, 0x0, 0xf, &(0x7f00000000c0), &(0x7f0000000100)=0x4)
ioctl$KVM_DEASSIGN_PCI_DEVICE(0xffffffffffffffff, 0x4040ae72, &(0x7f00000005c0)={0x80000001, 0x1, 0x101, 0x4, 0x20})
bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000002c0)={0x0, 0x9, 0x8}, 0xfffffffffffffd88)
r4 = syz_open_dev$sndpcmc(&(0x7f0000000300)='/dev/snd/pcmC#D#c\x00', 0x3, 0x34102)
ioctl$EVIOCGID(r4, 0x80084502, &(0x7f0000000340)=""/80)
mmap(&(0x7f0000573000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000004c0)={<r5=>0x0, 0x1}, &(0x7f0000000500)=0x8)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000700)={r5, 0x1, 0x6}, &(0x7f0000000740)=0xfe)
getresuid(&(0x7f00000003c0), &(0x7f0000000040), &(0x7f00000001c0)=<r6=>0x0)
setfsuid(r6)

03:35:21 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:21 executing program 2:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
io_setup(0xffff, &(0x7f0000000140))
connect$can_bcm(r0, &(0x7f0000000040), 0x10)
r1 = socket$inet(0x2, 0xf, 0xfffffffffffffc00)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000), &(0x7f00000000c0)=0x4)
io_setup(0x7, &(0x7f00000001c0)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000240)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000080)="040000008cfc6cfde19ab3a251fd2cfd09684d9c7afae3b519d21a2ce3cbdfcb2665dd1203ed5f1023fa813c9a0e46000000004001000000", 0x38}])

03:35:21 executing program 6:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000080)=0x87, 0x4)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x9, 0x0, 0xffffffffffffffff})
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

03:35:21 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x10)

03:35:21 executing program 3:
r0 = socket$inet6(0xa, 0x1, 0x0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070")
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x101000, 0x0)
recvmsg(r3, &(0x7f0000000580)={&(0x7f00000000c0)=@ll={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000140)=""/5, 0x5}, {&(0x7f0000000240)=""/48, 0x30}, {&(0x7f0000000280)=""/189, 0xbd}, {&(0x7f0000000340)=""/99, 0x63}, {&(0x7f00000003c0)=""/110, 0x6e}], 0x5, &(0x7f00000004c0)=""/158, 0x9e}, 0x40000000)
sendmsg$nl_route(r4, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=@mpls_getnetconf={0x2c, 0x52, 0x803, 0x70bd2b, 0x25dfdbfe, {}, [@IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x101}, @NETCONFA_IFINDEX={0x8, 0x1, r5}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x81}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4044011}, 0x80)
setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local, @rand_addr}, 0xc)
getsockopt$EBT_SO_GET_INFO(r3, 0x0, 0x82, &(0x7f0000000180)={'filter\x00'}, &(0x7f0000000200)=0x78)
close(r3)
dup3(r0, r2, 0x0)

03:35:21 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x5e0c000000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  385.266286] binder: 21567:21635 Acquire 1 refcount change on invalid ref 6 ret -22
[  385.351368] binder: 21640:21641 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:21 executing program 6:
r0 = socket$inet6(0xa, 0x1001000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070")
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0c6300008983ad5fa3884e43f836a9af2538273944724ec3e107322de61379f3c0513046248dd3f16ae9f848634447133290819904abc0431211c21da4c2b2165a96362025052a4065f4a16000dad8a493d684f1f92c8441541e2d81342499b7cdd82a0e5a2389d26f96a18a65837c2193b75cfac3734024d0953716e533dfdfa143b9e90056d03bbd4ada87ff61500c65db1c932363dbe2a1e1e862262177d7b0f0d34033b39458a21f28281c8d609db741cdb7f7aca4c512f8679172e201e71f2c8a09fc41490ebff108d855ea7524b76c25585f724141414540f05676b69343c380ea2c8a"], 0x48, 0x0, &(0x7f0000000180)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000900)={<r3=>0x0, 0xb0, "b5c86e3531d7d9e6c941eaf294fb1ceb8b5bb20c53d3944768e75b14f5d984f908e29638ad4f136b448edf509509abf67cf1cc44ed1a0b4284d1cffc098aa545c7b5189a9d04c01c60393e4c6d70d49496e9b8d97533b50cbfec032293caa9e847c58f19bf82b8a810c2ce862a2e1e9cbb7f01a84ef2f97a0fc0d0bd72ecadf49d5482ac4fc79f6cdd805da8b3b54c17f708d8ae6364b4796b9eb31ec07dfc6fc8b3eeffdb9e7d0094b138eef17c8791"}, &(0x7f00000000c0)=0xb8)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000009c0)=@sack_info={r3, 0x800, 0x8}, &(0x7f0000000a00)=0xc)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280), &(0x7f00000002c0)}}], 0x0, 0x0, &(0x7f0000000080)})
r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101000, 0x0)
write$uinput_user_dev(r4, &(0x7f0000000480)={'syz1\x00', {0xfffffffffffffff7, 0x7fff, 0xf9c2, 0x8}, 0x1f, [0x800, 0x2, 0x7fff, 0x0, 0x2, 0x1ae, 0x446c, 0xfffffffffffff000, 0x79df, 0x9, 0xfff, 0x6, 0xf13, 0x4, 0x8, 0x401, 0x80000001, 0x1, 0x40, 0x401, 0x7f, 0x3, 0x9, 0x9, 0x6, 0x6, 0x7, 0x401, 0x3, 0x10001, 0x4, 0x3f, 0x9, 0x299ce3cb, 0x4, 0x80, 0xda, 0x2, 0x1ff, 0x76, 0x7, 0xfce, 0x4, 0xff, 0x6, 0x6, 0x5, 0x3, 0x2, 0x7, 0x6431, 0x1, 0x9, 0x80000001, 0xcfde, 0x1000, 0x3ff, 0x1, 0x100000001, 0x0, 0xb2, 0xab7, 0x5, 0x3], [0x80000001, 0x4, 0x3fa0, 0x24, 0x80000000, 0x0, 0x0, 0xfffffffffffff001, 0xffffffffffffffce, 0x5, 0x3, 0x7, 0x3, 0xdf91, 0xd50, 0x68, 0xd344, 0x7, 0x4, 0x7, 0x1000, 0x80000000, 0x8, 0x177, 0x401, 0x5, 0xffffffffffffa6fa, 0x2, 0x10000000, 0x0, 0x3ff, 0x9, 0x6, 0xfffffffffffffffe, 0x80, 0x0, 0x0, 0x8001, 0x1, 0xe7, 0x9, 0x1f, 0x8, 0xe96, 0x9, 0x20, 0x13, 0x8, 0x9a6, 0x1, 0x6, 0x2, 0x4, 0x8000, 0x800, 0x3, 0x6, 0x3a19a915, 0x7, 0x9, 0x7, 0x7, 0x5, 0x9], [0x10000, 0x9, 0x7, 0x3, 0x6, 0x5, 0xff, 0x9a2, 0x100000000, 0x7f, 0xff, 0x8, 0x6, 0x5, 0x3ff, 0x8, 0x7f, 0x9, 0x6, 0x6e3, 0x1, 0x7, 0x81, 0x0, 0xffffffff00000001, 0x1, 0x54ab, 0xd6, 0x7f, 0x8000, 0xfff, 0x0, 0x27, 0x8, 0xffffffffffff8c5f, 0x0, 0x401, 0x0, 0x8, 0x1, 0x7ff, 0x6, 0x5, 0x45c6, 0x66, 0x95d5, 0xfffffffffffffeff, 0xc07b, 0x1f, 0x101, 0x80000001, 0x5, 0x0, 0x9, 0xfff, 0x5, 0x8000, 0x8, 0x1, 0xfffffffffffffff9, 0xb7, 0xcb58, 0x7, 0x9], [0x10000, 0x4, 0x39, 0xba4c, 0xa4dd, 0x4000000000000000, 0x200, 0x8, 0x7, 0x20, 0x10001, 0x8, 0x4, 0x2, 0x87f, 0x7, 0x3, 0x8000, 0x800, 0x100, 0x4, 0x5, 0xffff, 0x7, 0xcf2c, 0x3, 0xaa0, 0x100000001, 0x3, 0xa9, 0x5dd, 0x7, 0x0, 0x1, 0x9, 0x362c, 0x6, 0x1, 0xfff, 0x89e1, 0x5, 0xf76, 0xffffffffffff1657, 0x1f, 0x4fe5, 0x2, 0x3000000000000, 0xd9, 0x93f0, 0x3, 0xf9, 0x0, 0x0, 0x1, 0x7, 0x2, 0x53e, 0x2, 0x400, 0x2, 0x401, 0xfffffffffffffffb, 0x4, 0x3]}, 0x45c)
r5 = syz_open_dev$amidi(&(0x7f00000002c0)='/dev/amidi#\x00', 0x400, 0x40)
setsockopt$RDS_FREE_MR(r5, 0x114, 0x3, &(0x7f0000000380)={{0x8001, 0x7fff}, 0x1aae7ed013fa4777}, 0x10)

03:35:21 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xb80b, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:21 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:21 executing program 2:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x4000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
setsockopt$inet_mreqsrc(r0, 0x0, 0x2f, &(0x7f00000001c0)={@remote, @local, @rand_addr=0x5}, 0xc)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x3, 0x0, 0x1000, &(0x7f000000b000/0x1000)=nil})
syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="c744240000000000c74424024f000000c7442406000000000f011c24c4427d180508000000c4c245ae08c4e2850108b9800000c00f3235004000000f30d3559e67470f224205c814000066b89d000f00d0c423a95f2518410000e1", 0x5b}], 0x1, 0xf, &(0x7f0000000040), 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000080)={0x0, 0x10000})
ioctl$KVM_RUN(r4, 0xae80, 0x0)
r5 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r5, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000018ff4), 0xc, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="008000000000000000000000eb000000000000"], 0x14}}, 0x0)
sendmmsg$inet_sctp(r0, &(0x7f0000008780)=[{&(0x7f0000000180)=@in={0x2, 0x0, @multicast1}, 0x10, &(0x7f00000035c0)=[{&(0x7f00000005c0)="fe1e5468e7b178309fcfff583a3b11c2fee67f6b967ffd82e106fb41f87cb9e03bb83c8374b6d8e55b19696c593f2b3da4408043e98e5a6db5b8440d2e8fcaaa1deb3fd86df84167436e8d27e5cc3bd664057631a227d9f03c00002e058f74ee5590bdb61a3d466cb1ed92c38228f1e13c31aa1fe2e04de1f6a3809d52cce49798c62cb732cdd14af5ecc63d24fcab124db37d2a87620d6e0001fc7fe977494b0368fb267c59d867ada5a74dbd39e0d1b79e099f00ab87e517d55ae7d5d30656363cbbbcf1911c70338de6b6db4c17f6b8b6a8de6778a0670243901ae847020a770a5e9bdbd9bf5dee253d728dea29816b09402cfcd51e60703e2165f8118f53d9c5bb193a597fe8b2cabcac67dbbfbb3cbf0744ddb724026e2731ed8f3826cbe6b958d7029fb330ed1449bcfd8edd3cbf25a65f8a432b728ad135e4e853df7cdab6499335018bed665965090bfab025a15c34f70890eec99e09c137a61ef84cf7c2275397be5d0e18c3cec98725d334c3e16483c0ca862d7d35b37955e1240edc018f0e51617a194a61a527aa9d20394990066b4ca6b65b0ea68e90c1c01147f2b9311cfa64eb32bc34e5b877bbf606d9b0e969fcc3a0007a9d85cc496fc209f721ceedb0ad12ad9296029297e680d5b030e97a6d29c949163317f256d562900d1b324666313fcd87ff24ebf42cc6df35e6873b3fa8b36380d10237f9e6442e7c4a9ed917cc5c57186d7be8e806991bdd72cb24e887770b107b8b65c39561907c39ea7c40de02688f30c86d810f9b75de5de9699e26eb5913ab116b3bf039c4b9c58ea29637689f5d21447eb8415d6d5fd8975f8f8ffbb9d11170dd264e33af44f6c51ba981c08e989e62fb72b7e0f633772ebed294403f141304c74640050fecff65d93a98b0e246e6a20cb8801ec94e5d44789caccf2fd28e6ed4b674473d24886873648d0ef9c99cce735dfd97754c68ebd343d3542833bc62ea47ecaa4c96966703a6423052ee0d6008f53a51fe3ba140b1cefd8e08511334545f7b7d199bdde71c483e73be36dd703cee02e8af438b45b9a8739f3fce847f0d623d78c948300d0394170f6108281fbf70d9b8fbcd86e99e859eb1732d735550bcef5dd057982ebdb604f8ab98f73166b1da8c1946241851f5e04504ac204bb1b58419127f3cf9c5425d84da7f511d9e556471a5cdfaf28a77b598d9dd7e863d90479536331af1d1b90f77ad848dbdd7b9e60a706e4c3aa2d3ce832fb6ca8cf1349882c7b08b4f305d86c42e535ed00255237dc534935fef1c650b3ab47cca8b6098fdf87f97f0797a28993689379879cf679ae99a598071045256ad038bd3749156498f3874bc8292a0e16deb0285e9101a206e2efb1a27cd2d70ad87a187b5e919482dffcab091134817d86af73adff17fb4c7aaa24833c3fe9a8264c46e32fc0049db6974a73f1e94a65b73b33cf7c85943517a319909c735178afe8ef4682f32e3b01c9c739a4c974c440a2f05ec363dc40d0041129be67f4e0fdeb0e9873b136a9a34796a7f8335aecd04d00b3fde7b634ff90677386df5c104ac818817859a93edef6cd30957d40db14659676f432a6272a9ff3fda59301a88290ff3806d1a7687a958c97b80d53713607f370e01cf0e602599f5ed5749e0d8d964c90cf28fe7368bc235f6278505695bf8fa83ccbe065cd117f67f0976e16b47fa15bec80216dfdf5f752af2c4e1ef4b6687462b724d7c0666328f16d2e0f680f0c9cb2a16290d6e94d455c07e10b6942aae3f3607e2978b43434d3ee278e967d8ccf15439bdd94f1215acc1d1f8641e3238cb2f947696445448eb1272bdd917d69e84e373a6dae8e134404cf78706985f96eaa280301e515d4e4298dba09e573e846567b45760eae75e5bda5a3d84ec4fecd88923c3ae26793213f322747c5184dd6e7c5645ab7f070a0c4f7d57ca2dcb40f9f13d956074d90b58a809483a249ba9245ea0faba0ad7bcf5df51dbb3805a75a45bfa33bdacc2aabf5cc6dae333ab30ed921ae28d9d1e5e374bdc235f2af7031f716434b5307d4dadacc05ee2e8e2358aca61f43a77c3e8af8f812365f904d2cea4d373852b1a0148f876f497b9d758bbdfae39fd0856979015da01335451f21fefa7db5ea1cd84f1bbccb8c4325fb50ed83400622e7bbdbe75d8180221ff529b58ee225832d0841aff187efbeff2a6c9227923ae0b00d6da8bf4dfa9db9dc0af9f04e1d4d50309026ebda40fa71f158003eaae30e901ef618bafb40a96921d76e41c7b0102331b215974dda2485a82e9d9d3fe2d23cdb850a7997ee8308d7ba6c8bfa8c0dd1911d1426707565922346f2bd4edb1fce77357f0f44d52692a88e06223aefbfc1d73a3742d61ba636ae2b1b8c594683617412df40a93deb33fea0f69f669db941556cc2d0de1cfe1b20f88b9045224220487a581b971a53b505279b42dd39d39b69d42e0aa094d75ec843fe81b5b1ddef596821e2f8a5416f1e5598aed0e5f96fd44eed9f6b3db981d5de5aed7de6720d6c4ac76c03514bc2de281ccde91d17925fbc634564360fc36bd1a9e6fce02b7a7fa76dee007ca617638d23c6ff62a153d8fedad6ceb609aa569eac5c9124f69aa58c9817e743939565f4c87e58139742c4f2d4403991be2638471afa2f5cb1418e0dcf252d8fcd58126b27e4f6942816bb8cbc3657396becf125f1a6e9990a1115a5dc8ca6da0b5ef0cd6ef5cf23f0f4a2a0c329093a590ed8ff094b98398e25a794efeb2b14e0a50436cd57c74bae2692a34506887e46391ae6765aea2e9e29e22a64984d80e9b21ab00c64e65c6fe2d5c2faec9f49541e575b019afe8de75f6ab7c94bc5d8aa7eb91df3a1cd807df89b4f249f913bd0047df78746c7bac7df5358fcbfc56ddd29b3ccf49e38c0ee46e83706cd4a21ef7f2b8ade3c118089462d58a4757bc3c64ce0562ee12f5fa1db8f0f3edd377c1a2ba311780766cfe80accda5c7aea03fb28dc45891a027b31ded9b13953943a699ef6537808848b0b431eac4055d05ba1a34ffdd60d2fa279b9832dff4714ec8ee7c4b482ba2fe7543584644c0a30e4f337e7eb164fb436f94ab14c91b6dd915bfca6f0fc19d8cdb41feacb5bbe69a2938ae63740c0fba85ccfd7cd2c2db55faa98d3a1c3fd4a997889bbad2cece51b772df3876270d6e7f03f36f640d51da3130cf91d7d4b40061ae72854d24fc1c5ec0c9c6d7d3c7aae4fce89920a9f577c1f58a9c4aa5ce850f1e21b7a8fcdcd8c7fdea56486ede480fc2d4c1629daccc3790e124f5d39c08ae136c130529dd79de6e496b6cdbb75f52bf31a5b63551a53228e90eee7d492fd3efb43b0e2377288eb28813bc048fd503fcc49ba79b7b89385d0f72722f6f084789e19911d3cb4effd47c7132161259c2d6b0f71e1a48bd02f1d84f9d4c2fd5b2ce960f11bffb3bb03e264e87b821cc14b2d245f4b0ab04a8f49d69437a764bac19ec7495488fa6136b1f16f7f543d60008902bf0b955027d8cbc20131701dbce9dacd96e25", 0x9c5}], 0x1}], 0x4924960, 0x0)

03:35:21 executing program 3:
setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x80000001}, {0xa, 0x0, 0x0, @remote}}, 0x5c)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001c40)={&(0x7f00000000c0), 0xc, &(0x7f0000001640)=[{&(0x7f00000020c0)=ANY=[@ANYBLOB="1000007f0ad21853315b6402b153"], 0x1}], 0x1}, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000002100)=ANY=[@ANYBLOB="001000009cb31d58ff0ca0591e6f5e932a07b505ea40dd38d2b34cb8b8b99f8dfd4fdbab36805f720d85b24b7e590a121ca11171b9ce39dad7c6e9129d9c9b025dc7adb3aa6529f85450b339924e521d0c5c1297a60b5982aff9c9c2427c2d04da67123b73e738d4dd1c9c7aec0942f29b27f5a3cdf0349854633b3ed5bf1fad5a2d7cc144edafedb9dffeb3b13b501781cea0eb0037cc42df09de4fe7f049cc03ad8286dd02b861af07e259439ac2be0aabdd437ca4514ee43432c7f028d14097a53ba17ce1a38a7732543ba8bf972171b0ee2b91b6e4f7e3437c171200bfd64b14ca6c93aaa4de8821864343429079014739cd4b181d6f8621c708ac0fc1e9cc48e91349480df72f6b18adccd03adf1ab494ab0772c3086d41d4ab2eacf99c93f0adcb4b2e953d5a6c7606d778f373067916ae4b97c8e907c709d7392463f031e973a738012141f971b44480eb46a6396f7a6db6ef6abfd19722ee5660af7bfc26b5eabdaa3fbcac7ceaa630457036b4be7944af74bd5d7402d67f9948ba97304653a83dc361790d7b3b4a95e7401293855f4d5d6684b52df9e777d58601ca613a27d2"], &(0x7f0000001200)=0x1)
setsockopt$inet6_int(r0, 0x29, 0x40, &(0x7f0000001fde), 0x4)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.stat\x00', 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000100)={0x0, 0x7e7, 0x8, 0x0, 0x8, 0x2, 0x3f, 0x9, {<r2=>0x0, @in={{0x2, 0x4e20, @multicast1}}, 0x100000001, 0x100000001, 0x2, 0x3ff, 0x1}}, &(0x7f0000000040)=0xb0)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000080)={<r3=>0x0, 0x5}, &(0x7f00000001c0)=0x8)
getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000200)={r2, 0x1b, 0x7, 0x4, 0x5f418f65, 0x0, 0x8000, 0x9, {r3, @in6={{0xa, 0x4e24, 0x1, @local, 0xffffffffffff8001}}, 0x2, 0x6, 0xe82d, 0x1, 0x562}}, &(0x7f00000002c0)=0xb0)

03:35:21 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x10)

[  385.751883] binder_alloc: 21647: binder_alloc_buf, no vma
[  385.757596] binder: 21647:21648 transaction failed 29189/-3, size 0-0 line 2967
03:35:21 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:21 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0x10)

03:35:21 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TCGETS(r0, 0x5401, &(0x7f0000000180))
ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000040))

[  385.818224] binder_alloc: binder_alloc_mmap_handler: 21647 20001000-20004000 already mapped failed -16
[  385.863953] binder: BINDER_SET_CONTEXT_MGR already set
[  385.870703] binder_alloc: 21647: binder_alloc_buf, no vma
[  385.876604] binder: 21647:21669 transaction failed 29189/-3, size 24-8 line 2967
[  385.901295] binder: 21647:21648 ioctl 40046207 0 returned -16
03:35:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/icmp6\x00')
ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x8)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000380)={<r3=>0x0, @in={{0x2, 0x4e20, @loopback}}}, &(0x7f0000000040)=0x84)
setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000500)={r3, @in6={{0xa, 0x4e22, 0x9, @dev={0xfe, 0x80, [], 0x18}, 0x1}}}, 0x84)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f00000000c0)}}}], 0x0, 0x0, &(0x7f0000000500)})

03:35:21 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x63}, 0x2c)
bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xa, 0x5, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0x4c}]}, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0x3bc, &(0x7f00001a7f05)=""/251}, 0x2e)

03:35:21 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x3ffdb0]}, 0x10)

[  385.963845] binder: 21647:21679 got transaction to invalid handle
[  385.970307] binder: 21647:21679 transaction failed 29201/-22, size 0-0 line 2852
[  386.023527] binder: release 21647:21648 transaction 97 out, still active
[  386.030841] binder: unexpected work type, 4, not freed
[  386.036299] binder: undelivered TRANSACTION_COMPLETE
03:35:22 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TCGETS(r0, 0x5401, &(0x7f0000000180))
ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000040))

03:35:22 executing program 6:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x200000000000001, 0x80, 0x200000100, 0x56, 0x0, 0x1}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000240)={r0, &(0x7f0000000080), &(0x7f00000002c0)}, 0x3e)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r0, &(0x7f0000000180), &(0x7f00000000c0)=""/96}, 0x18)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x25)
ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r1, 0xc008551b, &(0x7f0000000080)={0x8001, 0x8, [0x3, 0x4]})
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r1, &(0x7f0000000280)="1ea42202da4581f51ca8ea01a6da369e9366454bfdfd46f85bac3ed22788c3aaf17ab6fd41ad1ffc4b631fbcc359bff2151a12d144a824aea7b289ac399925978ca64c3c3427f7174ff4cd4934673696e19f8876bfd3b76e8b5481323715859a70eeb0ff179556c37e736d84d43b080c423ebc10d7f6b09097804362bb7fe83110f31fcafa457a6f1af01691e40158", &(0x7f0000000340)=""/4096}, 0x18)

[  386.076986] binder: BINDER_SET_CONTEXT_MGR already set
[  386.092491] binder: undelivered TRANSACTION_ERROR: 29201
[  386.113511] binder: undelivered TRANSACTION_ERROR: 29189
[  386.118195] binder: 21692:21693 ioctl 40046207 0 returned -16
[  386.145421] binder: release 21647:21648 transaction 97 in, still active
[  386.152348] binder: send failed reply for transaction 97, target dead
[  386.159019] binder: undelivered TRANSACTION_ERROR: 29189
[  386.160984] binder: 21692:21699 transaction failed 29189/-22, size 0-0 line 2852
03:35:22 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x7a00000000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:22 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  386.267439] binder: 21710:21711 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:22 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x900, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:22 executing program 2:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r2 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x4058534c, &(0x7f0000000080)={0x80})
socket$inet6(0xa, 0x80000, 0x7fff)
setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x60, &(0x7f0000000040)={0x0, @empty, 0x0, 0x0, 'dh\x00'}, 0x2c)

03:35:22 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfc000000]}, 0x10)

03:35:22 executing program 6:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xf, 0x4, 0x4, 0x9}, 0x11)
unshare(0x20000400)
r1 = dup(r0)
ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0)
bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x4}, 0x10)

03:35:22 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:22 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TCGETS(r0, 0x5401, &(0x7f0000000180))
ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000040))

03:35:22 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:22 executing program 6:
ioperm(0x0, 0x4, 0x0)
ioperm(0x0, 0x403, 0x1fe)
r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={{0x4, 0xf4, 0x8, 0xc6cd, 0x7, 0x80000001}, 0x401})

[  386.861897] binder_alloc: binder_alloc_mmap_handler: 21692 20001000-20004000 already mapped failed -16
[  386.871933] binder_alloc: 21692: binder_alloc_buf, no vma
[  386.877581] binder: 21692:21745 transaction failed 29189/-3, size 0-0 line 2967
03:35:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/icmp6\x00')
ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x8)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000380)={<r3=>0x0, @in={{0x2, 0x4e20, @loopback}}}, &(0x7f0000000040)=0x84)
setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000500)={r3, @in6={{0xa, 0x4e22, 0x9, @dev={0xfe, 0x80, [], 0x18}, 0x1}}}, 0x84)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), &(0x7f00000000c0)}}}], 0x0, 0x0, &(0x7f0000000500)})

03:35:22 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TCGETS(r0, 0x5401, &(0x7f0000000180))
ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000040))

03:35:22 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x10]}, 0x10)

03:35:22 executing program 2:
r0 = perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$kcm(0x29, 0x7, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2)
r1 = epoll_create1(0x0)
epoll_wait(r1, &(0x7f0000b70000)=[{}], 0x18b, 0x400000800)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140))

03:35:22 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:22 executing program 6:
r0 = syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000000)={0x100000000}, 0x4)
ioctl$int_in(r0, 0xab09, &(0x7f00000003c0))

[  386.931004] binder: undelivered TRANSACTION_ERROR: 29189
[  386.937269] binder: undelivered TRANSACTION_ERROR: 29189
[  387.027112] binder: 21759:21760 got reply transaction with bad transaction stack, transaction 108 has target 21759:21760
[  387.038546] binder: 21759:21760 transaction failed 29201/-71, size 0-0 line 2774
03:35:23 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x74000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:23 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  387.098264] binder: release 21759:21760 transaction 108 out, still active
[  387.105303] binder: undelivered TRANSACTION_COMPLETE
[  387.110495] binder: undelivered TRANSACTION_ERROR: 29201
[  387.171636] binder: release 21759:21760 transaction 108 in, still active
[  387.178633] binder: send failed reply for transaction 108, target dead
[  387.204912] binder: 21773:21774 Acquire 1 refcount change on invalid ref 1946157056 ret -22
03:35:23 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x4, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:23 executing program 6:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000040)={0x2, 0x1, 0x0, 0x0, 0x12, 0x0, 0x0, 0x0, [@sadb_ident={0x2, 0xa, 0x40, 0x0, 0x1}, @sadb_key={0xa, 0x0, 0x240, 0x0, "e0b0eab01b0775581b078616889f486f7b4baf7a9c1179d3f5acfb82414c0247aab5860c275e5f66c57936bc46853a15f58f346bd1a73c871b078ea7b6f978e8d1b55cd24dab2edd"}, @sadb_address={0x3, 0x17, 0x32, 0x80, 0x0, @in={0x2, 0x4e22, @local}}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e24}]}, 0x90}}, 0x0)

03:35:23 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xb0fd3f0000000000]}, 0x10)

03:35:23 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070")
sigaltstack(&(0x7f0000461000/0x3000)=nil, &(0x7f0000000080))
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
clone(0x0, &(0x7f0000000280), &(0x7f0000000000), &(0x7f0000000040), &(0x7f00000001c0))
r1 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x8, 0x2)
setsockopt$inet_tcp_int(r1, 0x6, 0x9, &(0x7f0000000100)=0x9, 0x4)

03:35:23 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TCGETS(r0, 0x5401, &(0x7f0000000180))

03:35:23 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:23 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x7a00000000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:23 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  387.525688] binder: 21776:21786 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:23 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x5, 0xc200)
accept4$alg(r1, 0x0, 0x0, 0x80000)
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0))
mount(&(0x7f0000000400)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f0000000480))
mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000040)="045b898f73", 0x1004, 0x0)
mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200))
mount(&(0x7f00000000c0)='./file0//ile0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0)
name_to_handle_at(r1, &(0x7f0000000180)='./file1\x00', &(0x7f0000000440)={0x91, 0x800, "1093222950a21a4e4c00a9d3a67cecaef389753bf85f59dbe590573e4cdcb128eac0cb9ba67994173b188d1d375ea298e5b1ed08e9bd12d3f6870a90287b16ed6735ac16954c6ebdef0eb4a331b8900bed5ec6515da733a95df9027d69eb9a9bfe0156faee81796feaaa0e94c5901513d765aeb1789bee417710a3ca88d09b72e13f29d3dce27875b5"}, &(0x7f00000002c0), 0x400)

03:35:23 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xa0010000000000]}, 0x10)

03:35:23 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:23 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070")
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10)
r2 = accept$alg(r1, 0x0, 0x0)
sendmsg$alg(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x2f5}], 0x30}, 0x0)
write$binfmt_script(r2, &(0x7f0000000300)=ANY=[], 0xffffffaa)
recvmmsg(r2, &(0x7f0000007e00)=[{{&(0x7f0000001240)=@alg, 0x80, &(0x7f0000004700)=[{&(0x7f00000012c0)=""/167, 0xa7}, {&(0x7f0000000100)=""/49, 0x31}, {&(0x7f0000003580)=""/4096, 0x1000}], 0x3, &(0x7f0000004780)=""/245, 0xf5}}], 0x1, 0x0, &(0x7f0000008000)={0x0, 0x989680})

03:35:23 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:23 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xa0020]}, 0x10)

03:35:23 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x6c00}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:23 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x9)

[  388.002599] binder: 21773:21829 Acquire 1 refcount change on invalid ref 1946157056 ret -22
[  388.054720] binder: 21833:21834 Acquire 1 refcount change on invalid ref 27648 ret -22
03:35:24 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x11, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:24 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:24 executing program 2:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
close(r0)
socket$kcm(0x2, 0x3, 0x2)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x204000, 0x0)
ioctl$TIOCEXCL(r1, 0x540c)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x40, 0xa9, 0xa37, 0x1, 0x1}, 0x2c)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000002800000850000000000000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0xce, &(0x7f0000000180)=""/206}, 0x48)
signalfd(r3, &(0x7f0000000100)={0x2800000000}, 0x8)
bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x10, 0x4, &(0x7f0000000040)=@raw=[@map={0x18, 0x2, 0x1, 0x0, r2}, @call={0x85, 0x0, 0x0, 0x3d}], &(0x7f0000000140)='GPL\x00', 0x41, 0xffc4, &(0x7f00000004c0)=""/167}, 0x48)

03:35:24 executing program 6:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={<r1=>0x0, 0x3, 0x4, 0x4}, &(0x7f0000000080)=0x10)
getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000000c0)=@assoc_value={r1, 0x4}, &(0x7f0000000100)=0x8)
ioctl$FICLONE(r0, 0x40049409, r0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}], 0x1c)

03:35:24 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xa00100]}, 0x10)

03:35:24 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x9)

03:35:24 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:24 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x9)

03:35:24 executing program 6:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
socketpair$inet6(0xa, 0x6, 0x80000000, &(0x7f0000000240)={<r4=>0xffffffffffffffff})
setsockopt$inet6_udp_encap(r4, 0x11, 0x64, &(0x7f00000006c0)=0x2, 0xfffffffffffffff1)
syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f00000000c0)="c4c379146600006543a02d0000000000000064670f01cab8010000000f01d946d8f1e1b066ba400066edb9f60800000f32f2400f0964460f35", 0x39}], 0x335, 0x0, &(0x7f0000000000), 0x0)
r5 = socket$inet(0x2, 0x4000e, 0x9)
ioctl$sock_inet_udp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040))
ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000100))
ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f00000001c0)={[{0x0, 0x0, 0x3}]})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f00000002c0)={"b9e8235db007809205b6700c78eeceefaa124f6f6dca92b0d3ff9839d3140de351196d30936a0bcd249f4b8c20f5341e8b23dfc31da6d63aea1c54932a5da66f8ea0df85656be4f5d295d29281c70519455d7030de376afc8db0edf8407831f8dd15e951c8544d14943e4d9ee352eece0c0ac4be545a9359ce7dd13fac15d38e226d477d2d16c45650c311ddd454abfe0c9ae9ac0928932198a2223a5d9b08c3eb0c570f0992406a5e4892406e1f7fceaa4001737535c2d9bab74a6c0706a34294d1fcc2c1c73ba195755810e7ab51a937a8b63eed10ae4332914dc5737634796929f42ed6c85125bb1f510a27a47b2a42eb4ea8cdd61aa9d3f145e9206002e6ac4c8dbc8affd2e2624f2494c04e82329aa515dac138c82aba9cbb058c43c3ec0dac03c577f8db194abdd08143b362f3b3d5658cda6abc87e09b9dda000d883371a2145e6f2bc9658e15a665274d86f612a8ef2c850f3f8a72be44c51bf702fd789e3856c13675b6d83ed8d7b80c13d872722c256a5672857337d73350d05bd78c1fddbb465febbcd4e46b3875592c69da902a368be2baf60fe1cfff3b9aa609a5404346a60ca5fc0c323d203cb395f744657b42ba172705fa745b69a61dd1f86a9881788318004baa552a2cac30da7f250c47b19f6f46e5cdedd946d3623caf5b420ed3a96450faa85cee6596482c9567b9517df0b88d976f1bdd85d9db4746d39a59fd541df18984c4ad9c11c7e35a0f7a615976ea4845f4c88149d94227cb821319f0cbbee61f628a80fcce3405b059207c3e6fe6b98381832f172a1f4b1f64d7dae4e29ac7a972e2c29b800a51dfb238268ab15641f83620fb404eb02140de3506a03405a14441e2cabcb4e9e6ac10c80ea62054e649b57178abebc5f065f2e0a2c08f75249624bfc4f72884efe6fa6ce3fb611c99d5d8297896961bc8ba09b91690a270d88c8ce17350c641b3eb661670227d110932acfa2b7e996dac730c2eb64496082cbc4448133fbb95ebde022f57d6d31672cec97b95d6417fbefced6c8a75c863c697a9dfcbad9b7f60494944ef18fb3c85e89ccb974c009f0b18a1bfc95a103022ebe0015c4ca559aaf187d50dce3317f7ab41cf31b4a3b40a772c0b3d2321b28bdebb4dd969f52bec5e73385107017a0119b1af50f37203ae6fda4e4e5307c00c74a3d28d57bba64a8e0ab27fa7bafc449a9bb8cbe3fc82f0fe2b3ff5b08a8439a3485bb4bc8fd1e3bbe6f410c7d9fc305ce1fce8570077d5f459138d859efc6d300685f2bb5f4eb8a33a576c7d2a4cfc0431c199c505b1b861890fca52272b8227eb7f8f9fe31d12db63f9e69b9fe1fa4b4bd0a78f48c93e2c8a9f6d3258f3c8e27185d1e38aac461ee53953209a088d9ff41b7b6310166d78fddfea9e35bed246b334b40a306de8998d18a21558825ad57878de0748418806"})

03:35:24 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x8]}, 0x10)

03:35:24 executing program 5:
r0 = socket$l2tp(0x18, 0x1, 0x1)
r1 = dup2(r0, r0)
pipe(&(0x7f0000000000))
connect$llc(r1, &(0x7f0000000040)={0x1a, 0x0, 0x6, 0xffffffffffffffff, 0x4}, 0x2)
socket$l2tp(0x18, 0x1, 0x1)
msync(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x7)

03:35:24 executing program 2:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={<r2=>0xffffffffffffffff}, 0x111}}, 0xffffffffffffffbe)
fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000040))
write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000400)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @ib={0x1b, 0x3, 0x3ff, {"e65c15f04f5068ff4c97869c857cc218"}, 0x5, 0x6, 0x6}}}, 0x90)

03:35:24 executing program 3:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:24 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:24 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x5}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:24 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x10)

[  388.848914] binder: 21833:21893 Acquire 1 refcount change on invalid ref 27648 ret -22
[  388.904223] binder: 21899:21900 Acquire 1 refcount change on invalid ref 5 ret -22
03:35:25 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfc, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:25 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:25 executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c)
listen(r0, 0xa92e)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = openat$cgroup_ro(r0, &(0x7f0000000040)='memory.current\x00', 0x0, 0x0)
getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000000c0)={<r3=>0x0, 0x1200, 0x3, 0x800, 0xfffffffffffffffa, 0x8}, &(0x7f0000000100)=0x14)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000140)={r3, @in6={{0xa, 0x4e21, 0x7f, @remote, 0x6}}, 0xff, 0x7, 0x8cc0, 0x1, 0x80}, &(0x7f0000000200)=0x98)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r4, &(0x7f0000000280), 0xfffffffffffffedd, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000]}}, 0x1c)
sendto$inet6(r1, &(0x7f0000000280), 0xfffffffffffffedd, 0x2000012b, &(0x7f0000000080)={0xa, 0x4e20, 0x63bc, @empty={[0xe00000000000000]}}, 0x32b)
close(r0)

03:35:25 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, [{}, {}, {}, {}]}, 0x68)
socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff})
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000000c0)={0x3, [0x0, <r2=>0x0, <r3=>0x0]}, &(0x7f0000000100)=0x10)
setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000140)={r2, @in6={{0xa, 0x4e22, 0xffff, @remote, 0x9}}}, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000200)={r3, @in6={{0xa, 0x4e22, 0x7883, @remote, 0xffffffffffffff7a}}, 0x3, 0x1f}, 0x90)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000002c0)={r3, 0xe38c}, 0x8)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000300)=@assoc_value={<r4=>0x0}, &(0x7f0000000340)=0x8)
ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000380)={{0x1, 0x1}, 'port0\x00', 0x40, 0x80000, 0x8, 0x5, 0x0, 0x3ff, 0x7, 0x0, 0x7, 0x7fff})
removexattr(&(0x7f0000000440)='.\x00', &(0x7f0000000480)=@random={'btrfs.', 'nat\x00'})
r5 = getpgrp(0xffffffffffffffff)
fcntl$setownex(r0, 0xf, &(0x7f00000004c0)={0x2, r5})
getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000500)={<r6=>r3, 0x2f, "1331ed152b263963a1315f52790a4cfa12bff34ddc8da72948e464a30f0542a6c45ec196308b1f9fe457bedd868270"}, &(0x7f0000000540)=0x37)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x4000, 0x2)
ioctl$KVM_ENABLE_CAP_CPU(r7, 0x4068aea3, &(0x7f00000005c0)={0x7b, 0x0, [0x7fffffff, 0x25, 0x80000000, 0x6]})
r8 = shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x4000)=nil, 0x3000)
shmdt(r8)
ioctl$KDGKBTYPE(r7, 0x4b33, &(0x7f0000000640))
ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r0, 0xc1105518, &(0x7f00000006c0)={{0x1, 0x1, 0x80000000, 0x7, 'syz0\x00', 0xbf}, 0x3, 0x100, 0x2c, r5, 0x9, 0x80, 'syz1\x00', &(0x7f0000000680)=['port0\x00', 'procmd5sum\x00', '\x00', '\x00', 'btrfs.', '\x00', '[cpusetcpuset!selfeth1,\x00', 'nat\x00', 'user\x00'], 0x3b, [], [0x1000, 0x8, 0x80000000, 0x4]})
setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r7, 0x84, 0x72, &(0x7f0000000800)={r4, 0x44, 0x30}, 0xc)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000c80)=@nat={'nat\x00', 0x19, 0x3, 0x3d8, [0x20000880, 0x0, 0x0, 0x20000958, 0x20000ae0], 0x0, &(0x7f0000000840), &(0x7f0000000880)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x9, 0x3b, 0x0, 'team_slave_1\x00', 'ip6gre0\x00', 'bond0\x00', 'team_slave_1\x00', @broadcast, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], @remote, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], 0x70, 0x70, 0xa8}}, @snat={'snat\x00', 0x10, {{@random="a268da76adbd", 0x10}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x9, 0x1, 0x88fb, 'gre0\x00', 'erspan0\x00', 'bridge_slave_0\x00', 'ifb0\x00', @remote, [0x0, 0xff, 0x0, 0x0, 0xff], @broadcast, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], 0x120, 0x120, 0x158, [@rateest={'rateest\x00', 0x48, {{'sit0\x00', 'team_slave_1\x00', 0x10, 0x3, 0x100000001, 0x6, 0x1, 0x7, 0x3, 0xf8}}}, @connbytes={'connbytes\x00', 0x18, {{0x5, 0x8, 0x2, 0x1}}}]}}, @arpreply={'arpreply\x00', 0x10, {{@random="ea3338d827cd", 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x11, 0x6000, 'veth0_to_team\x00', 'bridge_slave_1\x00', 'syzkaller0\x00', 'syz_tun\x00', @remote, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @broadcast, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], 0xd8, 0x110, 0x148, [@cluster={'cluster\x00', 0x10, {{0x7, 0x7, 0x6, 0x1}}}, @connlabel={'connlabel\x00', 0x8, {{0x5, 0x2}}}]}, [@arpreply={'arpreply\x00', 0x10, {{@broadcast, 0xfffffffffffffffe}}}]}, @arpreply={'arpreply\x00', 0x10, {{@broadcast, 0xffffffffffffffff}}}}]}]}, 0x450)
getrandom(&(0x7f0000000d00)=""/85, 0x55, 0x2)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000d80)={r6, 0xfffffffffffffffa, 0x10, 0x9, 0x7fff}, &(0x7f0000000dc0)=0x18)
finit_module(r0, &(0x7f0000000e00)='selinuxppp1\x00', 0x0)
syz_open_pts(r7, 0x0)
ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000e40)={{0x1, 0x3ec1daf6, 0x5f2f, 0x21, 0xe8ca, 0x1f}, 0xcd})
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000e80))
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000ec0)=@sack_info={r4, 0x200, 0x9}, 0xc)
ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000f00)={0x5})

03:35:25 executing program 3:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:25 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xa002000000000]}, 0x10)

03:35:25 executing program 6:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
socketpair$inet6(0xa, 0x6, 0x80000000, &(0x7f0000000240)={<r4=>0xffffffffffffffff})
setsockopt$inet6_udp_encap(r4, 0x11, 0x64, &(0x7f00000006c0)=0x2, 0xfffffffffffffff1)
syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f00000000c0)="c4c379146600006543a02d0000000000000064670f01cab8010000000f01d946d8f1e1b066ba400066edb9f60800000f32f2400f0964460f35", 0x39}], 0x335, 0x0, &(0x7f0000000000), 0x0)
r5 = socket$inet(0x2, 0x4000e, 0x9)
ioctl$sock_inet_udp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040))
ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000100))
ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f00000001c0)={[{0x0, 0x0, 0x3}]})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f00000002c0)={"b9e8235db007809205b6700c78eeceefaa124f6f6dca92b0d3ff9839d3140de351196d30936a0bcd249f4b8c20f5341e8b23dfc31da6d63aea1c54932a5da66f8ea0df85656be4f5d295d29281c70519455d7030de376afc8db0edf8407831f8dd15e951c8544d14943e4d9ee352eece0c0ac4be545a9359ce7dd13fac15d38e226d477d2d16c45650c311ddd454abfe0c9ae9ac0928932198a2223a5d9b08c3eb0c570f0992406a5e4892406e1f7fceaa4001737535c2d9bab74a6c0706a34294d1fcc2c1c73ba195755810e7ab51a937a8b63eed10ae4332914dc5737634796929f42ed6c85125bb1f510a27a47b2a42eb4ea8cdd61aa9d3f145e9206002e6ac4c8dbc8affd2e2624f2494c04e82329aa515dac138c82aba9cbb058c43c3ec0dac03c577f8db194abdd08143b362f3b3d5658cda6abc87e09b9dda000d883371a2145e6f2bc9658e15a665274d86f612a8ef2c850f3f8a72be44c51bf702fd789e3856c13675b6d83ed8d7b80c13d872722c256a5672857337d73350d05bd78c1fddbb465febbcd4e46b3875592c69da902a368be2baf60fe1cfff3b9aa609a5404346a60ca5fc0c323d203cb395f744657b42ba172705fa745b69a61dd1f86a9881788318004baa552a2cac30da7f250c47b19f6f46e5cdedd946d3623caf5b420ed3a96450faa85cee6596482c9567b9517df0b88d976f1bdd85d9db4746d39a59fd541df18984c4ad9c11c7e35a0f7a615976ea4845f4c88149d94227cb821319f0cbbee61f628a80fcce3405b059207c3e6fe6b98381832f172a1f4b1f64d7dae4e29ac7a972e2c29b800a51dfb238268ab15641f83620fb404eb02140de3506a03405a14441e2cabcb4e9e6ac10c80ea62054e649b57178abebc5f065f2e0a2c08f75249624bfc4f72884efe6fa6ce3fb611c99d5d8297896961bc8ba09b91690a270d88c8ce17350c641b3eb661670227d110932acfa2b7e996dac730c2eb64496082cbc4448133fbb95ebde022f57d6d31672cec97b95d6417fbefced6c8a75c863c697a9dfcbad9b7f60494944ef18fb3c85e89ccb974c009f0b18a1bfc95a103022ebe0015c4ca559aaf187d50dce3317f7ab41cf31b4a3b40a772c0b3d2321b28bdebb4dd969f52bec5e73385107017a0119b1af50f37203ae6fda4e4e5307c00c74a3d28d57bba64a8e0ab27fa7bafc449a9bb8cbe3fc82f0fe2b3ff5b08a8439a3485bb4bc8fd1e3bbe6f410c7d9fc305ce1fce8570077d5f459138d859efc6d300685f2bb5f4eb8a33a576c7d2a4cfc0431c199c505b1b861890fca52272b8227eb7f8f9fe31d12db63f9e69b9fe1fa4b4bd0a78f48c93e2c8a9f6d3258f3c8e27185d1e38aac461ee53953209a088d9ff41b7b6310166d78fddfea9e35bed246b334b40a306de8998d18a21558825ad57878de0748418806"})

03:35:25 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xf00000000000000]}, 0x10)

03:35:25 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:25 executing program 5:
r0 = socket(0x20000000000000a, 0x2, 0x0)
connect(r0, &(0x7f0000000000)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80)
setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000080)=0x5, 0x4)

03:35:25 executing program 3:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:25 executing program 2:
socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000180))
syz_open_procfs(0x0, &(0x7f0000000040)='net/raw\x00')
r0 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x6, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x240082, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"00ac720000000000ec973f820f7c4000", 0x102})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x30a)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000100)={&(0x7f0000000080), 0xc, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="280000001000e4eeb4855fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="03ff0100000000330001b8b03694f212fc1f8dad21f2741bc000f43f0285000026242c0b03be1babf23e94d518d368eac6a575a5b8c4bf07cfe2807c9194ac5f4f9d8237ed1105d9f9147c217a06ff6c5ed915cebc2f60e1d8655154467ff6d742751b3474269d955245f04933ae116aa0f9e108a324343e8ca2935f88c5e9c427aaf19b2decff0733d01732edc5487d54faf21bc5686f5e9bf078a1e51a6e2eef2b2fe49b2b23e70731167ea42e460ae407b2ccb93fdb5d89730e814f129e8a66363abb9bf643cd22e45b84626a510b7bbb9acf13541bca0f3e30eed6d87ff93de30c3079a32f174a630c52dc61072c3389f21223aa9c031bc4acf5080c657899193149b48824a4f330c072e4ac7eb049d7b2e8dbe30573995a17a5d4b3a44bb61cac47549a81ba5f35b63dda1b658215253f1aef531e68249be1238c5eacbb8e9acd86c8cebe03d5d4db39906c257a1c11044d99a0991851388d7316a5710cb867a7346c038c4c960c4f8b6e9446f60df12448ad5e860eb2910a9d45ac7bdb74"], 0x28}}, 0x0)
close(r1)

03:35:25 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x100000000000]}, 0x10)

03:35:25 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:25 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xffffff7f00000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:25 executing program 3:
perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

[  389.700447] binder: 21899:21957 Acquire 1 refcount change on invalid ref 5 ret -22
[  389.748085] binder: 21962:21963 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:26 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x3e8, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:26 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000240)='fou\x00')
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0xc09, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x1}]}, 0x1c}}, 0x0)

03:35:26 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x4000, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)

03:35:26 executing program 6:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
socketpair$inet6(0xa, 0x6, 0x80000000, &(0x7f0000000240)={<r4=>0xffffffffffffffff})
setsockopt$inet6_udp_encap(r4, 0x11, 0x64, &(0x7f00000006c0)=0x2, 0xfffffffffffffff1)
syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f00000000c0)="c4c379146600006543a02d0000000000000064670f01cab8010000000f01d946d8f1e1b066ba400066edb9f60800000f32f2400f0964460f35", 0x39}], 0x335, 0x0, &(0x7f0000000000), 0x0)
r5 = socket$inet(0x2, 0x4000e, 0x9)
ioctl$sock_inet_udp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000040))
ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000100))
ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f00000001c0)={[{0x0, 0x0, 0x3}]})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f00000002c0)={"b9e8235db007809205b6700c78eeceefaa124f6f6dca92b0d3ff9839d3140de351196d30936a0bcd249f4b8c20f5341e8b23dfc31da6d63aea1c54932a5da66f8ea0df85656be4f5d295d29281c70519455d7030de376afc8db0edf8407831f8dd15e951c8544d14943e4d9ee352eece0c0ac4be545a9359ce7dd13fac15d38e226d477d2d16c45650c311ddd454abfe0c9ae9ac0928932198a2223a5d9b08c3eb0c570f0992406a5e4892406e1f7fceaa4001737535c2d9bab74a6c0706a34294d1fcc2c1c73ba195755810e7ab51a937a8b63eed10ae4332914dc5737634796929f42ed6c85125bb1f510a27a47b2a42eb4ea8cdd61aa9d3f145e9206002e6ac4c8dbc8affd2e2624f2494c04e82329aa515dac138c82aba9cbb058c43c3ec0dac03c577f8db194abdd08143b362f3b3d5658cda6abc87e09b9dda000d883371a2145e6f2bc9658e15a665274d86f612a8ef2c850f3f8a72be44c51bf702fd789e3856c13675b6d83ed8d7b80c13d872722c256a5672857337d73350d05bd78c1fddbb465febbcd4e46b3875592c69da902a368be2baf60fe1cfff3b9aa609a5404346a60ca5fc0c323d203cb395f744657b42ba172705fa745b69a61dd1f86a9881788318004baa552a2cac30da7f250c47b19f6f46e5cdedd946d3623caf5b420ed3a96450faa85cee6596482c9567b9517df0b88d976f1bdd85d9db4746d39a59fd541df18984c4ad9c11c7e35a0f7a615976ea4845f4c88149d94227cb821319f0cbbee61f628a80fcce3405b059207c3e6fe6b98381832f172a1f4b1f64d7dae4e29ac7a972e2c29b800a51dfb238268ab15641f83620fb404eb02140de3506a03405a14441e2cabcb4e9e6ac10c80ea62054e649b57178abebc5f065f2e0a2c08f75249624bfc4f72884efe6fa6ce3fb611c99d5d8297896961bc8ba09b91690a270d88c8ce17350c641b3eb661670227d110932acfa2b7e996dac730c2eb64496082cbc4448133fbb95ebde022f57d6d31672cec97b95d6417fbefced6c8a75c863c697a9dfcbad9b7f60494944ef18fb3c85e89ccb974c009f0b18a1bfc95a103022ebe0015c4ca559aaf187d50dce3317f7ab41cf31b4a3b40a772c0b3d2321b28bdebb4dd969f52bec5e73385107017a0119b1af50f37203ae6fda4e4e5307c00c74a3d28d57bba64a8e0ab27fa7bafc449a9bb8cbe3fc82f0fe2b3ff5b08a8439a3485bb4bc8fd1e3bbe6f410c7d9fc305ce1fce8570077d5f459138d859efc6d300685f2bb5f4eb8a33a576c7d2a4cfc0431c199c505b1b861890fca52272b8227eb7f8f9fe31d12db63f9e69b9fe1fa4b4bd0a78f48c93e2c8a9f6d3258f3c8e27185d1e38aac461ee53953209a088d9ff41b7b6310166d78fddfea9e35bed246b334b40a306de8998d18a21558825ad57878de0748418806"})

03:35:26 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:26 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, 0x10)

03:35:26 executing program 3:
perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

[  390.201885] netlink: 'syz-executor2': attribute type 4 has an invalid length.
03:35:26 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:26 executing program 5:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
msgrcv(0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0)
r0 = accept(0xffffffffffffff9c, &(0x7f0000000000)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x7c)
ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f00000000c0))

03:35:26 executing program 3:
perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:26 executing program 2:
r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000002ac0)={0x7, 0x3, &(0x7f0000001440), &(0x7f0000001480)='syzkaller\x00', 0x3, 0x1000, &(0x7f00000014c0)=""/4096}, 0x48)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x400000, 0x0)
r3 = shmget(0x3, 0x2000, 0x3, &(0x7f0000ffd000/0x2000)=nil)
shmctl$IPC_INFO(r3, 0x3, &(0x7f0000000100)=""/60)
r4 = openat$cgroup_ro(r2, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x0, 0x0)
r5 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x8, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5)

03:35:26 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x3e00000000000000]}, 0x10)

03:35:26 executing program 6:
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2000004, 0x31, 0xffffffffffffffff, 0x0)
pselect6(0x40, &(0x7f0000000000), &(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000040), &(0x7f0000000ff8)={&(0x7f0000000ff8), 0x8})
getrusage(0x1, &(0x7f0000000100))

03:35:26 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:26 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x300000000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:26 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x1000000000000000]}, 0x10)

[  390.544877] binder: 21962:22014 Acquire 1 refcount change on invalid ref 0 ret -22
[  390.618094] binder: 22019:22020 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:27 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xff00000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:27 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:27 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:27 executing program 6:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x773, 0x402)
r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0xffffffff, 0x10000)
r3 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x7, 0xf1b22dce9b2a0f94)
r4 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x1, 0x100)
setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000400)=[@in={0x2, 0x4e21, @loopback}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e21, @remote}], 0x30)
r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cuse\x00', 0x204, 0x0)
r6 = request_key(&(0x7f0000000440)='encrypted\x00', &(0x7f0000000480)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000004c0)='eth1\x00', 0xfffffffffffffffa)
r7 = request_key(&(0x7f0000000500)='encrypted\x00', &(0x7f0000000540)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000580)='GPL\x00', 0xfffffffffffffffb)
keyctl$link(0x8, r6, r7)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7fff)
getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000002c0)={<r8=>0x0, @dev, @remote}, &(0x7f0000000300)=0xc)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xe, 0xe, &(0x7f0000000200)=@raw=[@generic={0x1, 0x8000, 0xdc, 0x20}, @exit, @exit, @map={0x18, 0xf, 0x1, 0x0, r3}, @generic={0x59ac, 0x8000, 0x2, 0x3}, @exit, @map={0x18, 0x8, 0x1, 0x0, r4}], &(0x7f0000000280)='GPL\x00', 0x101, 0x0, 0x0, 0x40f00, 0x1, [], r8}, 0x48)
ioctl$UI_SET_SWBIT(r5, 0x4004556d, 0x2)
r9 = socket(0x10, 0x80003, 0xc)
write(r9, &(0x7f0000000000)="1f0000000202fffffd3b54c007110000f30501000b000600000423ca310000", 0x1f)
setsockopt$inet6_udp_int(r5, 0x11, 0x65, &(0x7f00000001c0)=0x9a, 0x4)
ioctl$sock_kcm_SIOCKCMATTACH(r9, 0x89e0, &(0x7f0000000600)={r0, r3})
ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f00000003c0)={0x4, 0x3})

03:35:27 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2, 0xd}, 0x1c)
setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000000)=@dstopts, 0x8)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r1, 0x4008af23, &(0x7f0000000080)={0x0, 0x9})
sendmmsg(r0, &(0x7f00000002c0), 0x4000000000002c7, 0x0)
pipe2(&(0x7f0000000040)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80000)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000180)={'syz1\x00', {0xfb8b, 0x2, 0xc21}, 0x26, [0x100000001, 0x6, 0x0, 0x0, 0x9, 0x0, 0x100000001, 0x0, 0x200, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x200, 0xffffffff00000001, 0x1ff, 0x4, 0xd9, 0x3, 0x2000000000, 0x40, 0x800, 0x1a, 0x0, 0x400, 0x100000000, 0xd, 0x0, 0x1, 0x7, 0x2, 0x6, 0x9, 0x0, 0x80000001, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x7, 0x127, 0x7fff, 0xfffffffffffffff7, 0x10000, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x39, 0x0, 0x7, 0x4, 0x0, 0xffff, 0x0, 0x1], [0x0, 0x3, 0x0, 0x6, 0x7f, 0x4, 0x0, 0x3, 0xf6, 0x6, 0x0, 0x619, 0x67cb, 0xffffffff, 0x0, 0x80, 0x0, 0x0, 0x0, 0x80000001, 0x69c8, 0x10001, 0x7, 0x0, 0x391b, 0x0, 0x0, 0x100000000, 0x0, 0x46c3, 0x101000, 0x0, 0x800000000000, 0x4, 0x0, 0x0, 0x1ff, 0xbf, 0xfffffffffffffff8, 0x8102, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x1000, 0x9, 0x0, 0x1, 0x0, 0x0, 0x1ff, 0xa779, 0x0, 0x0, 0x4, 0x1, 0x0, 0x200, 0x4, 0xfff, 0x1], [0x6, 0x0, 0x2, 0x0, 0x100000001, 0xd011, 0x0, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0xfff, 0x100, 0x7, 0x6, 0x0, 0x8, 0x401, 0x0, 0x0, 0xfffffffffffff128, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xf39, 0x0, 0x4, 0x2, 0x6, 0x1, 0x0, 0x9800, 0x0, 0xfffffffffffffffc, 0x0, 0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0x0, 0x401, 0x0, 0x0, 0x2, 0x1, 0x7, 0x2, 0x0, 0x20], [0x0, 0x5, 0x7ff, 0x100000000, 0x0, 0xe55e, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x2, 0x5, 0x2, 0x0, 0x9, 0x0, 0x10001, 0x0, 0x1, 0x3, 0x0, 0x0, 0x3, 0x8, 0x8c1, 0x7, 0x0, 0x1, 0x57c00000, 0x20, 0x80, 0x7f, 0x5, 0x6, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x8ea, 0x0, 0x0, 0x0, 0x54e, 0x4b, 0x0, 0x8, 0x6, 0x0, 0x1, 0x0, 0x2, 0x6, 0x0, 0x0, 0x6, 0x0, 0x7]}, 0x45c)
ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000600)=""/197)
socket$inet6(0xa, 0x1000000000002, 0x0)

03:35:27 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x3e000000]}, 0x10)

03:35:27 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:27 executing program 6:
socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
r1 = socket$inet6(0xa, 0x1, 0x0)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000100), &(0x7f0000000140)=0xc)
ioctl(r1, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070")
r2 = socket(0x10, 0x20000000000003, 0x0)
sendmsg$nl_generic(r2, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000340)={0x1c, 0x1a, 0x201, 0x0, 0x0, {}, [@generic="0d7df90bec0b"]}, 0x1c}}, 0x0)
r3 = shmget$private(0x0, 0x1000, 0x54000000, &(0x7f0000ffc000/0x1000)=nil)
shmctl$SHM_INFO(r3, 0xe, &(0x7f0000000180)=""/126)

03:35:27 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfe80]}, 0x10)

03:35:27 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:27 executing program 5:
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000000)={'nat\x00', 0x3, [{}, {}, {}]}, 0x58)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x200, 0x0)
r2 = memfd_create(&(0x7f00000000c0)='nat\x00', 0x1)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000c6b000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000100)="660f56ca3e660fd58ef02f0000f3260f30c4e2f934b1f4298590f30f208566baf80cb82c4c7b86ef66bafc0c66b8d05166ef0fa8b805000000b9f2ffffff0f01c1c4c2d3f7cc66baf80cb88ce26b86ef66bafc0cb84cd30000ef", 0x5a}], 0x1, 0x10, &(0x7f00000001c0), 0x0)
setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000200), 0x4)

03:35:27 executing program 6:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070")
mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x34, 0xffffffffffffffff, 0x0)
ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f0000000280))

03:35:27 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1={0xff, 0x1, [], 0x300}, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:27 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfffffdef]}, 0x10)

[  391.409716] binder: 22019:22068 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:27 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xc5f}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:27 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

[  391.605355] binder: 22083:22084 Acquire 1 refcount change on invalid ref 3167 ret -22
03:35:27 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x4000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:27 executing program 5:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0)
fcntl$getownex(r0, 0x10, &(0x7f00000003c0)={0x0, <r1=>0x0})
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4a58}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000080)='/dev/vga_arbiter\x00', 0x1)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x0, 0x0)
ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0)
ioctl$VT_ACTIVATE(r2, 0x5606, 0x3)
socket(0xa, 0x1, 0x0)
r4 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r4, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070")
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x401, 0x1, 0x3, 0x0, r2}, 0x2c)
getegid()
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80000, 0x0)
r5 = socket$inet6(0xa, 0x3, 0x3a)
setsockopt$inet6_MRT6_ADD_MIF(r5, 0x29, 0xca, &(0x7f0000000000)={0x1, 0x1, 0x3, 0x401, 0xffffffff}, 0xc)
r6 = socket$can_bcm(0x1d, 0x2, 0x2)
connect(r6, &(0x7f0000002000)=@ethernet, 0x10)
ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000002fd8)={'vcan0\x00', <r7=>0x0})
sendmsg$can_bcm(r6, &(0x7f0000000000)={&(0x7f0000004000)={0x1d, r7}, 0x10, &(0x7f0000002ff0)={&(0x7f000000ef80)=ANY=[@ANYBLOB="00000000010000000000000000000000790eaada477f17eb046695eea58af88d0ba3b8f5ca34f33a9a82d81e455bc6ca347989320000e865b85ea1247aafde2b17277187bd8fc023bb972d19343108b0"], 0x1}}, 0x0)
sendmsg$can_bcm(r6, &(0x7f00000002c0)={&(0x7f0000000040), 0x10, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB="02000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000001301000000000000000000000094256139246398aa"], 0x48}}, 0x0)
setsockopt$inet6_int(r5, 0x29, 0xc8, &(0x7f0000000280), 0x4)
setsockopt$inet6_MRT6_ADD_MIF(r5, 0x29, 0xca, &(0x7f0000000540)={0x0, 0x0, 0x2dfd, 0x1, 0x8000000000008000}, 0xc)
setsockopt$inet6_MRT6_ADD_MFC(r5, 0x29, 0xc9, &(0x7f0000000180)={{0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, {0xa, 0x0, 0x0, @remote}}, 0x5c)

03:35:27 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x300}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:27 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xf000000]}, 0x10)

03:35:27 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000480)="0a5cc80700315f85715070")
r1 = socket$inet6(0xa, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local, @rand_addr}, 0xc)
openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x1, 0x0)
getsockopt$inet_mtu(r3, 0x0, 0x29, &(0x7f0000000040), &(0x7f0000000000)=0x4)
ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @local}, 0x0, {0x2, 0x0, @remote}, "7465616d5f736c6176655f31e0ffffff"})
close(r3)
dup3(r1, r2, 0x0)

03:35:27 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:27 executing program 2:
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x7, 0x32, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x0)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x400000000030})
r1 = socket(0x10, 0xf, 0x26f)
connect$vsock_dgram(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711}, 0x10)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x2})
r2 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4)
getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0xc)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2, 0x32, 0xffffffffffffffff, 0x0)
close(r0)

03:35:28 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x9)

03:35:28 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x10, 0x6000000, 0x0, 0x0, 0xffffffffffffffff, 0x40}, 0x2c)

03:35:28 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xd0]}, 0x10)

03:35:28 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:28 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x9)

03:35:28 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x7, &(0x7f00000005c0)="0a5cc80700315f85714070")
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000004fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = socket(0xa, 0x1, 0x0)
getsockopt$inet6_int(r2, 0x6, 0x21, &(0x7f0000000040), &(0x7f0000013000)=0x221)
mmap(&(0x7f0000000000/0xfe3000)=nil, 0xfe3000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
close(r1)

03:35:28 executing program 5:
bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x102d}, 0x2c)

03:35:28 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x300}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:28 executing program 6:
r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [<r1=>0x0]}, &(0x7f000095dffc)=0x8)
r2 = socket(0xa, 0x1, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x742, 0x20200)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x7b, &(0x7f0000000040)={<r3=>r1}, &(0x7f0000000100)=0x8)
close(r2)
getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x7a, &(0x7f00000000c0)={r3}, &(0x7f00000001c0)=0x10)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(0xffffffffffffffff, 0xc05c5340, &(0x7f0000000200)={0x0, 0x0, 0x100000001, {0x77359400}})
sendmmsg$inet_sctp(r2, &(0x7f0000000bc0)=[{&(0x7f0000000180)=@in={0x2, 0x0, @rand_addr}, 0x10, &(0x7f0000000140), 0x300, &(0x7f0000000080)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0x4}}], 0x30}], 0x1, 0x0)

[  392.399073] binder: 22083:22142 Acquire 1 refcount change on invalid ref 3167 ret -22
[  392.447297] binder: 22146:22147 Acquire 1 refcount change on invalid ref 768 ret -22
03:35:28 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfcff, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:28 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:28 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xd000]}, 0x10)

03:35:28 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x9)

03:35:28 executing program 5:
mkdir(&(0x7f0000000000)='./control\x00', 0x0)
mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f00000000c0)='./control\x00', 0x0, 0x0)
ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x8001, 0x9, 0x652d, 0x40, 0x7ff, 0xfffffffffffffffd})
mkdirat(r0, &(0x7f0000000100)='./control\x00', 0x0)
getdents64(r0, &(0x7f0000fc4fbe)=""/80, 0x50)

03:35:28 executing program 2:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="c744240000000000c74424024f000000c7442406000000000f011c24c4427d180508000000c4c245ae08c4e2850108b9800000c00f3235004000000f30d3559e67470f224205c814000066b89d000f00d0c423a95f2518410000e1", 0x5b}], 0x1, 0x0, &(0x7f0000000040), 0x0)
ioctl$KVM_RUN(r4, 0xae80, 0x0)
ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0))
ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x9)
ioctl$KVM_SET_DEBUGREGS(r4, 0x4080aea2, &(0x7f0000000040)={[0x6, 0x0, 0x2000, 0xd000], 0x3878, 0x80, 0x7})
ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000180)={0x3000, &(0x7f0000000000), 0x9, r2, 0x6})
ioctl$KVM_RUN(r4, 0xae80, 0x0)

03:35:28 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:28 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000))

03:35:28 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfffffffe]}, 0x10)

03:35:28 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0)
writev(r0, &(0x7f0000000000), 0x0)
creat(&(0x7f0000000040)='./file0\x00', 0x0)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f0000000000)={0xbb, @multicast1, 0x4e24, 0x1, 'nq\x00', 0x1, 0xddd, 0x6a}, 0x2c)

[  392.954890] kvm: emulating exchange as write
03:35:29 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:29 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000))

03:35:29 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}, 0x10)

[  393.058199] IPVS: set_ctl: invalid protocol: 187 224.0.0.1:20004
[  393.083725] IPVS: set_ctl: invalid protocol: 187 224.0.0.1:20004
03:35:29 executing program 2:
r0 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendmsg(r0, &(0x7f00000006c0)={&(0x7f0000000200)=@ethernet={0x1}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)="3941d5c9374a2ca43cb5d7df11135bc45689bb", 0x13}, {&(0x7f00000002c0)="14518636340239dff7d4ed1b1863682dfe39a2a6b2e5458f24f8bfba4b0ff90243ccb4c1e9d85e41c270896b18db0ca25887dfc2cd74fd07434f6fd0b950218432737c13e8ce4266ab8fd5924f4ebaf60705f898f5129da990041e1565fcf34d7457cb6499f20c003dea439755e234d1c96b47f9bc3f5bbe196ca64f0e71288e140b814b631db0cc41fc4429f48d2c54d35490ff", 0x94}, {&(0x7f0000000440)="dcc98c159a76311f70a728a6e71e6fd085d290429e67de5a284980946ec53b5721ffce4c8944e8b2fcc2decd1cd1db25a0856a618cda5a24c8075120b83c2c5597c85703caf53ac04f850be1266122b57b82ccb98bf846955d9f99858274914fc5a2f9cb569b7d2976600cdc82e56a88dbf148b86e050cc8bb3e7512418cac983a0641f38adc282e885027d6f5e2a6dee58dd9bfc07f5081c31d4cbcde45fa77296bb164486de75246cbe1496e272a02faeb5d963e78e28a12c9598dc4ffe09a809f3e", 0xc3}, {&(0x7f0000000540)="9627aab4524801ab46bbd57df13513c5347ab994343acb71558c3eedde3598ee2effc94d2102c49d4e5aa5bd2e3b7dc7418125ef7ef35fcfeac6fdef624fd33822578abfd4aba7ef47fb74dcbd17eaa3db9c28bbb8ee1ee2aa0575fd18ab03b511cf8b0be1888795c9988bde669cf4aaff1ca9a03bf9697f39faaa1a358192974aad7699c8a06ab8a323bd9f009ba672888c6c8af346e81ef53d712bcd8db68d8a24c428b13551840089479d74bb115935d7c22ee052d6e9b2f1bd8775c9e6cbca8ecc9f447b47d64c4fa644d2a97f5d4265587a12cec37d5fbe5a78eb7cf62abcd11e5c474c507e7c9e6e225864c59e8943b18991f786", 0xf7}, {&(0x7f0000000380)="ff0a140d4721edc8342f1f261ae0c4f8011a7977742bee10f98fd8b28ceaa85e2c0165a1", 0x24}], 0x5}, 0x40000)
listen(r0, 0x0)
r1 = creat(&(0x7f0000000100)='./file0\x00', 0x21)
ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000140)={&(0x7f0000ffa000/0x4000)=nil, 0x4000})
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r3 = accept4(r0, 0x0, &(0x7f0000000080), 0x0)
clock_gettime(0x1, &(0x7f0000000280))
recvmmsg(r3, &(0x7f0000004d40)=[{{&(0x7f00000003c0)=@rc, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000000580)}}], 0x1, 0x2, &(0x7f0000004ec0))
write$P9_RREMOVE(0xffffffffffffffff, &(0x7f00000001c0)={0x7, 0x7b, 0x2}, 0x7)
r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x840, 0x0)
perf_event_open$cgroup(&(0x7f0000000000)={0x7, 0x70, 0x6, 0x98af, 0x4, 0x2420, 0x0, 0x7b, 0x422, 0x9, 0x9b3, 0x7, 0x5, 0x0, 0x3, 0x3, 0x0, 0x0, 0xfffffffffffffff7, 0x100000001, 0x4, 0x80000000, 0x7f, 0x7, 0x2, 0x1, 0xc2, 0x6a80, 0x7fffffff, 0x35296f5f, 0x600000000000, 0x7, 0x80000001, 0xe1, 0x9, 0x8001, 0x4, 0xff, 0x0, 0x9, 0x6, @perf_config_ext={0xc8b, 0xe885}, 0x20414, 0x1, 0x6, 0x0, 0x101, 0x100000001, 0x9}, r4, 0x10, r3, 0x9)

[  393.245583] binder: 22146:22199 Acquire 1 refcount change on invalid ref 768 ret -22
03:35:29 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x60}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:29 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  393.373438] binder: 22208:22209 Acquire 1 refcount change on invalid ref 96 ret -22
03:35:29 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xeffdffff00000000]}, 0x10)

03:35:29 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@remote}, 0x0, @in=@multicast2}}, 0xe4)
r1 = socket$key(0xf, 0x3, 0x2)
setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0xb9)
sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=ANY=[@ANYBLOB="02120100020000000000000000000000"], 0x10}}, 0x0)
close(r0)

03:35:29 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000))

03:35:29 executing program 6:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x5)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000040)={0x2, 0x0, [0x40000002]})

03:35:29 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x6, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:29 executing program 2:
r0 = socket$unix(0x1, 0x20000000000008, 0x0)
r1 = dup2(r0, r0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001540)={{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000300)=0xe8)
r3 = getegid()
mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000002c0)='fuse\x00', 0x20, &(0x7f0000001640)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xe000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x5}}, {@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x8}}, {@allow_other='allow_other'}, {@max_read={'max_read'}}, {@blksize={'blksize', 0x3d, 0xc00}}, {@allow_other='allow_other'}]}})
bind$unix(r0, &(0x7f0000000240)=@abs={0x1, 0x0, 0x4e21}, 0x6e)
sendmsg$unix(r0, &(0x7f0000000380)={&(0x7f0000000180)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f00000014c0)=[{&(0x7f0000000100)="09f44af8d24243b8704438b5477bb4e357aa775b32c5bb8bd8dacb6d1c3069776700872c15361ca4a8fc13b2982d078e0cb73dbe879b00205ac6c344bb0f2b1d6be54c0da846a317bf58aa466bc0455501e7d4840cae6ea7c4d87db02a12e38384abd4e0c5c68cb2b463bb23237a1ffe70da3eb8cddbc1", 0x77}, {&(0x7f00000003c0)="f2d755c026ee56d4f065338302a2e66e9bd574749803b4de85f4f524a0143adc44a407ef70512ebef6cdcfc410cc63101c24ba601bb2b912956d7a6cf0acdafb5cc6b5", 0x95}, {&(0x7f0000000440)="91ef6e94395b6d70903c21bb6bfe08173f82dfff8881cd4f3c118e3e61a9731d9207910893df3487d257563214972beb5951d74def1709b26ebd430a97bd23300ba46b03afb66f535239a8a26ee9ba8d322564c9c985eafab9d789528087697ac26bc4b1fb800f0fb98af1abd3f21d9ad342255f9aea1edbf7c62286759983c5dd5fc22b1516667be0470cc62f6ae7131698ae76140b7765ec44bd9e17b911b9cd64b501d17cd80d03c3dbefbec53dedf6f02d9530db6db04b3710e3606b4471eb880f7d762da8a26ff3c7c4846e9f6e9c881f745a1dd7a7c042e70a4248fc00048da8246e13ea62123f0769fa329213347ae0f44851d04e5769d8cb2d7eef37dde09a646b572d5dae3450c443927fb5c53034eadb0fa8bd16d50eca3ac9416d6fb995aec206e08ca9b5fd0a358c66453cef4fde58125bd2f5f5b0bbf7b2206f9ce2e2cfd4753b08bc82ca8a2c8485585f2aca85e373ae716dcbb11dce5df9b31c0ad7f1b471e317fb1f7973474e98acee7e43c5a088db3cfa3a3a4069d7f928a640e8cd412155e132a4c7a131c21a15688781b49b88ce1f8544e2feea95f35825975f891a54efd1fe09b17ed417c2e9484494c4bb54f7751f79fedede59cf31f153c57a65b12d77a4962fe326a423b4b6233e56f92b11ff4ce64ff98940fa784868f53ba5c4953ea8486efd405feda5fd1740425276a2b02556fa1795189d775f422326985f1128f99ed5991182bfd70c61ed49d3131c05eff126271903b86d0c9920991d5f114aa48570e43eae6144224e3f89a3e7a7f5c786f9a21225fcb874fbe51cad1d2227360511d47557ced329ae7750494066e8e3b8df913f547d1647cebe04e151e43fad8e861d1cd6753936fc0a607281c020298a5dda1dbb6b2ab48086d7a4d40fad93516c4fd795c352797e8ed7e44ad4c49e76af5e5e55f226b9d38a306a0adb20592ee651e7a522267d8960280f054fa9a8885c32053d9284550cf59045ca64b1ff1124d2d1fcf4a37416b26064838d243dc71da47daa690114784f536d5fa6f24659ad7e6471541010f6de0a471d2a818265e686b65218bb09b21911be2a83a6740146b9ddd20594688dd8540206105d5f0a81350455f4ab5f1cdf63777bb58bf8b6b5ab96b97155f62b0d7bb7f506d28d8b90b32c3baf65d1ca72ae9d8d49b935cff0f4d4a539313254f02e6e7d6c79910ed13f53648fabb3c413e3a7769d141d337c2223be0a43477bb89a138a0efb14bc59c0e65d43e4f2cbaacd67530e6ad5269593668300a819035edfe900a704a2440c6302f8045f355b4d624d205390466900dce3e3ad525084596ea4197c49ec0b4bb4aee1593f31557a159af31c4bc821fba3809eea800398d1961821075eeb3a518ea9ca249be35ce3f381ba65c0c905684f6798bfd188952debdb3c7f2c362857981357ca79a87080f95f37ee288b34e4bb9e793b61ff9e77d566b59fa31f72df2513ac04f6e72e083d052f7db4f38eeea8d9280aaacf9d73d88e887a027247af3fec9031b9bdec67b3404d34ae1afc88d01219e0ad7d120cc4243f3e6f1030e7850c711c9974567b888d80a6651866a8e2c1133b9b0ca00de6f6c37c8c05445b9625dc2c16dc6715d6f925d4b38085a0976f47a1653332554db40e49d5f0cfc8a7b8633b74a4ff200cfc0b27dd0ab41981bbd0cb2d0eadac97a2b308374825fa403061faf5210f883bbf885929d87328678b231a8f3b3bb6ed975a1345d526fc195eecc89e01896f766b27ce9bb0578929236c1d9e197134c83e557f03367864c6a459be79a513c697f6b65dd85a1d793f3d367e480209998fffaee197b0e867eaf830fe906ef52ebda0ca669fb44444b1210750780d9a8e6cc19354bb7c10336b5243291e231ff0e038357ac05b20c614b141a142b09cf6aed06acfb71400823f232bd5e95f9723caefa8e5b27056e9c458120585264caa7d8f9ddd06709a9cac38b6be9bb8ec048462ac4f7442bbeff25097312341eae3cdcc00f7623e1138ccd31ead732fa5e0f2dbfec87ea5e1c49c4cf1956dc9942d8e8a6885b9ecdcf36ce64a7c7ff12290540d3fc7266bc5481eff3aa44171d9a99cc5ce846de631340ec4cf080d5ae6081e40a5c5e96c6bba639c5f95e2a25f695876122b71dfbcbb8c2227cc52fa66d481e891e6c56d375447aa52ac0ffeff816ab1720049e3a5d228209775af9d7d1e33821bf9aab9ac8be788e3b10128408b46dea72952d906d2ee7b46a234d5f08d102726531dc0e45f9a031115b2b4500acb1db761b0e9b3b8d96c7cba49b2309555e6be925aecf8bb20b85e8cd487d76d897f8f4b0525507bfc715d09edb32e89b0ad0c52d1955e4276d442608e382bc5920cddaec2bcf2fbdc828150ef0fa89d241a00ae115ec7e24be6b3cb2b853c6a05311a6ed8ae8c66d10e698a09c4441dbb0e31ce9d2094beb57f22e68920fe0987188acccd6ac65b6efa2b5081a986b0a3c19a8105f386c9a35666353b3faf34bd2c8a7bb5b9341272c6d7d439e2c26c65639ef03625f83e775ded55dbffa6fd7634f1c92feb677784a8a447cd1f863a40f30a9cd8bc0c0d5d4b3a26b1eb546ab58d9661cfd0b5c5ead45181b28b97b6f76ead42d9aa6330f65b98e4bca609b9cc66a72a899524ab04f4c28abac67be800827a8fbbce62f2f610eac4bd524bc09404c756434253e3b451b6effacab6940d54e62e00496a019d04c1d51687429b4b4301c8cee1c8c994b9fe6184ad290cfdc7869e09e38207ad1d23c4018b05576e8ee9b8c312e0060576bb9d2bc3a9065aad17ccde2e9850bfe314efb1556ec1ac59eb373e38bc41f76b3dbe9f7524826b3368fe0f895ab9ab052c4e926b8d537ca3b8fcbf162c539cc204da65e120a210bcf40820967dd15f645c459dce1050f6cee957dc12196425c1d96d47fe90fa0bb6fc1834f4348576bf4de6b8a7c923000f77788209f01ad22c54478198f472ab5a527fce3b8a18614a69342412f4f02c099a1e219665f0521e28ebde227a8aa25e4c6c97c0ea6c5657a0d189ba47e5997282c37360a08b128d8599613b717e42b0fe710fefce3b6b9702b7183a56fd73b47d3808061c587de4a7f6ab071552c372961f88b34162cda6ceb116d4b8f429b4283787bd9b5c7329d86d7632215b3d2c2143a4bcce01be6303902503303386e9f91cf12faa95c21ced02a3e0df1e6fb9acbccc9c7a321639ccccf6ca3ab68f48e12bba0185363b2d561b5d3b09b16d7d51c95b87f87739508e2f5fa14c25d32a2acdb7acfd4ee0c9ef6609e1eccb5f279c877771d1cee348a8628d460717129582c982fb50a280a210ce8f3f586ce49a907c6b08d394713861908631ccb19e35d60839034dfddf391ea316e67e5a54caf9d0441ad4dc4d3f7304ea8520f1bf93277c58ff386e15fb9e6ef10ff588d8a30f5a807f6efdd74db43784b5a5260cd812ce42c5b5b90fbd19b543aff14d6b20f756e26b3612b415c8639cb4c1e1b86a9c20b5ad5f46578f31897791bcb877a344e305eaaf926c5ded95c0c2f2b66004836586f79f82527553fe5bdb983d876d18f9665b30489983f20489e57b2b6271817a9e94650fec149a507a1fd7387e16e6eb0e3d0932545ff157a76392773f573515db3b8dfdeef5edbaf209a7a6d3ebf609fb4ffdbd32f5b9a1bc78a399254b5edabf34b2c83a210647d8b2c9734a7b949153dcb4fca7acf1a23a1c92d40f9d975092985b6f577513c671a6d4dd6e933ef69fb6d5ad623c7fbb72263675283d22d6e25e7ffa9e26adbb027a802ca7bbab5b718c85ae2e62e15716ba33f5974f1b9164719a402a2b9436cf792751815f58e109cdde170379f13dc837a01d57053f19ec485b8930dd00a786163f633f05d734e19f19b59df761ba44be76562bf967b844a575c220f2f74ed1314035675e76925455320b1a542d6b39b1d80bf204a5200082b4ad2c41799d0c9e373f9df8900a2de0f733b5bbc6b125321400eda64d6ea8aa997c5b2dcc6889c9bfcfa4619bd9d1a93c4c61f28613bd233c2e8fcc07e838a6e4bfd920f75c819b961252d1072b763967c80106eefc12136858bb2ca64f93d813ef29fdc84fdd44ce00526166f2d78a0f95c0e5a57267bdcca7079860f5a29d05b57752a2899d5ef2969dc4c49947b32d624247893a010a9192c22a842e56c12e05503e3171966e26179028cc879a37050b798cbb1b689c2ac687576891e457cbbe50221c08234792f4e850d58433c125a9c8a4e1eb2da707fef6668230341a0e2fb03c6652ca39474ff93a54e738b2a34c0fd52a7c0477584d0e7a2db8580a0e42c8330a701b2aff442ce95b888c379469c3f5a51652cd80f0a93a1946b88c274ec3e6453e42e1ea8ba4318a5358583c06da48c38d2a7b8020d428c621d1702c8fc1b4f0e1ef5660c39ba7c66d4468ee7e43cc248141fdc6f883d44ba6c0dc4853dd9c57681ce94be66ea218b48c9c0a684f1b5470b270bc0d578776422e6588fe8baea0987c0f639f93fea15c449f5a37ab30f35e0141f717e1fc9f83cef97c6784488f61ecca7ddc0e56bcd70a0abed6b242e16c8e294335b427785e1ff5a75c818c522dc23c79985ac54e0748b9052efad0de8f2e5abcba310b26b8e2b3bbc4cf765fe465add3afb9a2c1f3bcb9c83c9192947d0cfd2ede9f15ccb959d2f3cd78a30bfaf52cc8daad665b3686362112bbba71d2a8bb4856496c0348d0e8c0c446c49d2c2d9130bff6816efbe5d242c54624a089fdb83716850ceacef9ce1a5cf8d19794be6ab1e87e4aba1b76047c46e3ee202a93c76253c841c8c7f0f9161bbfbd6a311f793c64f114df7987b710fe0fa34d7c9a31ea388dbc11c15e261966951b83de3a723f606ff26047ec6bb1e9f011c15ebbb83ef36c9ae6d903285f3458a28d75fa98544ae9e92716bd35c27e6e7245a17455223909b4a550af1efae7d37b91bfb05c2995961b1a50e92f8b674226ffbaea8ee48131babaf1a54d6f7c809c597ced21f05a7ff5a46e6c0f15fe0b58b060eef74095d93ed018b5ebbf197bc3032aec3215bf076b9c66f05ede6c5a33bf749620f24f3215f8408d51f47135d8c295193aaf31a71ff0370af691896828afcad3348f272678b1a215f401f301ad776ac244083151daf322819c1a2931234e9c0b17b8bf62ac0213258546457aee5f3b55930c8e3c24c954fe8462d91165d3bdfea06ae69e0b5a9706ae06d3e454e28f5e85bc8f6a170f69199b2cf3ae58a9ad5aba921388351432b818fa739ee1f3b0b41b7bd99b32082b42f2a7a2007d24ce73c191d81f358fe7f30589a01ac6db628bbf3c90db216832edba86490328ec442f6c6a811d0c5e48b5712e1615e2be7bca4e2e777fd317fe90ff851aad74fb5abde539d1561e797367e8779a469ab99d2a6bd44eec9615db2373c2715b5c2f92542f68cae680c9bc5b98bb60f8ad6082b110b94d15801d41f9937fee421367f1f0d6f5e13ccdd8d3eac6ba60ffc80d1577a7e449cae86b6e5cde319285952a8368f123a7461d934cf5746a93cd3d1d43c8d3f16526bee28849469802ffecc008f79de955fb406d9a3cbf49a99eae91004e2f5f60670d06406949734cf884dedf48969b429b55e6093833f825c546ec67180ba2115e43508b36345fdd61be0c8778166f441a63f9f824590d665f6bae4448af2583ecfeaf179f030398436842759376f8ca4dece2c65806201b65860626b66ecdd9747e544ab3675a1e27d640793308419a1266ad1a27f033ddbd3aeaf5f3", 0x1000}, {&(0x7f0000000080)="22ba7d3436a82a66e50d8c3c2ef34ca5dd0291e6c5f91d4095edec1be0ee7ec5fee5006995ca49756535de5685d819b01b356a3c75f9cba597684b119591", 0x3e}, {&(0x7f0000000200)="cf71c28e6910ff8b", 0x8}], 0x5, 0x0, 0xf0}, 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x4800)
ioctl$PERF_EVENT_IOC_ID(r4, 0x80082407, &(0x7f0000000040))

03:35:29 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:29 executing program 2:
r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
syz_init_net_socket$llc(0x1a, 0x1, 0x0)
setsockopt$llc_int(r0, 0x10c, 0x4, &(0x7f0000000100)=0xf922, 0x4)

03:35:29 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000000)="025cc80700145f8f764070")
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={<r1=>0x0}, &(0x7f0000000080)=0xc)
ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000180)={{0x2, 0x7, 0x7fffffff, 0x6, 'syz1\x00', 0x7}, 0x0, 0x2, 0x4, r1, 0x5, 0x90e, 'syz1\x00', &(0x7f0000000140)=['\x00', 'posix_acl_access\x00', '(user\x00', '!{trusted', '%\x00'], 0x23, [], [0xbc, 0x9, 0x2, 0x2]})
r2 = socket$inet(0x10, 0x3, 0x88)
bind(r2, &(0x7f00000000c0)=@nl=@kern={0x10, 0x0, 0x0, 0x400040}, 0x80)
r3 = socket$inet(0x10, 0x3, 0xc)
write$binfmt_elf32(r2, &(0x7f00000002c0)={{0x7f, 0x45, 0x4c, 0x46, 0xfffffffffffffff9, 0x57ed, 0x4fc, 0xffffffff, 0x0, 0x2, 0x3f, 0xbf58, 0x1d, 0x38, 0x260, 0x533, 0x1, 0x20, 0x2, 0x10000, 0xffffffffffffffff, 0x9}, [{0x4, 0x7, 0x4, 0x5, 0x2, 0x7, 0xe96, 0x5}, {0x7982049c19376ba3, 0x258000000, 0x278, 0x3, 0x3, 0x9, 0x0, 0x3}], "61803c64e0516391c181a335a772a6e27e7907ac3b98fb785c54593d7ddca95465303a1254884feb1705d7fdf9609926f324cefe8bdf7b5f838e69be3ccafd4de4b0b581696db9a043a53bc67bd240d379dbbd4969ccb153d87102b424efe6ceef8d47ce29e4026319e022d872d816e9a873edc739ebc664316cc975719e42f913ab5f3de72890d0bc839882c7eaceec795b6891529f0f0f7268e47373b1cfbad96ca96768c60bfed03c5d0c25be42f503a109917545f97673d2410278f81e5b8a4fa3a6a1d3c9d5c051b50d50029587ce0342ed64e2b82ac67f1e68bc9dce108c56ebe3c6d4cfbc6e1482e9b157aeef", [[], [], [], [], [], []]}, 0x768)
getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000b80)={<r4=>0x0, 0xffff}, &(0x7f0000000bc0)=0x8)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000000c00)={r4, @in6={{0xa, 0x4e24, 0xf25b, @mcast1, 0x5}}, 0x1f, 0x800000000000, 0x7b83, 0x1, 0x4}, &(0x7f0000000cc0)=0x98)
r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000ac0)='/proc/self/net/pfkey\x00', 0x220040, 0x0)
write$binfmt_aout(r2, &(0x7f0000000d00)=ANY=[@ANYBLOB="cc00030177030000a0010000200000002a010000ffffffff00000000000000001e81e3ad63690d4300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e8ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x628)
fcntl$setpipe(r2, 0x407, 0x7f)
mount$9p_fd(0x0, &(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80)='9p\x00', 0x40040, &(0x7f0000000b00)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@uname={'uname', 0x3d, '(user\x00'}}]}})
write$binfmt_script(r3, &(0x7f0000000000)=ANY=[], 0xfffffe0c)
ioctl$TIOCCONS(r5, 0x541d)
sendmsg(r3, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000002000)="24000000100007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b356da5a80d18bec4c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0)

03:35:29 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:29 executing program 6:
r0 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x10000, 0x1a5000)
r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x3, 0x40000)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000240)={'ipddp0\x00', <r2=>0x0})
ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000280)={@remote, @loopback, @local, 0x6, 0x5, 0x6, 0x500, 0x1, 0x20004, r2})
r3 = syz_open_dev$rtc(&(0x7f0000000300)='/dev/rtc#\x00', 0x40, 0x20001)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000340)=0x7)
ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f0000000380))
ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000540)={0x3, r1})
ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000580))
r4 = syz_open_dev$audion(&(0x7f00000005c0)='/dev/audio#\x00', 0x7, 0x200)
socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$RTC_EPOCH_SET(r4, 0x4008700e, 0x0)
r5 = getpgrp(0x0)
fcntl$setownex(r3, 0xf, &(0x7f0000000600)={0x1, r5})
epoll_pwait(r1, &(0x7f0000000640)=[{}, {}, {}, {}], 0x4, 0x1, &(0x7f0000000680)={0x5}, 0x8)
ioctl$KDADDIO(r4, 0x4b34, 0x100000000)
io_setup(0x401, &(0x7f00000006c0)=<r6=>0x0)
io_cancel(r6, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x6, 0x800, r0, &(0x7f0000000700)="3408fefb9bce0f3d03072ea56607fa27a574f04e941ec20479a2b52a5c9c29b00dc5a4b48996362bc07807093b0a3a8c4f740c100526f869b22755f5c1ddd28d4363b439a06eb8a3a7b67df0aad42c27357c9051337df9e57e7c103e951fc2dc5cebc1e6616712f378d9f5510facd98500405f24c8e92baa2bee713842df932a6faf5432da2b671b3e", 0x89, 0x7, 0x0, 0x1, r1}, &(0x7f0000000800))
ioctl$SNDRV_CTL_IOCTL_TLV_READ(r4, 0xc008551a, &(0x7f0000000840)={0xb7, 0x1c, [0x8, 0x6, 0x3, 0x200, 0x4, 0x6, 0x8000]})
r7 = shmget(0x3, 0x4000, 0x4, &(0x7f0000ffc000/0x4000)=nil)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000880)={0x0, <r8=>0x0}, &(0x7f00000008c0)=0xc)
lstat(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0})
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000009c0)={0x0, <r10=>0x0}, &(0x7f0000000a00)=0xc)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000a40)={0x0, 0x0, <r11=>0x0}, &(0x7f0000000a80)=0xc)
shmctl$IPC_SET(r7, 0x1, &(0x7f0000000ac0)={{0x4, r8, r9, r10, r11, 0x5, 0x10000}, 0x2, 0x1f, 0xc0, 0xeadf, r5, r5, 0x10000})
ioctl(r4, 0x80, &(0x7f0000000b40)="ec9a0f098026d50fa86d32c366e6f7f88d447e8e6e185b3cecc78d4d2a24")
exit_group(0x2)
ioctl$FIBMAP(r4, 0x1, &(0x7f0000000b80)=0x101)
r12 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x80810, r1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000dc0)={0x4c, 0x0, &(0x7f0000000c80)=[@transaction={0x40406300, {0x4, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x40, 0x20, &(0x7f0000000c00)=[@ptr={0x70742a85, 0x1, &(0x7f0000000bc0), 0x1, 0x3, 0x29}, @flat={0x77622a85, 0xb, r12, 0x1}], &(0x7f0000000c40)=[0x0, 0x78, 0x0, 0x38]}}, @exit_looper, @exit_looper], 0xac, 0x0, &(0x7f0000000d00)="45d77a63a7fe1e6dd7321fdf5c6f5d0c651e0e58f2b19714e9f59cb4d7445db0a7140c3a5d341eb49a8f551b369bbd657ec2180b6e87bd3628fe5cfcfcdd3040fd8c35fadb9003aa0fe1f014b1bfaa837238587bf7671a708d2eb805f69678536677791701593b2a7ba2867ddb4ddd59bf518a1737c37f6c12c0978563d11c0ec58bb4cf00eebb5f9c6a8528ea612308b421f641f149e56fb5bad19431ae5f325cdfef5794ae6e1a8b30ede7"})

03:35:29 executing program 3 (fault-call:2 fault-nth:0):
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:29 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x10)

[  393.989381] FAULT_INJECTION: forcing a failure.
[  393.989381] name failslab, interval 1, probability 0, space 0, times 0
[  394.000759] CPU: 0 PID: 22243 Comm: syz-executor3 Not tainted 4.18.0+ #195
[  394.007789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  394.017180] Call Trace:
[  394.019808]  dump_stack+0x1c9/0x2b4
[  394.023534]  ? dump_stack_print_info.cold.2+0x52/0x52
[  394.028874]  should_fail.cold.4+0xa/0x11
[  394.032972]  ? fault_create_debugfs_attr+0x1f0/0x1f0
03:35:29 executing program 2:
r0 = socket$vsock_dgram(0x28, 0x2, 0x0)
getsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000100), &(0x7f0000000140)=0x4)
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070")
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000180)={<r2=>0x0, @in={{0x2, 0x4e24, @multicast1}}}, &(0x7f0000000240)=0x84)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000280)={r2, @in6={{0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, [], 0x11}, 0x7}}, [0x5, 0x8, 0x8, 0x101, 0xd8, 0x6, 0x7, 0x100, 0xfffffffffffffffc, 0x80000000, 0x6, 0x3f, 0xfffffffffffffffb, 0x400, 0x8fe]}, &(0x7f0000000380)=0x100)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x50, &(0x7f0000000040)={'T!ROXY\x00'}, &(0x7f00000000c0)=0x1e)

[  394.038116]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  394.043702]  ? perf_tp_event+0x91b/0xc40
[  394.047815]  ? perf_swevent_event+0x2e0/0x2e0
[  394.052362]  ? find_held_lock+0x36/0x1c0
[  394.056511]  ? check_same_owner+0x340/0x340
[  394.060879]  ? rcu_note_context_switch+0x730/0x730
[  394.065852]  __should_failslab+0x124/0x180
[  394.070121]  should_failslab+0x9/0x14
[  394.073976]  kmem_cache_alloc_trace+0x2cb/0x780
[  394.078701]  __request_module+0x41a/0xf17
[  394.082896]  ? perf_tp_event+0xc40/0xc40
[  394.087017]  ? free_modprobe_argv+0xa0/0xa0
[  394.091373]  ? memset+0x31/0x40
[  394.094698]  ? perf_trace_lock_acquire+0x4f9/0x9a0
[  394.099692]  ? perf_trace_run_bpf_submit+0x269/0x3b0
[  394.104852]  ? perf_trace_lock_acquire+0x4f9/0x9a0
[  394.109812]  ? perf_tp_event+0xc40/0xc40
[  394.113905]  ? graph_lock+0x170/0x170
[  394.117746]  ? memset+0x31/0x40
[  394.121084]  ? find_held_lock+0x36/0x1c0
[  394.125278]  ? kasan_check_read+0x11/0x20
[  394.129482]  ? do_raw_spin_unlock+0xa7/0x2f0
[  394.133940]  ? _raw_spin_unlock_irqrestore+0x74/0xc0
[  394.139083]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  394.144203]  tty_ldisc_get.part.3+0x50/0x120
[  394.148643]  tty_set_ldisc+0x5c/0x6a0
[  394.152492]  tty_ioctl+0x3ad/0x1870
[  394.156168]  ? tty_vhangup+0x30/0x30
[  394.159907]  ? rcu_cleanup_dead_rnp+0x200/0x200
[  394.164639]  ? __fget+0x4d5/0x740
[  394.168129]  ? ksys_dup3+0x690/0x690
[  394.171889]  ? find_held_lock+0x36/0x1c0
[  394.175996]  ? kasan_check_write+0x14/0x20
[  394.180263]  ? __mutex_unlock_slowpath+0x197/0x8c0
[  394.185228]  ? tty_vhangup+0x30/0x30
[  394.188970]  do_vfs_ioctl+0x1de/0x1720
[  394.192883]  ? __lock_is_held+0xb5/0x140
[  394.197005]  ? ioctl_preallocate+0x300/0x300
[  394.201438]  ? __fget_light+0x2f7/0x440
[  394.205441]  ? fget_raw+0x20/0x20
[  394.208933]  ? __sb_end_write+0xac/0xe0
[  394.213452]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  394.219041]  ? fput+0x130/0x1a0
[  394.222352]  ? ksys_write+0x1ae/0x260
[  394.226201]  ? security_file_ioctl+0x94/0xc0
[  394.230637]  ksys_ioctl+0xa9/0xd0
[  394.234123]  __x64_sys_ioctl+0x73/0xb0
[  394.238066]  do_syscall_64+0x1b9/0x820
[  394.242007]  ? finish_task_switch+0x1d3/0x870
[  394.246531]  ? syscall_return_slowpath+0x5e0/0x5e0
[  394.251488]  ? syscall_return_slowpath+0x31d/0x5e0
[  394.256446]  ? __switch_to_asm+0x34/0x70
[  394.260550]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  394.265950]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  394.270834]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  394.276043] RIP: 0033:0x457089
03:35:30 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x6000000000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:30 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000000)="025cc80700145f8f764070")
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={<r1=>0x0}, &(0x7f0000000080)=0xc)
ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000180)={{0x2, 0x7, 0x7fffffff, 0x6, 'syz1\x00', 0x7}, 0x0, 0x2, 0x4, r1, 0x5, 0x90e, 'syz1\x00', &(0x7f0000000140)=['\x00', 'posix_acl_access\x00', '(user\x00', '!{trusted', '%\x00'], 0x23, [], [0xbc, 0x9, 0x2, 0x2]})
r2 = socket$inet(0x10, 0x3, 0x88)
bind(r2, &(0x7f00000000c0)=@nl=@kern={0x10, 0x0, 0x0, 0x400040}, 0x80)
r3 = socket$inet(0x10, 0x3, 0xc)
write$binfmt_elf32(r2, &(0x7f00000002c0)={{0x7f, 0x45, 0x4c, 0x46, 0xfffffffffffffff9, 0x57ed, 0x4fc, 0xffffffff, 0x0, 0x2, 0x3f, 0xbf58, 0x1d, 0x38, 0x260, 0x533, 0x1, 0x20, 0x2, 0x10000, 0xffffffffffffffff, 0x9}, [{0x4, 0x7, 0x4, 0x5, 0x2, 0x7, 0xe96, 0x5}, {0x7982049c19376ba3, 0x258000000, 0x278, 0x3, 0x3, 0x9, 0x0, 0x3}], "61803c64e0516391c181a335a772a6e27e7907ac3b98fb785c54593d7ddca95465303a1254884feb1705d7fdf9609926f324cefe8bdf7b5f838e69be3ccafd4de4b0b581696db9a043a53bc67bd240d379dbbd4969ccb153d87102b424efe6ceef8d47ce29e4026319e022d872d816e9a873edc739ebc664316cc975719e42f913ab5f3de72890d0bc839882c7eaceec795b6891529f0f0f7268e47373b1cfbad96ca96768c60bfed03c5d0c25be42f503a109917545f97673d2410278f81e5b8a4fa3a6a1d3c9d5c051b50d50029587ce0342ed64e2b82ac67f1e68bc9dce108c56ebe3c6d4cfbc6e1482e9b157aeef", [[], [], [], [], [], []]}, 0x768)
getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000b80)={<r4=>0x0, 0xffff}, &(0x7f0000000bc0)=0x8)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000000c00)={r4, @in6={{0xa, 0x4e24, 0xf25b, @mcast1, 0x5}}, 0x1f, 0x800000000000, 0x7b83, 0x1, 0x4}, &(0x7f0000000cc0)=0x98)
r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000ac0)='/proc/self/net/pfkey\x00', 0x220040, 0x0)
write$binfmt_aout(r2, &(0x7f0000000d00)=ANY=[@ANYBLOB="cc00030177030000a0010000200000002a010000ffffffff00000000000000001e81e3ad63690d4300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e8ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x628)
fcntl$setpipe(r2, 0x407, 0x7f)
mount$9p_fd(0x0, &(0x7f0000000a40)='./file0\x00', &(0x7f0000000a80)='9p\x00', 0x40040, &(0x7f0000000b00)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@uname={'uname', 0x3d, '(user\x00'}}]}})
write$binfmt_script(r3, &(0x7f0000000000)=ANY=[], 0xfffffe0c)
ioctl$TIOCCONS(r5, 0x541d)
sendmsg(r3, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000002000)="24000000100007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b356da5a80d18bec4c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0)

03:35:30 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:30 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfec00000]}, 0x10)

03:35:30 executing program 2:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x101001, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="080000000000000000000080028000007a0a00fffffffffd630148"], &(0x7f0000000480)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6", 0x0, 0xce, &(0x7f0000000300)=""/206, 0x0, 0x3}, 0x48)
sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="080328a37000fedbdf253fa8989da1419f0d00400000000000000800000000000000"], 0x14}, 0x1, 0x0, 0x0, 0x20040004}, 0x8000)
syz_mount_image$nfs(&(0x7f0000000440)='nfs\x00', &(0x7f00000004c0)='./file0\x00', 0x7fff, 0x8, &(0x7f00000029c0)=[{&(0x7f00000005c0)="e7f8a2db6fa74ad8afbc6e65e128f113534b", 0x12, 0x5}, {&(0x7f0000000600)="0af28d348841bdd6adb61a19ba68ef94b110c211c4de76775a3a48660c97ce944f8c634d0fc1ff79021e46c3685533c9ec1782b0bd693bb0eb3e5c6c28920083af30302f0ce28c84f1d1f957f51d37891841f1d62564ba9c57fdb16ebd83b2b05be0f6be903d7c390124c8b70a05a3a0", 0x70, 0x800}, {&(0x7f0000000680)="b834e29058d24349db88c4dd93a0d36f0edc1925e0313c7142fd116cf1aac7773940721654541db7a73b095b47c585294c2302bb336d48bcc6b869f0c22e9815eb9087658f717d8ebd727f0de2f0a94e70537170b36492ee2970e101b3a5c43146ff430d0c5f0767c630d7181c03e4d1ce3f8cbfd411066640ae413ebffafc0e745b46f54350ad742c4c3393f9fdb5451cd967e080c91cda1be6926d51ef759648d4c57dded77128384971ba151d0b70589decba16451fd9f39c4bc58b5bef48f4e28136d1827d5437309f8faa2366fdbb0f32b4ff6e8a0e8d600c9d0c1dc8b6eb5728a5236654294db92b9293cfe33363e3c7a26dc15d539d315fea75576d4e075f573f944e19a2722ba5e3bc639bd195843923c8ef65e402a3ee530ded4991856e526692648c1d0ca212f8adb435032f46e3722359481af66d4ebfa562fa76c9564954c910751f0ace1b6d1b02f8a600d9ee09a3766ba8fc9ea39be6828b77343553592acd97064f89ffdeee32dee91c68bee948e63927df316bce0a12f526ca2cbc751e4080746b09353e0c533aa4a612fd8795500eb53066aea3d5e9af2f85423f71728ce7497296751d336d552f672247e57634df82304da4601b2977c407ca36b20df6f27ec68e2eec278e6ed74096bdf0de1b5a2c11a69680b79c36ba488649dc8942df95011b9494dec9f3756d0571e30d12fa05390fcaef7109463e6dab4ad4393b56acdf017e6eab75d0706c4d23c095c71806baf5dc624cf813860ff2f161b6c872151432d3fb3599713b637ec64884c9eda55efd78375c67518d01e0b5a0f5d509a4fbed2cdefc219bfc9b910d535a6cb10b3cee8b44171e2bb1dbe26947dce6c04730c07c363cb9f19a534e5b338a673fd90461f6f188b6aa172a8f7e123e669ee062e88db2938f3c424acce8f0e367fc462dd4f9f76da56925352e778cf912decb27b07390937f382082f7b2f2d6057a10ba539729c3f79e9b2faa2f54447d9ca5b30865c16300fb450393890ac3145d332d08cdede7239ce232868c01418c90877844398f7e6ce15394af67caa5a51cfa7c9388e68453603c4a32834fba7e3a324fabcae00d7c7a9fdc5a656019591549492ac609ca9bbdc452ee84f443121c503759848686b3f5ce9642a7f0d041d7007521cfe018fd4f5d938c24eaaed9f33b5e8a900c07409bb470c88222625328a7d55bd7a1356a6fa25cf2d1a1a2740f2436e2d148a7b2efc1351406323641cac2eb1f148923854b7609a5b5ed9817844b7b165aa3a6bebad95e0e02a26b8681944eb0a832158e0605989321b10159860715484215fa664c69ff24371b0364bada6aca4b5a131ff66c55d550ddc06d0cca9ab932865ba1e1bb03ed94783b7da47bd71ed670d35827c672c009a74a4388c83c6247d94121c843f42f0e21524f41c1ed27e70f792d9c6795d321d9568cee8e90f2b0bc53d983c85e9218f9849a016b80f30be6098540816a120c73570bd7dcd87817ed973872fe5b10df63109e3f2ef7cdda3c23bc6d3e55e01e3132b0d6d81b0ab5adaa0c73bd62046f32fda8de2d4a297a01154d7f085fbb9dbc5eb80008a854c9831706dbdcf07fb36669ba7bc91912451e40bb39ffb42676bcfaa957dff4be1a4a2294c1aff5cfee3ab785bce349f44eb70bf74bbcb913aff777752a7d827a8fa554b08aa197a6e77c1eb264c3f5a08c59332617274b696b1301c3aceb9be601871404b949bab109db45ff46102c90abba3d05b80b4b8200d2ded95e076464d169000f9a71935bb0ec0f478ab59d365ab47faa47fe716cbc0733311b687161b87b8eb14e1e5e48c6f7dfd19da8e2281b73b4f274b3738ee65c772140b474e6b56ee605cb4414f31dd087b53f05e4a565fe11341aa584e71120efa125b872305d58a8051001eebcaac4d64eaa536ba4f039010a48bdefe6532ab137db2ed8150a877d90ed5b62c51bb615730249336e5e931ed5ca2dca7474f678860ab2239e99cbd1368acf415c1646fdd1aacc00c39e324872f1543c19ba9c13aac01b6ed90055f7a6abbc853c36114ba01c00d8591cc410c453e69469488af12ed79ba5c7e8340c23e74c3b529ba255cc85970ab070240d607bc2ef6f9ea1f2c94bc22786345179f8de171a4d246c58606dacb70c97e6f706153305b50db245954e9ffedf4b551acb144622a987bf6cee0c8533bdbbcb9a841ea3f4af268664eb9b386214af771595ad78a1070621da1c9d18d34a5688c70ecb3d051e9b6713107e7b672c7fa71fd9780ed59309646f306212df5a3fd786456ca5d50f960051c5dd3b461c61441285d3a74f08e0d8c5b2a35b22e3fb140cbe11576e6f3873c2ed50dac24a5cf5cb91d3263ea9d78495b8b40180fddabc883f75dfaf608d49f6d4a9c6d7b671483fbb305458ac4bb745f2d80b45e8da16a376af0b7722f894ca4ba8c454a2dd33cbeba1436647cfb2446cf8f0adebe529ef45239c72b20e954cacac795524fa93b9cf107092dda95627aead94b6753e4048c4b4982ac9459ce183ddef2646b1eb9782a7addaed312b64aa5844408a397f7b32f260b08ebd898319daa86c3445d0cf54ced954fe8a6b86abfcc8c80dcfec7ccea1f8fba1d9e5fb3923017da5b45698627f5e99b60aaaaf9ec51bb1c2e0fe5267d7ea7b929b3d958b99d47497d6ce88d464cbee9c0776d1ee6ebf646190153687384635356457f905661841d752e219d803264b8b3fc02901f3358028486d2ae636580e50cac726ba702732dd5683c19841639c59246397a127146ac7ef73538878203aacd6fcef2020b0204f6f58a691d211d093d80e08cc95dc33b235fb0896196bb8db3e48384f1f1b8f47b6b660791564f889f80b67f679ac3df4574205ab244c894c7abd01e8ca1b6db6cb35e7f48039d461da903cfe83b649420bc2b0ea693c162277235a3b45fe0c29bf45a2637e2eb24b30125508b0e558dc5953314a16bd49f39f7d35d26e234ffd5e48e45be5bb461f0d324569e5db0e148bac5cae958513a668503ffe3ec3fbfd17fbca66aefa930252082ca111cc9130637052a778587a14236c616d26d0d313d9a5abe300d94d3c573f74961e3962986019f0e5160844e6f353d0a77c5b61ffcf6846a3f50ceb17b439f788cd508172b4dcc82e3e1673335a752974dd6d31cb0b02f8262fc8281b859bae927c42931c637c16b7e8408008079afc58a757268fa8018ddcbc57158f60d300ed519f1969043ff5d559c4c485d2efe010bc5162ae3d97fe35007cf8d503bfafd9f30f0348cc6fac96fff85ccdf5a4dce5c3d7582776d6ad512ed083e6d4bc90522cf3e9f152ae8ac500f1e1c0e17dbf01820609536f132241bba89bf24ac72ce26624998d3da70d99f310858bbbefb523590c22c000232e045b707245d2ccfb98437e4e347c932dbdc65e88508bd521064a7d01d70033c42080cd560580aa175d35efdea3ff55734ddcfb7b2721527898989bde17eff87c7043afbe4f91a2f196c32e1d42fe21d01e8d709e87544ac5915c41e857403db12cf92db37aa92b64973341cfc1e1418a306d65fe8c727ea115abbe19e6fe7c541ade34cbc0c8309bef8e277f6ffcd3e7c434caa7df57868d7114837d6fedc6d83739f51ee9e96a91072527185222911f77553b29cfd2f2e0cf8a145e73a073017ea7cf8b34dcfe7171c1f6898e237f6dc6bde6abc22e0d0baf6dbc3ba0a8b3289f2af87bd9cc487339aebffb619575be468e44f415b04caff6fed4db65c3249b8ed2c871601bf8ed38d9a24f2d82b00e97407292ea692c0841964fa70d7a1ff7abec78aab863e1ddd1eba25a5a2a327edbdec9c0f682b57c858185ec3cebe4b05809221a885967bb5e73a6af6ac34ca612f5575526a0d1a13059be2b353dc9877e182172f09080ecd65dee714bc893e529857342d6e60b998b670754a8668c258a0abba156cce715bf4f0e577900ef616a22231abe1399d7184bef274fd84376dcd020e15c194e0e5bc196f6314cb6f4164eac29785e12de6e7556f324541ab74e3f7e56ae6b81855d111d31c1f0b72beabf28d792cfd95718c9e8863290b05b291ed2760b952efb5c4e87253fdf9e888164ef7e4dc9ac59308a116e38f894abbfc3871af7d55f26a205021da8d46fba9a862f956604f8ddb01032c9c5042f013c68c45867a6f97e35357f41fabc04e5f79dcd398c3523e35fd8f5f5c96d4d73398379bc0bbdae98e3aa1a132ae4f87da3688eadd6770f8b146a9567af8df2500282689d28f39b69e4afa8f3a8c96a864edda072fec5b18736535fc6727e8db365f6dc79c280fe69cf7a45ab54fedad9018585e2c3a8447fae5a2e2546727c5fa51ae172ac61052f9b4768322670a862034d6fa736a6dfe06b9ca9ee366ffde2ee440126d3a4c2aa12b04517d466df4b25b33e0ac92d0d96301b2b042f3e44d1091e8ae8a0c36bc9e5404957830577748ff3c6b2cd9123a010e0cbf61306b7d5c27782d867b85bb47e58a36490c9170b01fbed56eceab62eb0b76475bd1bd6ee62691264726576699fa79ac0ec4571f6be2213868674b2a8ecf1701fe9ade4a410ef18a706d4a95c921fd3578b3f2c94027e788f6c576ca496b8857fd64e7f86506cd9eec9cf654865b7b9c3e9609b8a917514530654fcdc003457b66dc8c01673c78759d6e0a38373d8adb9f0a4fc68922fb7d3fb77fc84ea5467829638af32e224a00e3c2b64a2f2550a99e992198e55fd7008127d02358959729e6feff8267b25c05f37b792b53e5a0ef5b6ca5427686286d70cde3d4d121a05ed7e618c6956e05594d6b043cce63e73a5041fa0aff42c3949fc3a9a8414d568982fc77b5445afd522cc1ca07e61a6d7fd43c9face236ea0fb377a97ca29d44bc7b9ab81664b7f519cc26d6f1340cee826657446c0ad8b41a5334bbc8e33872dcc509da09b1491991e1cb5700ff77317b0ff88366508ff6d6671b32edae7a38e0b4f1feaeb5789987065cb7d0faa99d52d5446091a0d7f0140f3c1ac155897817fc81961d8f256cd7bfa00d331127f75517272adb7b44000138ff9c3035b69cd77263e1835ec0bebc290a910df2e046792678fb6539b71d276864bb6790d87bcba27dbe31c10be9b98fbaee7e7e5314d1b67da7646031c97be25e93ec8099d208174447eb91e44db48570b470dc858c559ec583b8deedcc3183d1b2ff1271464b917807f46cad69fe5ab016935cb7d078e08d8297fa2b4570bc8abfc0b1b0b940d6c41ace912249573a0fa24a97a6eec202e98f6a71a898a1bc9cf04a02f6bd21864aa464fde3874e2689f15a2ce7cdfb1d2c8112f8eda4466b03f5680f0c36a2ab6b65df8dc8bd8d51ecc67ac328a071fd5672bece644e0855a1bfa2dc70e0e92482a346c831fe374a5692b4cbdf3576ec43a101ffb05dc54f0aca9bf23829f5fff5616bea7cde706e8385556222ec059b752d21ab4649b581afd4ea797b4833ee0e61606bf755f9b45eb931b30c74ba61ac36574912511a1edf78be71c3ce7bbe327f1e90d8b756d9fc96cb2a0b756112570ad10e9d617d6c0538f316130da5c929b8b1eb28eeaff43a1be214631ad4d4b310ed5433adeb263ae37f28f3e1b767e01fea5a562148ec35b613a662a004bd8c168144b98fca252de4836c4805c6a82ba014c876f1e61cb0c9beadea211d637045a3b7c1882701c0323297736140f784d1d57df64fd108250beb726c7c1adf4b18581677d870f50b59691817e52c0ca57ce776b38e0a2f2ca2f3afcaf3474078eeae2f7c5c5", 0x1000}, {&(0x7f0000001680)="ebbfa70b65d524b19424f80a60bca1333a339ee736bb1fbd153358ba16133df9b03a1079a13e29a34cd40024980df8406de1d884ea002385c0b6525df201ecb2b24613bf7b9b58ca5fa10ba2c0299d67918d5a2d91dfa52a0e9f056762ccc81b6e2f7d4f3da69a1bd599a880d033bd36c9c241ec48ee268f8405704bfa1acba902ecd4292e4d1f93ded3d9604b951c24dd598351f54702c13c213a7802236ad786ab7490567b875926e153ad99eb108e8ada49c2bd48ef284b885b7cfbfec3ff435c2856b74b24111cfd2d728538eea67ec51de7", 0xd4, 0xfffffffffffffff8}, {&(0x7f0000001780)="bc7f5cdac3bbd52eeea09a97a6fcf1270a755f11006d9f8058c0fee801f553aa71f76a5fa6cec8991f4edec91b6ca72db6d504c6dab39c916f1d9564fff5fad43860e1ad649d65ea55452e98ab96eb522521c345c701d01077a48d256e84d12f1c1fc6d4074f002a02b956844369345bbb883fbedf09200b4dcf9b965da7b392b84b804c2007f08db0444f86721115873ebdb8eef7dbc8e6cf21585afeb72db3a6ce77cb71ba07a328024fad9bee1f4b5cdf154b92f5a806978fa3de44a580c0d1eb33b1580c", 0xc6, 0x4}, {&(0x7f0000001880)="8d37aac003e4b4c4212d97d0e53d66645d71fda1a73ccb4d4069e76ce44edbfa7e134accfd3a1d44f5ac90a75a658c8e5fefce61dba978c82cc2f5431ee647722120c533211db9c204c307adef57b5e630a29f430552ac24915dd8213b5a0d86581f571fb70de24902b7a4ff9e7a895be19edcc430dafe7bfdefc215df8d7474c8fc057d25f7180774264b599bdac6961632a53b08bbb344c419c29a67461bf95d4f26c4f94b5ac2843cc407b9ed9c4e490880f4beb3e713a99eb12c7122f44c2a82a0bef375ecb38753a5d8c36c640d9ca66acf9e51fab29f31eb41870e4bfba7d3b7524bb4c7b83853928c8d2926d46e51417d3d5dcbc7fdd908688232e76e3de5b12281fb899b43e666c6ce8ae808632c3c1122cfaccf3350aae60e8cd78239f61a7d72dafa011603abd4b5d3746b7f838496c61706c647e180bad6a7841f6d32c92fac71c69da58645463966e809af425a3d3545889149af3897036ade0f0c11f54cddf0623baf6ba69bde844936d1e07bd41ab5d0e18c5ee0fab7e99f9a77dfcb4f4969c8a5fac30caab8ac4c80ab38c2c2fc82d2dbc34a5439fa36726d930859afb168ccb3b2639a1b5b662e1defb1fa98bc64ab00904cd5e45698b7b7baf13636c9c27ac2c6463021490686f4412557d91ed4225151ed3dfa1df2050fa387f990f06196c1b4704263e61533ba807802d3711289cf07387e9545e4ae6a3da3adfd067c1caad11de556381dc94515f178696d0148a9a23474160b1e115b1a79b47acedbbea3abfb367a0866e7d63966aac14ceaa66cbb1ea6d4d60480105a9fcee075db6398bcf0e718497a86c9c5edf29a1ae0231fa93ec3f08917bc764059025d22ea09aabfe1801ed56ace3c8009b39c89a93ea3a596d78be9ba7ec8491cad780e37fac68d1d063a604378fe8a4541a7f9c231f567f0072b90001f6ea0716ce4e0b645d69fcaf74490b01ca20f324c5f025d8c5d118b84d57569ec863c46d0b2a59eadadb8344c735edff3995597b56610c83e78b1895b10aebe7b4ff147a37cd037dc97779c47d9d4e4891b4149c3014ba4a65ada760aa9a9010e910aa63dfc1fcbd40e0bcc403782e132f772be986cb1ed90c549824a56782d6af3c7b6af6bdf5ab5cffc470c37836f2cad02854853cbc88e5ed5963dbe8954628eaaf0b9f67514a2dfbf4daa33fdfdd9ef629b1c0c3e40a36071c4586a4b30e8c3af76107396a47b67051004927a722020a37c6b252dcfb93dfb6ac88faaadec08339b87257783aa55a6516a8d5e5e25fe4bceb2738f15fe41a70ed7dde2e562e5315374ee18bf5fd77bad3740927809ceb0fbafa22969478e86d762fbae6fbf29b4057f295064983cc9b7266259bf9fbe67b71aea68767f3a0c992f035dfe7a6a7821e6ffcfd96e383cbe3313bcfa3f2788b30a9fffa3129fe1ccd6410f47511c249bf97469185759be75916510d81efd42043ef960cacc645ae1b096d03a99ede9a8f4622e2caf570b79a4945cff21ac191e8fce3f02ab06bc39422a29887ecf35fb1539b4628a42ce17fa23d3bc0ee207adc42a08ffe3aa183ee3f018ab671792109922895aea757e571a91881476feb427df7d75de4d1d9b7a270fb18ccd3b9958f73a01eb73653931e4d0f59283256ede5cd30f1ef066734d254192df6e7f9d1aae274ff2adba328f26205768af28d323ee8fce3cdf09153f9dc0584eef4927b359d28c3313067007f537657dac403268a209d38e083dd2a143101dd887e9da152f2921623c0c5713d49046d5fc05b0bac8dfc101cfd52843eac313dc69e098f498eb56447ab16ad91066f22ce9614f70fafbd1f67668e4424a07cefd5f5b4312b6e4970e788499a7550e76c3d3ef849e0f052a6da461e0678a5252d84e12f4bc9b60051b9922a30313170eb2a4bf19f8fc61dd5bbd65b9d8c1a425e24d188945a9e3f5dd0dee76587566d14ba3dad52a7c4a0f191f33f8c8ad93bef2083db56492bfd82aad4a65a8b1aa7fdd39cfc1e2abc203904a49fc76f06e2458212e1627d4d2e7b2fdafb41e81233f6cced11ab926ed68f3531f7e8bf97151402c5e9ee397843349a3e5191ad11832796f92c693d986a146700e703896a0e45185dfdcba8d198d7de3af8e3d2ea26e42d6d2b78c88bf3e20a4e31b2ef0b675a9ba2d5925a8e19f21d84b8360837d3c1daa19db4896c1549ed30088ccd4bfd6b1559e66cf9a4a606a323f200ba5a4c66ebbc7125dfc1f5a1648841dc9abb20cf12e4c106a9edfdf98a5e020147a474d92ffd6c6fe5c9b0317bb7aef7945225e60cfc85b126c667a35b57bda4a3ed17d44df901dc83e0aadc14268d026ef45a06a388d83ca8cab76bf702bad9c5c0992e09f215c4432d2c183316a84a7d2db33fdad6fcad71b60258dd21960f69ac42a333a29dbda52ddd2ca5c15ee970e99cfa78361e1b4dcaf475268d176991c8186c73fe1867e610c6281673f5f402a82a400b409eabdcddb7215abaa4055088b336877f4bd398d9d387de457fcb47fc182ddc174ed66b4d8b2ecdad673414f481f24d18d5147b5761e7e2aee8a2020dccb2b67d2cd341a23f467a443087e043a3d82f2880608d86dd969a805e0641cc27c4d5795dc42871e8196239f97f259f28709f6df06d94a60e0af6ece240ad88e23b67298cb5ee9b2df7dc92654ffe0374f48c11f39550e3e5df09e99be24510dcedc9f23a2d4acd6182646db0f253566097359bd2c92d0b7181b21519238eeafe2e1f393ddf8a538ee5aa6d46e97bfe18ed7bdc667c738f9bbe3f28bf2229bbfa6784bc46e85bd47badfb9d36e63fde0e47381588c5effecc96786609a242ddb748e05f445193d393710cbcce710eba960ddcf76eb9580d16bbd5ea72130c32de455968d1c920c7550352d98757dd7bf2d51aedc2d13531ccb050c59626cb3a1884b836f71e9cce9c0c26344095c3853553bbe2d65a6bbbc696576157b9e1fe98cc261cf42942265ebbc1837430f068a0453200f226501c53e267a3ece87a9ce9b42374f04aebbea81b9faf12ea88714accdd04de0621f3d50b37e52f328bfb7e9a4e628eed3a06ea88f30bfa563c9187b8aa4b2819ff306ed61aa64a4bbd7425737c06a27ca71af50befc41660d7f3c41e1b8b9923993a950a9d5954eb4b91d425da018d9d42eb22e705eccd630f418038608698cad8f6b09fc4889f95da99d4b1d000423180975ab3a9334fdf62ebfbb13af613978ebfebc687b4f74baeb1ea70d4c9a4d06f6a55e3ed6bf9ebbf5ee601e7e72676f6fde40ad4a1b308416a766b0b290900ac29b6f34d783f27eee3969c82d09eed2f62f6a2801c28534dfdc530a44a8ea33822dd1140fb66b842a535203b71f08d0325ae3cf1314ebc2d08868c5c70d75d63db4b119fded801ed0c8f26dd08997b925d968aca885124f845340139f9d82fb8514a5f5f687d1f763fc39dc2dec31c74179d750941123c1254665d31f80f508be759c10014156fdad5e4c4e16c643722a525fbe8c204c3e9ca2f2b37984187bec732719cf29952eeb0865047cda6ee8128ba3cd0a1cf1283ec3f5a3aaab3d3884a89150d858ae2fc3b311a4da2c97f3d02191cd8b266ceca610a1aea68c5adfb1d959633deae6339c7af664d3b4628500b18851c9c8e2397b9c67ace2edf725b72abef980b87f2d64fb1ae8093eee8ff68c03f69571a71f5a62c76ebd72222b0c2d4036f4e9d370dd3fba23802f3e6b04edea30bc30e72eb20ea8e891d4b11445829010688992c382fdd917a2f520c9f209babe725f5934c0591475dd417264a3e69bccf0b1e14aa3d98ffe4004443db7ee791b0b7225f0e1efbf9bab6f80532c2c36f087d820294c2a9a86e241e5f7cefd9b164fcfc9ffcc49a1839e1b75fe5dac0b59b0bbc8d453496fc3015ae638b93c26a66bc25254e5d5ad4b2c6bad0f56bb1ad48cb080bb40b94d99552c4a313f71093cb47d1386711bead10f02f708a320df8e0ef234ec28e8f15a6838c6ed8801832ff98b9ea050ded7977dad8890382f22e71ea0f8d6527f226f156f9b8691c0270683791628cbaf181aed2c57f805a2c6962b9268d5df167577d0f6eb0e2ac995bb8569a3bf8f854c07bdcd363410622bc0ef5aecdc1d132d265af84321f3852fda2b990ea86ae8ae8ca732ffe365623d914165dd486e2921417fcb1368930d0e9c8f75e5c027f6e3d3a72b38c66a890388d176f7504433f377bbb440b3ae10fc4a05739af1b2b4ef6193571722ab80169804d0ee99c7bfb6710c35d59ad8c558b3dec20b4c28945c0f6183556b4c5f321d2d3cbab6501fb2da385d32ee892e0bafe5af71a501a68c6c194b3409a6dc820a7d0a7ac0e5bd6a01985275215a02df6cae5a31d18e1b9c6bde81b4b260af1b53588eb98aa9b6e25471ec959b1bdcfc2d040fc9369a4722cd1b53a71f2e2310005e32a8d9dcdd54f34684202719976f52bd987e0fe581c41c032ad59ce8832cd2a56c9c3f3985e920bc1f5336e699b3f588d194677884bf1014521efa4bb17faf93aac773a484d1b7ca96c1f6706858d303e88538aa3698deb4a1f72095d443038662e6c300e21a6402e5973cb455b9c0b9b9a5a95fec1c844b6cc885353e2065d497361def8bcb9157b4210a2c653e88f75e05aff2dc3594b27f9a788173924865c00dae26b7929d14a5c00c5ac67a3d90532d9ba510ba5d4ab9b15f1bbf1f938706d8becf9b2c6eaeff42030641f3d2da470a47098641081d0d51d2cd665b9028772f851afede9dc5c5b96eef87568616abe39f5f57010fbf1ffbec5636b088dd84cb09f0e7e078f96684e791385fc57d72b81af5c6af63f53d8dc348f9257e44f184a7f7d6dc2d54ca185e9e6cb2255e440ded1e111d67ce44b08b650981d29581a8e6e69bf4d57fafd8b0bb73b80229a9d39223bd9ebee4228ec79836ff83656cbd644e20ad69d59fb021e92b8fc96c292175484cead831391aa89fdf16a81aa696c2bd8c13767d8f8ebb0a65194cfee23fa0059d1773c45798866d69f77fedd5a673d9141db460c6e72d858f1021be4b8035a50a8a39c94c6c2b955e4f4cb487a372ce998775128a6c606f180a240722f78b73bffdbfc6c622ed831cdaf7a3c9e1d206c0f74e3ef2a82997261a3a5333c45719760d3f211b3106cd21a483c3d06134be12323a6cf10e841b62e696384f2accaf7d54fac32e6f2ac31342ddd0f8329dd85fc847b66a5fe8c52865d4d975c212c39342bbae097c780eb9bf0bb417ceb6a301658e5363e0cc68623685e15eb8422e09680f2927cf07d3cc731735d283af7078b0e5430449a75e0888bc1ce47ba3e6133db194ab3c98a415fe353608695afa326da6f8846f014153d49f7aaf0d0f477c9c28c99c8ada6d8a15acf7c556e425d754e209864d08eec63dfa68720e51aa71f3d15657e67d01c9939683a40e8017bf6e8d1f608820814e1e08055931025fea1dd3e2da10a29f8f7ddebb3d40e6163f515474e7d14e52c2a5d255a878d4ae3b54aacdd86a299d2a6e7ffa60e2eb0eab1321e5e2278ccc475f34d6f16c074479707cf41e512a443af56e9c110df968dbec03fa0531756cb6e61c25da3f3c241967e654073c2d4e21b88e4b08fadc11a131078068776cff6440d5b797b72e0ea51025ae4e4f360318eb1309ac68a92a0e816176ad0e60403391f089eded79761fdba623d0c792a18386cdaea08c737ac240927bac09db05573a5c7943f6876b18993beba810d50ac2256a202295f4aa3c521cd7a14c464d258d3f56ca5879a1c395390497", 0x1000, 0x3}, {&(0x7f0000002880)="6626d75c7257dbc8710678cfa89193ffc0a51957cd02979fc63a08270097f739ae9b1cee8f72619b6270961b08b8dc7cc1fbde45842eb215ac0d6e3eb84a4292a8fb1b51e8cbefb470b406f0b9ad4b2dca7b9687f599e5dc6d520ebdea1b9313bc7a643ba0cbef8207607ec0424e5efc91949c80b9659bb2c91cf3b59246ad89e506ac45fc1b67a6d8fd31d453685b0bc20f5f14531ee15222b16e448ea4e704a618", 0xa2}, {&(0x7f0000002940)="17bcd36b98e9ae2362337918267e094590e5d8d174821061e8bc8bc5d83f66921083b88dba06575f4371b34f06bc7def9bf8251795c463ee7447fa9989d1a6ed9ecb747838404807c9d965c3fd134c7b43a7a91f12c13cc211d97ac9f152a9d83d4e3fabeec8ab6587e2c9be6faf096f73ae9f1de4a7c7c90829001489", 0x7d, 0x2}], 0x2400, &(0x7f0000002a80)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6")
getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f00000001c0)=0x8, &(0x7f00000002c0)=0x2)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
accept4$llc(r1, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000000c0)=0x10, 0x80800)
ioctl(r1, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070")
bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x4, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000050000000004000000000000000000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x84000004, 0xbb, &(0x7f0000000300)=""/187, 0x8000000}, 0x48)

[  394.279271] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  394.298308] RSP: 002b:00007f0f2514dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  394.306047] RAX: ffffffffffffffda RBX: 00007f0f2514e6d4 RCX: 0000000000457089
[  394.313333] RDX: 0000000020000000 RSI: 0000000000005423 RDI: 0000000000000004
[  394.320618] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  394.327917] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[  394.335231] R13: 00000000004d06c8 R14: 00000000004c633f R15: 0000000000000000
03:35:30 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:30 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x8000000]}, 0x10)

[  394.445076] binder: 22280:22283 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:30 executing program 3 (fault-call:2 fault-nth:1):
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:30 executing program 2:
r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x400000000000007d, 0x2000)
mmap(&(0x7f0000012000/0x3000)=nil, 0x3000, 0x8, 0x32, r0, 0x3e)
r1 = socket$inet6_sctp(0xa, 0x0, 0x84)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x1d, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0x8)
fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, <r2=>0x0})
perf_event_open(&(0x7f0000000040)={0x4, 0x70, 0x1, 0x2, 0x4, 0x3, 0x0, 0x200, 0x8000, 0xc, 0x7, 0x6, 0x100, 0x5, 0x80000000, 0x8, 0x100000001, 0x3833bc14, 0x800, 0x9, 0x7ffffffe, 0x6, 0x0, 0xfff, 0xb6, 0x8, 0x2e81, 0x0, 0x2, 0x0, 0x3, 0x6, 0x2, 0x80000001, 0x4, 0x1, 0x7, 0x3f, 0x0, 0x8, 0x0, @perf_config_ext={0x4, 0xd3}, 0x40, 0x80000001, 0x9, 0x7, 0x100000000, 0x1, 0x8}, r2, 0xe, 0xffffffffffffffff, 0x1)

03:35:30 executing program 6:
r0 = socket$inet6(0xa, 0x3, 0x4000000000001)
recvfrom$inet6(r0, &(0x7f0000000380)=""/67, 0x43, 0x10003, &(0x7f0000000100)={0xa, 0x0, 0x0, @local}, 0x1c)
r1 = add_key(&(0x7f0000000000)='blacklist\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000140)="97df692a300b06427519721e567c201b388df8c82db952906f7b2610741cb3a9635d66cd2c9ec6ffd2f55d68163552a5dc752df2a98ca2f0b1fa56870be8e60825bf22f10f81399a5e54a83b90a60519bb64c7e5ee63f6f176a295cbfcae297dac3caef71d0af87560b52a2928166a58ffadf9610f32e6fc2f23fd81577a738c9109bb3dce68f59015b402732cfcb0f55fb0ef50c5e30ee3b15bd10eb045c6b3404e526f919a83498a5612f41f5caed5e8d43a1a12b851ff04a9182d58cd2294870c04e896b713d9d31d6e8c0bb446103dc8ae1c1af3548316dfd94c37", 0xdd, 0xfffffffffffffff8)
r2 = request_key(&(0x7f0000000080)='trusted\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000240)='{,eth0\\wlan1vboxnet0\x00', 0xfffffffffffffff8)
r3 = request_key(&(0x7f0000000280)='id_resolver\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000300)='\x00', 0xfffffffffffffffc)
keyctl$dh_compute(0x17, &(0x7f0000000340)={r1, r2, r3}, &(0x7f0000000400)=""/66, 0x42, &(0x7f0000000580)={&(0x7f0000000480)={'sha384-avx\x00'}, &(0x7f00000004c0)="69706d948a12c8c4cc048dcdec12ad3341509dbe24042cccd5c1cc1363d02480ee105273faa02432a23f53daa8b98f15d9199efbc24ac3e9bd030289c9144eef50b822bef51541d5ecdc7c5c1733a724b8d9b4a6a36e969343ac97e980d1ad5ae6ca14b8220a0f03582fb53e71d530a298797c49418da277d86da446d224b8f8cf623c4b976ec1946952600cf5c6cb298a0c021f33042e90a135114cb3717ee98d34e19f400790d434f333987c4f274d16851db944", 0xb5})

03:35:30 executing program 5:
r0 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0xb, 0x80)
ioctl$int_in(r0, 0x800000800c5012, &(0x7f00000000c0))

03:35:30 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x300]}, 0x10)

03:35:30 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:30 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xff000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

[  394.677923] FAULT_INJECTION: forcing a failure.
[  394.677923] name failslab, interval 1, probability 0, space 0, times 0
[  394.689381] CPU: 1 PID: 22298 Comm: syz-executor3 Not tainted 4.18.0+ #195
[  394.696415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  394.705790] Call Trace:
[  394.708404]  dump_stack+0x1c9/0x2b4
[  394.712056]  ? dump_stack_print_info.cold.2+0x52/0x52
[  394.717266]  ? is_bpf_text_address+0xd7/0x170
[  394.721794]  should_fail.cold.4+0xa/0x11
[  394.725890]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  394.731032]  ? save_stack+0xa9/0xd0
[  394.734683]  ? kasan_kmalloc+0xc4/0xe0
[  394.738592]  ? kmem_cache_alloc_trace+0x152/0x780
[  394.743460]  ? __request_module+0x41a/0xf17
[  394.747803]  ? tty_ldisc_get.part.3+0x50/0x120
[  394.752401]  ? tty_set_ldisc+0x5c/0x6a0
[  394.756396]  ? tty_ioctl+0x3ad/0x1870
[  394.760212]  ? do_vfs_ioctl+0x1de/0x1720
[  394.764294]  ? find_held_lock+0x36/0x1c0
[  394.768400]  ? check_same_owner+0x340/0x340
[  394.772746]  ? rcu_note_context_switch+0x730/0x730
03:35:30 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xf]}, 0x10)

03:35:30 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  394.777704]  __should_failslab+0x124/0x180
[  394.781960]  should_failslab+0x9/0x14
[  394.785809]  __kmalloc_track_caller+0x2c4/0x760
[  394.790503]  ? __request_module+0x41a/0xf17
[  394.794850]  ? rcu_read_lock_sched_held+0x108/0x120
[  394.799903]  ? kmem_cache_alloc_trace+0x616/0x780
[  394.804775]  ? __request_module+0x43c/0xf17
[  394.809121]  kstrdup+0x39/0x70
[  394.812348]  __request_module+0x43c/0xf17
[  394.816529]  ? free_modprobe_argv+0xa0/0xa0
[  394.820868]  ? __lock_acquire+0x7fc/0x5020
[  394.825165]  ? perf_trace_lock_acquire+0xeb/0x9a0
[  394.830049]  ? perf_trace_lock_acquire+0xeb/0x9a0
[  394.834920]  ? graph_lock+0x170/0x170
[  394.838779]  ? find_held_lock+0x36/0x1c0
[  394.842888]  ? kasan_check_read+0x11/0x20
[  394.847062]  ? do_raw_spin_unlock+0xa7/0x2f0
[  394.851503]  ? _raw_spin_unlock_irqrestore+0x74/0xc0
[  394.856628]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  394.861691]  tty_ldisc_get.part.3+0x50/0x120
[  394.866128]  tty_set_ldisc+0x5c/0x6a0
[  394.869996]  tty_ioctl+0x3ad/0x1870
[  394.873645]  ? tty_vhangup+0x30/0x30
[  394.877380]  ? rcu_cleanup_dead_rnp+0x200/0x200
[  394.882075]  ? __fget+0x4d5/0x740
[  394.885552]  ? ksys_dup3+0x690/0x690
[  394.889285]  ? find_held_lock+0x36/0x1c0
[  394.893376]  ? kasan_check_write+0x14/0x20
[  394.897669]  ? __mutex_unlock_slowpath+0x197/0x8c0
[  394.902614]  ? tty_vhangup+0x30/0x30
[  394.906350]  do_vfs_ioctl+0x1de/0x1720
[  394.910254]  ? __lock_is_held+0xb5/0x140
[  394.914339]  ? ioctl_preallocate+0x300/0x300
[  394.918768]  ? __fget_light+0x2f7/0x440
[  394.922767]  ? fget_raw+0x20/0x20
[  394.926266]  ? __sb_end_write+0xac/0xe0
[  394.930266]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  394.935834]  ? fput+0x130/0x1a0
[  394.939153]  ? ksys_write+0x1ae/0x260
[  394.942979]  ? security_file_ioctl+0x94/0xc0
[  394.947402]  ksys_ioctl+0xa9/0xd0
[  394.950866]  __x64_sys_ioctl+0x73/0xb0
[  394.954760]  do_syscall_64+0x1b9/0x820
[  394.958673]  ? finish_task_switch+0x1d3/0x870
[  394.963187]  ? syscall_return_slowpath+0x5e0/0x5e0
[  394.968124]  ? syscall_return_slowpath+0x31d/0x5e0
[  394.973071]  ? __switch_to_asm+0x34/0x70
[  394.977135]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  394.982521]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  394.987377]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  394.992564] RIP: 0033:0x457089
[  394.995773] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  395.014679] RSP: 002b:00007f0f2514dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  395.022392] RAX: ffffffffffffffda RBX: 00007f0f2514e6d4 RCX: 0000000000457089
[  395.029670] RDX: 0000000020000000 RSI: 0000000000005423 RDI: 0000000000000004
[  395.036955] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  395.044229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[  395.051500] R13: 00000000004d06c8 R14: 00000000004c633f R15: 0000000000000001
03:35:31 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x4800000000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:31 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070")
setsockopt$inet6_int(r0, 0x29, 0x0, &(0x7f0000000000)=0x9, 0x4)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0)
r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x288002, 0x0)
ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f00000001c0)={0x52, 0xea0, 0xddb, {0x3f, 0x1}, {0x2f, 0x9}, @rumble={0x3ffc00, 0x1f}})
getpeername$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f0000000100)=0x10)
syz_open_dev$sndpcmp(&(0x7f0000000200)='/dev/snd/pcmC#D#p\x00', 0x8, 0x400)
read$FUSE(r1, &(0x7f00000002c0), 0x1000)

03:35:31 executing program 6:
r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r0, 0x0)
mlock(&(0x7f0000005000/0x4000)=nil, 0x4000)

03:35:31 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x800000018, &(0x7f0000001280)=0x800, 0x4)
r1 = socket$packet(0x11, 0x2, 0x300)
socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000000))
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x800}]}, 0x10)
sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000140)=@in6={0xa, 0x4e21}, 0x42f, &(0x7f0000001200), 0x322}, 0x8000)
sendmsg(r0, &(0x7f00000001c0)={&(0x7f0000000080)=@sco={0x1f, {0xd884, 0x100000001, 0x1, 0x2c4c, 0x18, 0x8}}, 0x80, &(0x7f0000001240), 0x0, &(0x7f00000036c0)}, 0x0)

03:35:31 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x10)

03:35:31 executing program 3 (fault-call:2 fault-nth:2):
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

[  395.239248] binder: 22280:22333 Acquire 1 refcount change on invalid ref 0 ret -22
[  395.304817] FAULT_INJECTION: forcing a failure.
[  395.304817] name failslab, interval 1, probability 0, space 0, times 0
[  395.316225] CPU: 0 PID: 22342 Comm: syz-executor3 Not tainted 4.18.0+ #195
[  395.323258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  395.332623] Call Trace:
[  395.335235]  dump_stack+0x1c9/0x2b4
[  395.338934]  ? dump_stack_print_info.cold.2+0x52/0x52
[  395.344398]  should_fail.cold.4+0xa/0x11
[  395.348492]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  395.353616]  ? __kernel_text_address+0xd/0x40
[  395.358139]  ? unwind_get_return_address+0x61/0xa0
[  395.363167]  ? find_held_lock+0x36/0x1c0
[  395.367296]  ? check_same_owner+0x340/0x340
[  395.371646]  ? rcu_note_context_switch+0x730/0x730
[  395.376607]  __should_failslab+0x124/0x180
[  395.380864]  should_failslab+0x9/0x14
[  395.384687]  kmem_cache_alloc_trace+0x2cb/0x780
[  395.389369]  ? rcu_pm_notify+0xc0/0xc0
[  395.393301]  call_usermodehelper_setup+0xfb/0x420
[  395.398177]  ? dec_ucount+0x350/0x350
[  395.402004]  ? call_usermodehelper_exec_work+0x2f0/0x2f0
[  395.407482]  ? memcpy+0x45/0x50
[  395.410793]  __request_module+0x52e/0xf17
[  395.414963]  ? perf_tp_event+0xc40/0xc40
[  395.419055]  ? free_modprobe_argv+0xa0/0xa0
[  395.423397]  ? memset+0x31/0x40
[  395.426711]  ? perf_trace_lock_acquire+0x4f9/0x9a0
[  395.431660]  ? perf_trace_run_bpf_submit+0x269/0x3b0
[  395.436800]  ? perf_trace_lock_acquire+0x4f9/0x9a0
[  395.441747]  ? perf_tp_event+0xc40/0xc40
[  395.445829]  ? graph_lock+0x170/0x170
[  395.449664]  ? memset+0x31/0x40
[  395.452982]  ? find_held_lock+0x36/0x1c0
[  395.457097]  ? kasan_check_read+0x11/0x20
[  395.461263]  ? do_raw_spin_unlock+0xa7/0x2f0
[  395.465722]  ? _raw_spin_unlock_irqrestore+0x74/0xc0
[  395.470847]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  395.475900]  tty_ldisc_get.part.3+0x50/0x120
[  395.480326]  tty_set_ldisc+0x5c/0x6a0
[  395.484168]  tty_ioctl+0x3ad/0x1870
[  395.487821]  ? tty_vhangup+0x30/0x30
[  395.491585]  ? rcu_cleanup_dead_rnp+0x200/0x200
[  395.496283]  ? __fget+0x4d5/0x740
[  395.499756]  ? ksys_dup3+0x690/0x690
[  395.503509]  ? find_held_lock+0x36/0x1c0
[  395.507598]  ? kasan_check_read+0x11/0x20
[  395.511772]  ? rcu_is_watching+0x8c/0x150
[  395.515931]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  395.521479]  ? rcu_pm_notify+0xc0/0xc0
[  395.525392]  ? tty_vhangup+0x30/0x30
[  395.529125]  do_vfs_ioctl+0x1de/0x1720
[  395.533052]  ? ioctl_preallocate+0x300/0x300
[  395.537474]  ? __fget_light+0x2f7/0x440
[  395.541498]  ? fget_raw+0x20/0x20
[  395.544987]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  395.550539]  ? syscall_slow_exit_work+0x111/0x500
[  395.555396]  ? lockdep_sys_exit_thunk+0x2e/0x2e
[  395.560083]  ? tracehook_report_syscall_exit+0x2f0/0x2f0
[  395.565549]  ? security_file_ioctl+0x94/0xc0
[  395.570006]  ksys_ioctl+0xa9/0xd0
[  395.573477]  __x64_sys_ioctl+0x73/0xb0
[  395.577382]  do_syscall_64+0x1b9/0x820
[  395.581283]  ? finish_task_switch+0x1d3/0x870
[  395.585795]  ? syscall_return_slowpath+0x5e0/0x5e0
[  395.590741]  ? syscall_return_slowpath+0x31d/0x5e0
[  395.595690]  ? __switch_to_asm+0x34/0x70
[  395.599767]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  395.605245]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  395.610113]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  395.615325] RIP: 0033:0x457089
[  395.618532] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  395.637440] RSP: 002b:00007f0f2514dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  395.645192] RAX: ffffffffffffffda RBX: 00007f0f2514e6d4 RCX: 0000000000457089
03:35:31 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:31 executing program 6:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000), 0x1000000000000040)
ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000001040)={"c63b5215cfe587c0efba3d4b2b4e5394a96a099d4c21c248ce0cb5ff2ff77b9c7012983b6d95bde37ebbbdd2c133adfc80f578c9d28ad054587114da4036c2514dcbaa93b5572bcd30f598f0af2d2895810e09ee258a360d74ded6c1fd8320fe6f42bf7b159c7e6dfe2b8e0b3c816645b76e709a2f7bc22872f25a3dc654e36cb3fa1f5431c6d195dd4c9162f12469742445ecfab42754dab7188b4a3da70afdb7ac70735ab8bf7221383f61a835a4e2301a61d3934974d2d04c758880fd2cc738e2a6f2922eb7e5872714c6ad24b727f1e42ac21a01af97ea2fb2580d4e72bf43d07b765fedea0bc8691efb2c34a02df98c820e4946a91b3b9c22f60095c70d2a592ef6323b509a7c716999fd10d42fce8b1e60f8814059cf9f0003ff6b9ca6043b058ce6d677d43cee6863d518ccb5b782cbe93a723fd510d789df67483fb2e516ac8ba3a5a73ee063265aea7eff706d68befe17cc360519676e2799c1645a46a362c397fdcb13096f1737c4468dbc1e93affbfdcea096a4541073dbde420a33690937eb17c174a4c6cfbfe308dc226277af88c49f5a5ca8a6105e667ef15587d1782e4a52e678dfe3e5600c09ba6ecddb2c5e83ac2cba12456ae2a0fc0f4c9cc02f3bec3245371d9335328b8387f6db86d1f7aab5ecadfac8fd01a22a80ce5a9908e29bcfa8530581c3f604a538f391f02b614173a60c15d76c762ae17211022a2e1a87c68feaa8dd14fa63a4dc9a32e352fe586f86e7083d06d2eb5e1ccaf699b4a96dfaa0745dfe2fa23910b75017832493c1c775b8dccdc29d5709b04805ded0e16e582c847d934b8e9db935ca78e6b9d3263aafecabc96cd77e2bfcc5acc07d8ee49e8d25bf56b39a75ed550ec54f41aee559469a1fbe6f472e3fe3fdcfb6ce1c91bbb21e526127d2a689dac200ab32dcc1bb6b19e5b9a10ff6a5592aed0d0a65e0f06c8b514096c08c8f14736491c09eb8805f5a57b6a5e2e42d082ab18d5641fa02192ae5a151a6640642c6bb0d5a5fb7af5ab72978d1fc866ef03af1fbda03bd7c4bcaf98c2aee260b9fa5144793bc0aefa95f6b90cc019d0fa2ef9f0164851901e5c845553815accec3a32c64fdc163fb9860371e6694f8906c147cd8d6e52c0f540d0e1d04b3f6a2850eae205ccfaa1c928ba410563df0acd0fb2092fa8481acd33d21fac8efd1f836aad487ec192818736720a08a4b2365c66024a6dcec0e76d52b5e14636ae8535bcb51ca21760f25f75cc5c05ab20512935a49cbdc28845d2e83898822445ffbf59a809b9f098fd191c3f5db418e1ae63bc0d9ad37d68268fa4c7d0c148b8ef516c792ab0c213216f586f3c0673081f1e95b17c655579c849469c96fed692872e926bd608854109a98be7ff6142c85a611752fc54446767923ff7ef837b405639153b1a1849fa218d9f37009ea916d186127"})
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000580)={0xa86, 0x0, "7e95511b98be85fbf327c90d7e16c9cdf6e39b6f9f96153f8bf14dfb2788dfd360859b45e9783df57bc5d5a10cb2aa1616c951844f8c7961e127c1ecc4455100e3b05d6d40fe379879820fbce2c74b912f25e982a3f2605e90edae5bcd7d7d9aa6af5048cd08d9cb5fb0ea3b5ec9101b4ea1a20517eb52b7f714d2bd6601888e3bc78ab33117529261584a648712c0917728572078b431dd27b246a14b978f8a4657be59d22b9161a1dda023888434391dd1c4d002729117704ebd19be21ec71d23494e45b555fd7becaa1505158b9bb23ce88657a5e4ab2f0b508e2c8025721381bbdc848d6ac43405d0d70ba2f5a3e2b1c95f43047287122bf191b02afe04348f56f7f9b4614e46cb834407c2daeed64e517af8a6439ee80cbb680d0c51c0e4009a1e4d740245c324e5dc08813ce1a1f56c64c9fcf69e45f7cacc00d9c50a12e8e5615bc2c34a611f136dd827f75ca2a544083ddcbd84100e04be595db06ec6028172f94369eca9e181b2e6a0df5b69638c03de578fa2383a823a4d04363379fa43468d7365f86ba61309e96d92013684343493f7c5c8841314bc0baa38c343c84ca511c4e915c90b3174d16616a320a8817490c215438cb98c3be8922c500fa87fe93627a1af52445792ea9fdd1fc25b5012b1f8a5983dbd39435bdff41ce35be63a36b8e9567586c8cf1fda831bc31b6b0b1002a8c5040470d96e7e48f365ca584b89f498e7927cee0cc44565ca4ab685624347112982670f1561ef9bbbea4de7df02fd9a831f1d9888ce3da55bcc9a6156c7a54b2af4ab0624ebdd0b8bff90f172bebcb9b25ba22cc950be4c3b839ab0ceea67b65a24c9e6ffdc51944f4607c6fd84263c7cc69c9eecafc5fa9fccffb98b6c6aa7629bceb1443b749e0563b327eaab5236d75e859492f567b5a7a00f02884f4519841ad7c4ef4e3e7d903c3c6b183487714d50a50ed2e870635bc5926076e437dac224a3f0fe4cb93fc10e25bd0e452e6ecb3e8b5d32187993e13a29c8d167eb4311109f602e030328c0cc4af693343721cbbdc26371b477d90b8f68ddfdc589c6bbd1a9e0dd7898c337813ef0f83dd928b2d2ee16a951a1b1dac082176862b3061fec8e4e79fee31c82ed9404db2799348d062c7c042afd7b5de8d2c44f74e798b98e6fabb518f3afb8ed8876f5d432797f20d57201c7d170fe3db8f044873143dbde4d33dce45eb280bada82aa735bb5fd15a81dfec2a7306a8d9772cfa3d7c514797204abe8f186eea0570e070f7ea06a87719ac9c57856400ad017e1e791f07cdf2941a57cca61d89095705e5b028f7a933e45ad17459b20457044a8e4f20b815b6563583098df295e470559ba5e1484b3a656d79f1c0499249a298b65c4c09705c0b5aa365ebd1ddb8d604654dde3bec733a9599b95145f55007f9a9af9ffa5dec27e7f2bfd4b1cd3dc1defb2beaf9fc7131eb2338f4be3e012a391ca432ca56c5f19ff3b8df1c173407b4d800452585444113919dc02eede4da6c6c3cd31724a4f7fd7d42f1a6ea9df1d0af86e3e1e30472ecb9f9c1f72d4489397087cf77d83a1bed08000d4e6c895f48a391018e648bc59f8225a190d47404cc5e19475385414bd8fde5e632ab8657675bd3e6ad42201fac2d98e5d537901bdd5ac4a9995059d968696d0f455e0fc42d69e91444c1efbe2a263b8f5f56341545ac6016cb4448a2e220eab84d1281c7dd8cf216ec21dea42031e2b28ac1917d261b451b0b04374ea824c3d21685c4c74c4ed9cac2f1caa53ab01fbf65d1cde05af9b6e51fe969c22e7881925409bb018a4120c47504adda556ef8f5900af344302278d80c433b8016b6b63404a199d10f8b0291e6b20c9913278df6f3beb3c11d338d31572f7c472144c329ccf29d4d0dafdf598ef34bdb1345fbd3aa9d787ccd294cf2a0fc81124975452d3a0b1d540c170213fda6b9a4b008231db9568dffe673d3f300564973658eb3edcf6a14c1b646f26218b64d028e88d59ac4c0d7ca4eb6d45e7e943ddc703c689473aebfff7821815b9ca7a77af6e6817cf220ed140da07e27d229952d8d6f12649b0dfe5fbd7b68bfe726c6288e0c93f1602789adc11b09435e84412962af4a519d8f3271ed1e054bc4831ee3eaffaa27d2c38642e6c66de097b486e5fd07563c486e28d3c50b22ae8e52cdc394a2d13397ac0e0590d962d8d92c5ae25d5ffcea8b757b49e0d604c02346a9a9fa077700c74d4332876bd70b0242be663d79125ed3ab95b8266a11c91ecb6a11e0da95091e1df996f7bd4fd9b67a1a32ced219aca0e75f5677f81345ef112d6d358269046b3b365670b149cc6ac398599869e84034ee5d42d8e6b9f97845985d04034ee1dbb444802df3190986bcad4a80d0797b8561b1a879d599b641830629956afd60c1b837f86f00f0f934d6c29582f6f3cfe87c8035b79ea20c8b5eef35afb211a3380f11cbbed6c2bb4529729f2573f3c69ce77ef1089401b6867ea3ee56fb941f892dab10cbb2c89f9c1e5d874c570fef85e288b4accfdab2a18772b00b3896b6927d846e802621edf3d7f5afe37f5b1f451973eb9282f04ffab8d07b14401286ac1cf3a16425f20fc55a9452cebdd98e868b159080613699fdcce8f9175c387830a08cf0b2dd4f30b2878e988a616de913da1e84d81781c5de645470a1c6c8aab7942c9079f0d11f892b924424ecb66ea5050c45e172422f7f765cab80255fdbffe8af7b7666181029f58cbaa1c82d1bd4780152300d4ca7fcd298c08f7ba32319fddd7fd2c6c83ab2c395509eda97376bdf0c43107213ee9fee7b739da614ad26767b67a88b91a363d5d255c363a0e10d4cd0c811b039db72932c0027fb0eb78774b2cda7ddf2804bc35b142abf9008cd482d23314d0e64464399536ecdd4011073f695552bf7addb37b4ff201d9c32c391dc41e9e8e50913baff83bc7770bb46cfc635069cc64ed33ce1332a5e91af16de8ee1c06a71b692e43e7f5179e4ac510dcefb56ed41cd4d83b1e5006d9881e6597451fbd48bde83804b223b5b94059621e0af5d3bf05af13946b2cf9db1541f32dd0c667db1f46632d48c4b9ced7dbbe83794b1b97e44713ddd99259383338794a1d6e5872f36dc93066c9536d14c38cd0ff80f80e6022217056793a928440a78545578e50bb74ce030cbd208df0373a1357df5593e7db1384714dc85e7489b84b9544d61840ae8fc32d75811457b9551cdfebb2abac09820deacd0a0779319381d2ba24193330452ecf07e281f52c105419d232247423b08d91b49619dbc7d91a8ae34f738830ccb6c64b231c1d441d55c9a18aca32b33855925f7af3e0ca2c4c1cfc908534dcd772a382fbf7e1addc1ef5a9388090dd5ef6c8ad761696a8fdac17bcb319fe355c034bc1d97242afe6ac7f4771dc17fb5782f2fa1967bda1e0a0c73324e8aea13c2b45bf2e1235e7113d44231588c774ffa85a34a252a7309d179b7f5e7537b115937f4f55e0bb3d4138453b335b8e1be6a2c90ce0220e4265751e7109046c5667788a62e5c53e0d83608cd46490595e2de2455b7897684087fe717f03789bef40de4c8393c61e6314bff2fba6672aeff74b6d39f862d19f396a4fd0b07d2b69231e06e2874c39091f7b8eff26a7b46f69aa28bcb16608a31ce48510f3710e730b77b77c25d0fc433f9f85139c69b9b58de212fc85312ce21119d6e4b518816bf608680200567c581549269acbb889e10288b55f7c0c84c630ae520a7a1ec50516e43da58ab637add857016a6c2de7b1a09bf54dabac9e8"}, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

[  395.652478] RDX: 0000000020000000 RSI: 0000000000005423 RDI: 0000000000000004
[  395.659759] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  395.667038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[  395.674319] R13: 00000000004d06c8 R14: 00000000004c633f R15: 0000000000000002
03:35:31 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x100000]}, 0x10)

03:35:31 executing program 5:
r0 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
listen(r0, 0xfffffffffffffffc)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
r2 = socket(0x400000000010, 0x3, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000280)="0a5cc80700315f85715070")
sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r3 = socket$netlink(0x10, 0x3, 0x4)
writev(r3, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84470080ffe0064e230000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1)

[  395.744392] binder: 22350:22351 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:31 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xa000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:31 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:31 executing program 3 (fault-call:2 fault-nth:3):
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:31 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x2f]}, 0x10)

[  395.824602] binder: 22350:22362 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:31 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x2000000000000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:31 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:31 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x2f000000]}, 0x10)

03:35:32 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:32 executing program 6:
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x111000, 0x0)
ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000040)=""/232)
setsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000140)=0x4d, 0x4)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000400)={@empty, <r1=>0x0}, &(0x7f0000000440)=0x14)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0xa, &(0x7f0000000180)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4}, @initr0={0x18, 0x0, 0x0, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x8}, @alu={0x7, 0x1, 0xf, 0x0, 0xe, 0xfffffffffffffffc, 0x8}, @generic={0x0, 0x4, 0xc, 0x100000001}, @jmp={0x5, 0x20, 0xa, 0x3, 0x7}], &(0x7f0000003ff6)='GPL\x00', 0x800000000005, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], r1}, 0xfffffffffffffea1)

[  396.053947] binder: 22384:22386 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:32 executing program 2:
r0 = socket$rds(0x15, 0x5, 0x0)
getpeername(r0, &(0x7f0000000040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000240)=0x80)
r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x4001, 0x0)
faccessat(r1, &(0x7f00000000c0)='./file0\x00', 0x0, 0x1600)

03:35:32 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:32 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070")
r1 = msgget(0x2, 0x110)
msgrcv(r1, &(0x7f0000000300)={0x0, ""/46}, 0x36, 0x4, 0x1002)
remap_file_pages(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x3000000, 0x3, 0x80010)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="7b64d6", @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="ac67726fa0705f69643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'])
r3 = open(&(0x7f0000000240)='./file0/file0/file0\x00', 0x0, 0x0)
rename(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00')
read$FUSE(r2, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r2, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
read$FUSE(r2, &(0x7f0000001000), 0x1000)
write$FUSE_ENTRY(r2, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90)
read$FUSE(r2, &(0x7f0000001000), 0x1000)
write$FUSE_ENTRY(r2, &(0x7f0000003000)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x8, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}}}, 0x90)
getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f00000001c0)={0x0, @remote, @loopback}, &(0x7f00000002c0)=0xc)

03:35:32 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfec0]}, 0x10)

03:35:32 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0xc0045878, &(0x7f0000000000)=0x9)

03:35:32 executing program 5:
ioctl$PIO_UNIMAPCLR(0xffffffffffffffff, 0x4b68, &(0x7f0000000380)={0x7fff, 0x9, 0x86})
sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0)
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
readv(0xffffffffffffffff, &(0x7f0000001200), 0x0)
ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000100))
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f00000bc000)=@abs, 0x8)
ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000040)=0x5)
ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000400)={0x8, 0x7, 0xa, 0x0, 0x0, [{r0, 0x0, 0x401}, {r1, 0x0, 0xff}, {r1, 0x0, 0x3e3}, {r0, 0x0, 0x10001}, {r3}, {r0, 0x0, 0x48470506}, {r1, 0x0, 0x2}, {r2, 0x0, 0x6}, {r2, 0x0, 0x5}, {r2, 0x0, 0x511905d5}]})
sendmmsg$unix(r3, &(0x7f00000bd000), 0x80, 0x0)
write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000200)={0x6, 0x118, 0xfa00, {{0x0, 0x0, "7a3ef5da710cc6b98ef7daa3b3c40f5470cbfd31b9fa770615f9489394c4a4459a93797b637a1832005ec532d841f030afe1b3d4ed1f757fdb985fdb0c03c61e409c8eaf898b5e8841d54140d17dee9f2b4c8c71fc561e858ad42eaa6d631640b6a393642e0eeb6ff8a4fb413741ec8be3aca88d1aae868ec25a786312c403648c096373444bd3e1d10e46956fb367905fb6dec8166a504ac2ab40bcb4968c464c3adf52e40724cf1ba31b35ca74cb1633a3146a87c50fe28e8b7ccdcde5ac73ee2e607d721a2dd77bd58ee0607f3b487de236bfedd982b8582276c09944084605d644cee52d3b737d6ee52066101b8a9348e67538c917702334d5aeab778aee"}}}, 0x120)
poll(&(0x7f00000000c0)=[{r3, 0x100}], 0x1, 0x0)
close(r2)

03:35:32 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:32 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xa00, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:32 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xff00]}, 0x10)

03:35:32 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5427, &(0x7f0000000000)=0x9)

03:35:32 executing program 2:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe2(&(0x7f00000000c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000bc8000))
write$binfmt_script(r3, &(0x7f0000000580)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x1)
r5 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x0, 0x214002)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
ioctl$LOOP_SET_FD(r3, 0x4c00, r3)
write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x1c)
getsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f0000000140)={{{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@local}, 0x0, @in=@dev}}, &(0x7f0000000280)=0xe8)
sendmsg$can_bcm(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x1d, r6}, 0x10, &(0x7f0000000380)={&(0x7f0000000300)={0x7, 0x20, 0x20b2, {}, {0x0, 0x7530}, {0x1, 0x400, 0x1, 0x5}, 0x1, @canfd={{0x2, 0x2, 0xb36}, 0xc, 0x2, 0x0, 0x0, "31ed02e2e0a221d0535461916605f2b276f8260029b98b7a25b30f3ebc8fe00fc70346abd70c9a42c27aeba26b560afa560168400e7d2a3a16187e5493c4fcf7"}}, 0x80}, 0x1, 0x0, 0x0, 0x4000}, 0x91)
tee(r2, r1, 0x2, 0x0)
init_module(&(0x7f0000000500)='/dev/audio#\x00', 0xc, &(0x7f0000000540)='/dev/audio#\x00')
r7 = dup2(r2, r2)
getsockopt$IPT_SO_GET_REVISION_MATCH(r5, 0x0, 0x42, &(0x7f0000000080)={'ipvs\x00'}, &(0x7f00000004c0)=0x1e)
getsockopt$sock_buf(r7, 0x1, 0x3b, &(0x7f0000000400)=""/174, &(0x7f0000000000)=0xae)
timerfd_settime(r7, 0x1, &(0x7f0000000240)={{0x77359400}, {0x77359400}}, &(0x7f00000005c0))

03:35:32 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x5e0c}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:32 executing program 5:
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r0 = getpid()
sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x6)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000))
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0)
r3 = syz_open_procfs(r0, &(0x7f0000000040)='net/udplite6\x00')
setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000080)=r3, 0x4)
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000013000/0x2000)=nil, 0x2000}, 0x1})
r4 = syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x0, 0x402)
ioctl$EVIOCGMTSLOTS(r4, 0x8040450a, &(0x7f0000013000))
write$evdev(r4, &(0x7f0000000300), 0x0)
ioctl$EVIOCGMTSLOTS(r4, 0x8040450a, &(0x7f0000000480)=""/115)
close(r1)

03:35:32 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:32 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x3e]}, 0x10)

03:35:32 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0xc0189436, &(0x7f0000000000)=0x9)

[  396.834632] binder: 22384:22446 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:32 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:32 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x540d, &(0x7f0000000000)=0x9)

[  396.911576] binder: 22458:22461 Acquire 1 refcount change on invalid ref 24076 ret -22
03:35:33 executing program 6:
r0 = add_key(&(0x7f00000001c0)='user\x00', &(0x7f0000001300), &(0x7f0000001340)='r', 0x1, 0xfffffffffffffffe)
r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='user\x00'}, 0x10)
sync_file_range(r1, 0x1, 0x4, 0x4)
request_key(&(0x7f0000000140)='user\x00', &(0x7f00000000c0), &(0x7f0000000180)='ppp1(\x00', r0)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x440000, 0x0)
ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000040)={0x1e, 0x3a5})

03:35:33 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x10)

03:35:33 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:33 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x2, &(0x7f0000000000)=0x9)

03:35:33 executing program 5:
r0 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0)
r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x40505330, &(0x7f00000001c0)={{}, 0x0, 0x0, 0x0, {0x2, 0x8}})
ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x3)

03:35:33 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfe80, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:33 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:33 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x10)

[  397.704517] binder: 22458:22507 Acquire 1 refcount change on invalid ref 24076 ret -22
03:35:35 executing program 2:
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', <r1=>0x0})
connect$can_bcm(r0, &(0x7f0000001ff0)={0x1d, r1}, 0x10)
sendmsg$can_raw(r0, &(0x7f0000001fc8)={&(0x7f000000a000), 0xffd1, &(0x7f0000000ff0)={&(0x7f000000a000)=@canfd={{0x1}, 0xffffff7f, 0x0, 0x0, 0x0, "0327e1b22b5fcef7739c699f5ff986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b50200000000000000004e2f9663a918fa1efd9b0b"}, 0x9d8}}, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x20)

03:35:35 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5414, &(0x7f0000000000)=0x9)

03:35:35 executing program 5:
r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x1000, 0x0)
r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x3ff, 0x20000)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
seccomp(0x400000000000002, 0x0, &(0x7f0000000040))

03:35:35 executing program 6:
r0 = memfd_create(&(0x7f0000000140)='dev ', 0x0)
write(r0, &(0x7f0000000040)="164690f91220", 0x6)
sendfile(r0, r0, &(0x7f0000000000), 0xfffb)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
clock_nanosleep(0x0, 0x0, &(0x7f0000000100), &(0x7f00000000c0))
getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000080)={<r1=>0x0, 0x8c3}, &(0x7f0000000180)=0x8)
getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000001c0)={r1, 0x10000}, &(0x7f0000000200)=0x8)

03:35:35 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x10)

03:35:35 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:35 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xfffffdfd}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:35 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xf401, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

[  399.799132] binder: 22521:22526 Acquire 1 refcount change on invalid ref -515 ret -22
03:35:35 executing program 5:
r0 = socket$inet6(0xa, 0x7fc, 0x400)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket$inet6(0xa, 0x1, 0x6)
setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000000)={0x40000000000005}, 0x4)
r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x40, 0x0)
ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000140)={0x200, 0xff, 0x5, 0x2, 0x1e2a})
ioctl$LOOP_SET_FD(r2, 0x4c00, r1)
connect$inet6(r1, &(0x7f0000419000)={0xa, 0x0, 0x0, @ipv4}, 0x1c)
ioctl$UI_BEGIN_FF_ERASE(r2, 0xc00c55ca, &(0x7f0000000100)={0xe, 0x0, 0x9})
bind$vsock_dgram(r2, &(0x7f00000000c0)={0x28, 0x0, 0x0, @host}, 0x10)

03:35:35 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0xc020660b, &(0x7f0000000000)=0x9)

03:35:35 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:35 executing program 2:
r0 = socket$rds(0x15, 0x5, 0x0)
setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10)
r1 = dup3(r0, r0, 0x80000)
r2 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x4, 0x4400)
ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f0000000080)=r2)

03:35:35 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfe800000]}, 0x10)

03:35:35 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:35 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xfeffffff]}, 0x10)

03:35:36 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x2d3)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x1, 0x0)
accept4(r0, &(0x7f0000000300)=@generic, &(0x7f0000000380)=0x80, 0x80000)
accept4$unix(r1, &(0x7f0000000240), &(0x7f00000002c0)=0x6e, 0x80800)
sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = accept$alg(r0, 0x0, 0x0)
sendto(r2, &(0x7f0000000480), 0x0, 0xfffffdffffffffff, &(0x7f0000000000)=@hci, 0x80)
recvmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1, &(0x7f00000000c0)=""/50, 0x32}, 0x0)
sendto(r2, &(0x7f0000001640)="13", 0x1, 0x0, &(0x7f0000002a80)=@nl=@unspec, 0x80)

03:35:36 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x540c, &(0x7f0000000000)=0x9)

03:35:36 executing program 5:
r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x3d, 0x0)
ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x9, 0xffffffffffffffff, 0x0, <r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r1, 0x0, r0)
ioctl$SNDRV_SEQ_IOCTL_PVERSION(r2, 0x40086200, &(0x7f0000000000))

03:35:36 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:36 executing program 6:
add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140), 0x0, 0x0, 0xfffffffffffffffd)
keyctl$set_reqkey_keyring(0xe, 0x4200000000001)
request_key(&(0x7f00000001c0)='user\x00', &(0x7f0000000080), &(0x7f00000000c0)='/dev/uinput\x00', 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000180)={0x2, 0x463, 0x9, 0x5}, 0x10)
r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='user\x00'}, 0x10)
setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x4e21}}, 0x3, 0x5, 0x10000, "5938246efc2f1015ccab96237027202a6cde397a859697eb9c374b680adda38c0d8fc7b2f4d8132f2c515c49f0393f8f86751ef5830af096ae8bdd42f1cab29cb10431d1bc4ddf5466796f3bf25b6c1a"}, 0xd8)

03:35:36 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x10)

03:35:36 executing program 2:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = open(&(0x7f0000000080)='./file0\x00', 0x2000, 0x0)
write$FUSE_IOCTL(r1, &(0x7f00000000c0)={0x20, 0x5be55000c1191d36, 0x1, {0x9, 0x4, 0xd6e, 0x3}}, 0x20)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000002c0)={0x0, <r2=>0x0}, &(0x7f0000000300)=0xc)
sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@getpolicy={0x1cc, 0x15, 0x101, 0x70bd25, 0x25dfdbfd, {{@in=@dev={0xac, 0x14, 0x14, 0x20}, @in6=@mcast2, 0x4e20, 0x9, 0x4e23, 0x0, 0x0, 0x20, 0x20, 0x0, 0x0, r2}, 0x0, 0x2}, [@algo_auth_trunc={0x64, 0x14, {{'sha384-generic\x00'}, 0xb0, 0x280, "5e567f7765efd6847897ff9f9bf26b60cc7742d44e49"}}, @lifetime_val={0x24, 0x9, {0x6, 0x8, 0x4, 0x9}}, @output_mark={0x8, 0x1d, 0x13}, @ipv6_hthresh={0x8, 0x4, {0x8, 0x21}}, @algo_auth_trunc={0xac, 0x14, {{'md4\x00'}, 0x2f0, 0x60, "98ca2faa78d08b377bc286c2dddd9ac028b6d2949f987b48d71c5ee79cb933825d25400b28b4e298c31928d102aa5aaaac76d9f433692accd27f90a6aa2b90fe26efda7650a233f2ebd2a118c97b0bd2395afde4cfa32b3bc2ef51293b92"}}, @migrate={0x30, 0x11, [{@in6=@ipv4={[], [], @multicast1}, @in6=@local, 0xff, 0x2, 0x0, 0x3502, 0x2, 0x81d044505f2442cb}]}, @output_mark={0x8, 0x1d, 0x10001}]}, 0x1cc}, 0x1, 0x0, 0x0, 0x10}, 0x40)
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000200)=<r3=>0x0)
r4 = getpid()
kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r0, &(0x7f0000000240)={r1, r1, 0x6})
sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000002900010000000c01010007ffffffffffe40000000000000000000000000000000000"], 0x20}}, 0x0)

[  400.583414] binder: 22521:22588 Acquire 1 refcount change on invalid ref -515 ret -22
03:35:36 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x68}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:36 executing program 5:
perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
prctl$void(0x0)
recvfrom$inet(0xffffffffffffffff, &(0x7f0000000400)=""/157, 0x9d, 0x0, &(0x7f00000004c0)={0x2, 0x0, @local}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = socket$vsock_dgram(0x28, 0x2, 0x0)
socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000640)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000740)={{{@in=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast1}}, &(0x7f0000000840)=0xe8)
ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000880)={@mcast1, 0x7b, r2})
recvmsg(r0, &(0x7f0000000600)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000500)=[{&(0x7f00000000c0)=""/202, 0xca}, {&(0x7f00000001c0)=""/5, 0x5}, {&(0x7f0000000200)=""/119, 0x77}, {&(0x7f0000000280)=""/78, 0x4e}, {&(0x7f0000000300)=""/206, 0xce}], 0x5, &(0x7f0000000580)=""/124, 0x7c, 0x2}, 0x40)

03:35:36 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5437, &(0x7f0000000000)=0x9)

03:35:36 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:36 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070")
getsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000040)=""/83, &(0x7f00000000c0)=0x53)
r1 = socket$l2tp(0x18, 0x1, 0x1)
r2 = socket$inet6(0xa, 0x3, 0x3a)
r3 = socket$inet6(0xa, 0x1, 0x0)
recvmsg(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000740)=@alg, 0x80, &(0x7f00000009c0)=[{&(0x7f00000001c0)=""/15, 0xf}, {&(0x7f0000000380)=""/22, 0x16}], 0x2, &(0x7f0000000a00)=""/218, 0xda, 0x3}, 0x2042)
ioctl(r1, 0x4000008912, &(0x7f0000000480)="295ee1311f16f4c6bf4e3b45d86822d5780d6a9f1f1638d99709cc1eea028766bdc41ebf017ee74e7b851e1f34b4406045f903b837be136250708165d1937aa26b1712fbf3126218ecb8c56f296d4d600c9a5c43cb4386819cd54832fd1ed544a6e3cf873efa540e1617776426c42f8550e38fe7039a08b91e9d0a0966fbd05eb35c0254ee9859888a9487cb9596fa7fe7b54196c191e04a06eed28ec2f71181be56730e45260aec9d1b7cbcd35c865e0d8488e26b9d5a2357642698058bc651248eb842cfd09a1131d7f329a3c661a38baa42054a97e9aeaf3de78e608f9207117b5b26e7c8d1c0ec3803df1c8ddf99fa4d16399a5f827b6f6f143c109ad76b0a142597b07df80e9b77ae")
r4 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r5=>0x0})
bind$packet(r4, &(0x7f0000000000)={0x11, 0x0, r5}, 0x14)
getsockopt$inet_mreqn(r4, 0x0, 0x20, &(0x7f0000000200)={@multicast2, @local, <r6=>0x0}, &(0x7f0000000300)=0xc)
syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @multicast2}, @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, &(0x7f0000000240))
getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000007c0)={{{@in=@remote, @in=@multicast1}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000180)=0xda)
ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000bc0)={@mcast1, 0xf, r6})
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000d80)=@sack_info={<r7=>0x0, 0x8, 0x7f}, &(0x7f0000000dc0)=0xc)
getsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f0000000e00)=@assoc_value={r7, 0xfffffffeffffffff}, &(0x7f0000000e40)=0xffffffffffffff46)
r8 = socket$inet6(0xa, 0x1001000000002, 0x0)
ioctl(r8, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070")
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000003fe8))
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000340)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x2})
r9 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r9, 0x84, 0x8, &(0x7f0000013e95), 0x4)
ioctl$sock_SIOCETHTOOL(r9, 0x89b0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="0000000000000000020000004ea3a1fbbd2eba5d2033923100000000000000"]})
close(r9)
close(0xffffffffffffffff)

03:35:36 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x1a000]}, 0x10)

03:35:36 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070")
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x10001, 0x8000)
ioctl$TCSETA(r1, 0x5406, &(0x7f0000000040)={0x101, 0x8, 0x101, 0x1, 0x8, 0xfffffffffffffff7, 0x54, 0x4d, 0x37a, 0x38e})
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETA(r2, 0x402c542d, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x3, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffb})

03:35:36 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x1100, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:36 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:36 executing program 6:
r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x40505330, &(0x7f00000001c0)={0x80})
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000300)='/dev/dsp\x00', 0x0, 0x0)
write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000000100)={0x41, 0x6, 0x0, {0x3, 0x2, 0xfffffffffffffe03, 0x0, '-]wlan0cgroupsystem)eth0'}}, 0x41)
ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f00000000c0))
getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040), &(0x7f0000000080)=0xc)
ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000240)={0x2, 0x2, 0x0, 0x0, 0x1})
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2)

03:35:36 executing program 5:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000000c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha512\x00'}, 0xfffffffb)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000), 0x0)
r1 = accept$alg(r0, 0x0, 0x0)
write$binfmt_elf32(r1, &(0x7f00000001c0)=ANY=[@ANYRESDEC], 0x14)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x20000, 0x0)
write$P9_RLINK(r2, &(0x7f0000000080)={0x7, 0x47, 0x2}, 0x7)
clock_gettime(0x0, &(0x7f0000000000)={0x0, <r3=>0x0})
recvmmsg(r1, &(0x7f0000004e00)=[{{&(0x7f0000000ac0)=@xdp, 0x80, &(0x7f0000000b40), 0x0, &(0x7f0000001b80)}}, {{&(0x7f0000001bc0)=@rc, 0x80, &(0x7f0000003fc0)=[{&(0x7f0000001d40)=""/156, 0x20f}], 0x1, &(0x7f0000004040)=""/224, 0xe0}}], 0x2, 0x0, &(0x7f0000004fc0)={0x0, r3+10000000})

03:35:36 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3e]}, 0x10)

03:35:36 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5451, &(0x7f0000000000)=0x9)

[  400.735945] binder: 22614:22615 Acquire 1 refcount change on invalid ref 104 ret -22
03:35:36 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070")
open(&(0x7f0000000100)='./file0\x00', 0x80, 0x41)
r1 = dup(r0)
getsockopt$inet_buf(r1, 0x0, 0x2f, &(0x7f0000000300)=""/227, &(0x7f0000000040)=0xe3)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000080)=@nat={'nat\x00', 0x19, 0x3, 0x318, [0x20000540, 0x0, 0x0, 0x20000640, 0x20000780], 0x0, &(0x7f0000000000), &(0x7f0000000540)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000b0000000000000000006272696467655f736c6176655f300000736974300000000000000000000000006970366772657461703000000000000069706464703000000000000000000000ffffffffffff000000000000aaaaaaaaaa000000000000000000a0000000a0000000d0000000636f6e6e6c6162656c000000000000000000000000ff7f00000000002e1b0000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffff7f0100000003000000000000000000766c616e3000000000000000000000006270713000000000000000000000000069705f76746930000000000000000000766574683100000000001c00000000000180c2000000000000000000aaaaaaaaaa00000000000000000070000000d8000000100100000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000cd67c026a74517d29d116d006d61726b00000000000000000000000000000000000000000000000000000800100000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff0100000005000000000000000000726f73653000000000000000000000006970366772653000000000000000000076657468305f746f5f62726964676500766c616e300000000000000000000000ffffffffffff0000000000000180c200000000000000000000007000000070000000a80000006172707265706c79000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000"]}, 0x38d)
accept(r0, &(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, <r3=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000200)=0x80)
getsockopt$inet_tcp_int(r3, 0x6, 0x17, &(0x7f0000000240), &(0x7f00000002c0)=0x4)

03:35:36 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:36 executing program 6:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
capset(&(0x7f0000000640), &(0x7f0000001fe8)={0x4, 0x0, 0x2})
r1 = accept$inet(0xffffffffffffff9c, &(0x7f00000000c0)={0x2, 0x0, @broadcast}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f00000002c0)={<r2=>0x0, 0x9}, &(0x7f0000000500)=0x8)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000005c0)={r2, 0x68, &(0x7f0000000540)=[@in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e24, 0xb13, @local}, @in6={0xa, 0x4e23, 0x3ff, @local, 0x187ec9f6}, @in={0x2, 0x4e21, @remote}, @in={0x2, 0x4e20, @rand_addr=0x80000000}]}, &(0x7f0000000600)=0x10)
socket(0x10, 0x0, 0x0)
syz_open_procfs(0x0, &(0x7f0000000440)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f7980584303d01f0549a89d78dc4af89ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5ad3657818feb0279188b92b2e6b035cde4c66c6b00081bd106f6adfe58108a8be89d3695670374e304c071de17635f3034de8c2372e07000000000000007d656f")
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000), 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000400008fe7bb5cd4e344cd0002800000720a00ff"], &(0x7f0000000080)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6", 0x0, 0xce, &(0x7f0000000180)=""/206}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xf, 0x5, &(0x7f0000000040)=@framed={{}, [@jmp={0x5, 0x0, 0xffffffcd}]}, &(0x7f0000000200)='syzkaller\x00', 0x80000001, 0x228, &(0x7f0000000300)=""/187}, 0x48)

[  400.929712] kernel msg: ebtables bug: please report to author: Wrong len argument
[  400.970816] kernel msg: ebtables bug: please report to author: Wrong len argument
03:35:37 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x68000000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:37 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}, 0x10)

03:35:37 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x80045432, &(0x7f0000000000)=0x9)

03:35:37 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000140))
r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x589200)
ioctl$RTC_PIE_OFF(r3, 0x7006)
ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000080))
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0\x00', 0x0, 0x0)
syz_kvm_setup_cpu$x86(r4, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f0000000040)="b8010000000f01d90f00d50f23ba66b884000f00d0b8010000000f01d9f30f7f96fcb400000f2d0edff50f0099000000800f01df", 0x34}], 0x1, 0x0, &(0x7f0000000280), 0x58)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r3, 0x402c5342, &(0x7f0000000180)={0x1ff, 0x0, 0x7fff, {0x77359400}, 0x9, 0x9})

03:35:37 executing program 2:
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @remote, [{[], {0x8100, 0x9, 0x3, 0x1}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x21, 0x0, @remote, @local}, @dccp={{0x0, 0x0, 0x4, 0xf008, 0x0, 0x0, 0x0, 0x2, 0x0, "e57044", 0x0, "cd98e8"}}}}}}, &(0x7f0000000100)={0x0, 0x0, [0x277]})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000040)={0x2, 0x3, 0x0, 0x9, 0x10, 0x0, 0x0, 0x0, [@sadb_x_sa2={0x2, 0x13, 0x2}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x80ffffff]}}}]}, 0x80}}, 0x0)
r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0xffffffffffffff80, 0x2402)
name_to_handle_at(r2, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={0x70, 0x1d, "3c7292ea4c65e4130f9c2e898210b22cb6193f7b4325ff57a411f100dc43a4f3baead3fa3a3eea335f53cceeae152027aa4c750ef87500003615950930caf127f73b9114d4cb32bcaecbc8ab2df09cedf76307742abdcdc2bfd69d9425970e6066d52e8253374e8b"}, &(0x7f0000000140), 0x1000)

03:35:37 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:37 executing program 6:
r0 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x6, 0x200082)
getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000080)={<r1=>0x0, 0x100000000, 0x800, 0xdb}, &(0x7f00000000c0)=0x10)
setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000100)={r1, 0x6, 0x8, [0x2, 0x7ff, 0x3, 0x20, 0x5, 0x7fff, 0x8, 0x4]}, 0x18)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = socket$unix(0x1, 0x1, 0x0)
r4 = socket$unix(0x1, 0x400040000000001, 0x0)
bind$unix(r4, &(0x7f0000003000)=@abs={0x1}, 0x8)
listen(r4, 0x0)
connect(r3, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8)
r5 = syz_open_procfs(0x0, &(0x7f0000001880)='net/ip_vs_stats\x00')
sendfile(r3, r5, &(0x7f0000000000), 0x800000bf)

03:35:37 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xe, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

[  401.529248] binder: 22614:22654 Acquire 1 refcount change on invalid ref 104 ret -22
03:35:37 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:37 executing program 6:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x80806, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070")
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000140)={0x7b, 0xbff, [0x0, 0x0, 0x40000020]})
ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f0000000000))

03:35:37 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x545d, &(0x7f0000000000)=0x9)

[  401.645843] binder: 22673:22675 Acquire 1 refcount change on invalid ref 1744830464 ret -22
03:35:37 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000]}, 0x10)

03:35:37 executing program 2:
r0 = creat(&(0x7f0000000340)='./bus\x00', 0x0)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000040)=<r1=>0x0)
ptrace$getregset(0x4204, r1, 0x200, &(0x7f0000000240)={&(0x7f0000000180)=""/110, 0x6e})
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={<r2=>0x0}, &(0x7f0000000100)=0xc)
fcntl$lock(r0, 0x7, &(0x7f0000000140)={0x0, 0x0, 0x9b, 0xd, r2})
r3 = semget(0x2, 0x3, 0x40)
semctl$SETVAL(r3, 0x3, 0x10, &(0x7f00000002c0)=0x7ff)
write$FUSE_IOCTL(r0, &(0x7f0000000000)={0x20}, 0x20)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r4 = socket$inet6(0xa, 0x6, 0x0)
ioctl$RTC_UIE_OFF(r0, 0x7004)
ioctl(r4, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070")
fcntl$setstatus(r0, 0x4, 0x44000)
io_setup(0x40000100000003, &(0x7f0000000200)=<r5=>0x0)
io_submit(r5, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}])

03:35:37 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80720315f85714070")
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="ce58"])
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000000)="0f01c8f20f35ba2000b000ee0f2336360fc76df20f2054440f20c0663504000000440f22c064f3e10a660f3a63a63c6700baf80c66b8bd08428766efbafc0cb066ee", 0x42}], 0x1, 0x0, &(0x7f0000000000), 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_NMI(r3, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil})
ioctl$KVM_RUN(r3, 0xae80, 0x0)

[  401.777280] binder: 22673:22680 Acquire 1 refcount change on invalid ref 1744830464 ret -22
03:35:37 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:37 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5425, &(0x7f0000000000)=0x9)

03:35:37 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x5e0c0000}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:37 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3e00000000000000]}, 0x10)

03:35:37 executing program 6:
io_setup(0xba, &(0x7f00000000c0)=<r0=>0x0)
r1 = socket(0x2, 0x803, 0xff)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000000)={0x3, 'veth1_to_team\x00', 0x1}, 0x18)
io_submit(r0, 0x1, &(0x7f0000000140)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000080), 0xfffffe00}])

[  401.976218] binder: 22708:22712 Acquire 1 refcount change on invalid ref 1577844736 ret -22
03:35:37 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:38 executing program 5:
r0 = socket$nl_xfrm(0x11, 0x3, 0x6)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', <r1=>0x0})
r2 = accept4(r0, 0x0, &(0x7f0000000080), 0x80800)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000100)={r1, 0x1, 0x6, @dev={[], 0x1d}}, 0x10)
bind$packet(r0, &(0x7f0000000240)={0x11, 0x0, r1}, 0x14)
readahead(r0, 0x3, 0x8)
r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f0000000000))
r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r4, 0x2, r2)

[  402.029059] syz-executor2 (22693) used greatest stack depth: 11048 bytes left
[  402.037504] binder: 22708:22720 Acquire 1 refcount change on invalid ref 1577844736 ret -22
03:35:38 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}, 0x10)

03:35:38 executing program 6:
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0xfffffffffffffffe, 0x32, 0xffffffffffffffff, 0x4)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f00000003c0)=""/4096, &(0x7f00000013c0)=0x2)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ppp\x00', 0x101002, 0x0)
epoll_pwait(r1, &(0x7f00000002c0)=[{}, {}, {}], 0x3, 0x8001, &(0x7f0000000300)={0x6}, 0x8)
r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0)
ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000040)={[{0x3, 0x40, 0x6ee, 0x10000, 0x5, 0x3, 0x2ee5, 0x5, 0xc7d1, 0x5404949b, 0x80000001, 0x7, 0x20}, {0x5, 0x5, 0x3, 0x3ff, 0x6, 0xff, 0x4, 0x0, 0x0, 0x4000, 0xf750, 0x2, 0x47}, {0x8, 0x5, 0x4, 0x0, 0x3421, 0x1, 0x6, 0xad5, 0x8b1, 0x6, 0x4, 0x2800000000, 0x5}], 0x7ff})
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00')
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000240)=0x14)
getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000001400)={0x0, 0x200, 0x77ee, 0x7, 0x1, 0x8001, 0xffffffffffffff37, 0x1, {<r4=>0x0, @in={{0x2, 0x4e20, @multicast1}}, 0x1, 0x6, 0x7, 0x7fffffff, 0x3}}, &(0x7f0000000340)=0xb0)
setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000380)={r4, 0xfffffffffffffffc, 0xff}, 0x8)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r3, 0x6, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2b}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x40000)

03:35:38 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x400000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:38 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047", 0x3b}], 0x1, 0x0, &(0x7f0000000080), 0x0)
ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000002c0)=ANY=[@ANYBLOB="010080db4d7e30e062de9a000000018f484ab903ac00c706df7d7bad667920455265ba1eb4260380056e8a82b5f153706066f6b020486315aa3aced52b5c2c93b129819c67482bed532839c08601a5"])
ioctl$KVM_ENABLE_CAP_CPU(r4, 0x8188aea6, &(0x7f00000001c0))
ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000240)=0x4)
r5 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x3, 0x101000)
ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00@\x00'])
getsockopt$inet_int(r5, 0x0, 0x3a, &(0x7f0000000140), &(0x7f0000000180)=0x4)
r6 = fcntl$getown(r0, 0x9)
ptrace$pokeuser(0x6, r6, 0x401, 0x4800000000000000)

03:35:38 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0x4800}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:38 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:38 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000040)={<r1=>0x0, 0xce, "1429ec719d75dfde607de796b741aeb9d5449f3a8262ef80861eb220711ae81dfc878f52fb328a0db3cade7fd92116483afd673f5ba5ffff11d9b820b49133c87917f3cae801a797ac00d990ec3c260e5864355ba0cf5a87f5dcd8262b2df4011f4245d4b42d2afb746c356a0c21ebbbc6ee40e55348ea98f2a31549cb2ac9e2e80fa5580c5cec9daa9264c2cbfe07771b4a989a90f2a7b39a1de7b7faa15749133cb6313bb5278dca55a120e58a0af93204879da4cc952b0809906ffd35a40a52c2c838ffc9a78aa978c60cab52"}, &(0x7f0000000200)=0xd6)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000240)={r1, @in6={{0xa, 0x4e22, 0xffffffff00000001, @local, 0x7}}, 0x401, 0x1}, 0x90)
preadv(r0, &(0x7f0000003a00)=[{&(0x7f0000003900)=""/209, 0xd1}], 0x1, 0x0)
ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000300)={0x27, 0x32, 0x4, 0x13, 0x4, 0x8, 0x6, 0xd4, 0x1})

03:35:38 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0xc0045878, &(0x7f0000000000)=0x9)

03:35:38 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}, 0x10)

03:35:38 executing program 6:
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0)
r1 = socket$inet(0x2, 0x7, 0x800)
ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f00000000c0)={0x0, 0x915, 0x7, 0x5, 0x5})
prctl$getreaper(0x28, &(0x7f0000000180))
write$P9_RCREATE(r0, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x1, 0x4, 0x3}, 0x5}}, 0x18)
syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x2240)

[  402.435895] binder: 22752:22754 Acquire 1 refcount change on invalid ref 18432 ret -22
03:35:38 executing program 6:
socketpair(0x1d, 0x0, 0x2, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000000)={{{@in=@multicast1, @in6=@dev}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000000140)=0xe8)

03:35:38 executing program 5:
r0 = socket$inet6(0xa, 0x6, 0x2f8)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket$inet6(0xa, 0x7ff, 0x1)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x8, &(0x7f0000000000), 0x20)

03:35:38 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:38 executing program 2:
r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x8, 0x2300)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000008000)={0x0, {{0x2, 0x0, @multicast2}}}, 0x88)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @loopback, @dev}, 0xc)
getsockopt$inet_buf(r1, 0x0, 0x30, &(0x7f0000008000)=""/144, &(0x7f0000004000)=0x90)
getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000040)=""/145, &(0x7f0000000100)=0x91)

03:35:38 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00]}, 0x10)

03:35:38 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5418, &(0x7f0000000000)=0x9)

03:35:38 executing program 6:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x7, 0x800)
fchdir(r0)
mq_getsetattr(r1, &(0x7f0000000140)={0x3, 0x7, 0x20, 0x800, 0xefc9, 0x2, 0x6, 0xffffffff}, &(0x7f0000000200))
r2 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffb}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f00001bf000/0x1000)=nil, 0x1000, 0x0, 0x6011, r2, 0x0)
r3 = perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r4 = perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000000040), 0x2}}, 0x0, 0x0, r2, 0xb)
dup2(r3, r4)

03:35:38 executing program 2:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000040)={0x1000000efffffff, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="020d0000100000000000000000000000036300b11aaddfa6ec06000e2000000200006ae000000120000000010000000800120002000200000000000000000058007fcba9bd00000000000f000000000a0000000000000092ab000000000001020014bb0000000000000000080000000300050000000000020000f3df0000210000000002000000"], 0x80}}, 0x0)

03:35:39 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x3000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:39 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:39 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000]}, 0x10)

03:35:39 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5413, &(0x7f0000000000)=0x9)

03:35:39 executing program 5:
r0 = creat(&(0x7f0000000000)='./file1\x00', 0x0)
ioctl(r0, 0x0, &(0x7f0000000040)="78f3ee4f1d413a3653f5e53bc5a7333fb448da1e69408429708fa33d629c33078e880f552165e8db2d60719adb6ec71fc77c6fd7c7c45563420ef5e4af2af00cbe971a61609dbc61adcb8ebb15624dd8a7b765dd085f1b24f3caa9cac82533")
fallocate(r0, 0x20, 0x0, 0x8000)
setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f00000010c0), 0x4)
getdents64(r0, &(0x7f00000000c0)=""/4096, 0x1000)

03:35:39 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070")
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047", 0x3b}], 0x1, 0x0, &(0x7f0000000080)=[@cstype0={0x4, 0x3}, @cr0={0x0, 0x18}], 0x100000000000010a)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="f3000000002800fb034d564b0000000001"])
ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f00000001c0)={0x2, 0x0, [0xc2]})

[  403.235015] binder: 22752:22803 Acquire 1 refcount change on invalid ref 18432 ret -22
03:35:39 executing program 6:
r0 = socket(0xa, 0x1, 0x0)
fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, <r1=>0x0, <r2=>0x0})
llistxattr(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)=""/24, 0x18)
msync(&(0x7f0000e00000/0x200000)=nil, 0x200000, 0x0)
ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, &(0x7f0000000080)={0x4, &(0x7f0000000000)=[{0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @local}, {}, {}]})
ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000840)={0x3, &(0x7f0000000680)=[{}, {}, {}]})
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setgid(r2)
r3 = gettid()
getpgrp(r3)
r4 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={<r5=>0x0, <r6=>0x0}, &(0x7f0000cab000)=0xc)
setgroups(0x0, &(0x7f00000003c0))
syz_mount_image$btrfs(&(0x7f00000004c0)='btrfs\x00', &(0x7f0000000500)='./file0\x00', 0x7, 0x1, &(0x7f0000000640)=[{&(0x7f0000000600)="0cb10cd4ae7e7cce7eb4b441e232625670eff10efad68b5acaeee7b4f03a06ee8bdbdaf4fa38", 0x26, 0x3ff}], 0x1000000, &(0x7f0000000900)=ANY=[])
getrlimit(0xb, &(0x7f0000000100))
setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x48b, &(0x7f00000003c0)={0x0, 'veth1_to_bridge\x00', 0x3}, 0x18)
r7 = socket$inet6(0xa, 0x2, 0x10001)
setresuid(0x0, r1, r6)
r8 = syz_open_dev$vcsn(&(0x7f00000005c0)='/dev/vcs#\x00', 0x3ff, 0x2000)
write$P9_RATTACH(r8, &(0x7f0000000880)={0x14, 0x69, 0x1, {0x6, 0x4, 0x4}}, 0x14)
r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x0, 0x0)
ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r9, 0x3)
syz_open_dev$dmmidi(&(0x7f0000000340)='/dev/dmmidi#\x00', 0x0, 0x20001)
shmget$private(0x0, 0x4000, 0x1808, &(0x7f0000ffb000/0x4000)=nil)
getsockopt$sock_timeval(r7, 0x1, 0x15, &(0x7f0000000540), &(0x7f0000000580)=0x10)
sched_rr_get_interval(r5, &(0x7f0000000480))
recvmmsg(r4, &(0x7f0000004040)=[{{0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000940)=""/172, 0xac}, {&(0x7f0000000a00)=""/155, 0x9b}, {&(0x7f0000000ac0)=""/191, 0xbf}, {&(0x7f0000000b80)=""/95, 0x5f}, {&(0x7f0000000c00)=""/3, 0x3}, {&(0x7f0000000c40)=""/115, 0x73}, {&(0x7f0000000cc0)=""/76, 0x4c}, {&(0x7f0000000d40)=""/153, 0x99}], 0x8, 0x0, 0x0, 0x8}, 0xffffffffffffffc1}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000e80)=""/88, 0x58}, {&(0x7f0000000f00)=""/120, 0x78}], 0x2, &(0x7f0000000fc0)=""/87, 0x57, 0x7}, 0x10001}, {{&(0x7f0000001040)=@xdp={0x2c, 0x0, <r10=>0x0}, 0x80, &(0x7f00000020c0)=[{&(0x7f00000010c0)=""/4096, 0x1000}], 0x1, &(0x7f0000002100)=""/4096, 0x1000, 0x9}, 0x10001}, {{&(0x7f0000003100)=@nl, 0x80, &(0x7f0000003240)=[{&(0x7f0000003180)=""/148, 0x94}], 0x1, 0x0, 0x0, 0x8000}, 0xda6e}, {{&(0x7f0000003280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000003780)=[{&(0x7f0000003300)=""/173, 0xad}, {&(0x7f00000033c0)=""/76, 0x4c}, {&(0x7f0000003440)=""/70, 0x46}, {&(0x7f00000034c0)=""/81, 0x51}, {&(0x7f0000003540)=""/22, 0x16}, {&(0x7f0000003580)}, {&(0x7f00000035c0)=""/88, 0x58}, {&(0x7f0000003640)=""/234, 0xea}, {&(0x7f0000003740)=""/15, 0xf}], 0x9, 0x0, 0x0, 0x3}, 0xfc3}, {{&(0x7f0000003840)=@nl, 0x80, &(0x7f0000003980)=[{&(0x7f00000038c0)=""/150, 0x96}], 0x1, &(0x7f00000039c0)=""/134, 0x86, 0x2}, 0x7}, {{&(0x7f0000003a80)=@rc, 0x80, &(0x7f0000003c00)=[{&(0x7f0000003b00)=""/64, 0x40}, {&(0x7f0000003b40)=""/47, 0x2f}, {&(0x7f0000003b80)=""/100, 0x64}], 0x3, &(0x7f0000003c40)=""/168, 0xa8, 0xfffffffffffffffd}, 0x100000000}, {{&(0x7f0000003d00)=@l2, 0x80, &(0x7f0000003f00)=[{&(0x7f0000003d80)=""/185, 0xb9}, {&(0x7f0000003e40)=""/97, 0x61}, {&(0x7f0000003ec0)=""/52, 0x34}], 0x3, &(0x7f0000003f40)=""/220, 0xdc, 0x401}, 0x2}], 0x8, 0x40, &(0x7f0000004240)={0x77359400})
ioctl$sock_inet6_SIOCDELRT(r9, 0x890c, &(0x7f0000004280)={@loopback, @mcast1, @empty, 0x4, 0x8, 0x9, 0x400, 0x555, 0x110010, r10})
r11 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x9, 0x200002)
ioctl$SNDRV_TIMER_IOCTL_GINFO(r11, 0xc0f85403, &(0x7f00000001c0)={{0x4, 0x3, 0x3, 0x0, 0x4}, 0xfffffffffffffffd, 0x3ff, 'id0\x00', 'timer1\x00', 0x0, 0x1638, 0x3, 0x9, 0x7fffffff})

03:35:39 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305, 0xa00}], 0xfc7c, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:39 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  403.349227] binder: 22813:22820 Acquire 1 refcount change on invalid ref 2560 ret -22
03:35:39 executing program 5:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0)
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x6)
mmap(&(0x7f0000701000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0)
socketpair(0x19, 0x80000, 0x401, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000080)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1c}}, {0x6, @broadcast}, 0x16, {0x2, 0x4e20, @local}, 'erspan0\x00'})
lseek(r0, 0x0, 0x0)

03:35:39 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x10)

03:35:39 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5428, &(0x7f0000000000)=0x9)

03:35:39 executing program 6:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5413, &(0x7f0000000000)=0x9)

03:35:39 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:39 executing program 2:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_opts(r0, 0x0, 0xc, &(0x7f0000000080)='u', 0x1)
sendmsg(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000000c0)="ece942520f66f9cb5d3455ef9343a1c4d830361fae06c5daf1aa157258f78d64ed57d0942136b6a1bd1a36ed3c168850cff111861b5ee373e878a4cc920d6685bbb8028da3b9bd90cbab2fee9955585a10a2b9873cace00cfa77aef3f0a5c32f333087539f89a4c51d1e025598a0741f680e11ae171ee29866026100aba802b8138c4bdb629ed4ca3389bdecf6bfb2cdb2462645fac68cc8d913d45f0b25dc4b9a020662a60b53fa14a131aa633dc3718fe71a4e194d5936fc65886bbe2f93a82718f685098a1dc9d048", 0xca}, {&(0x7f00000001c0)="ec789f3c68e98307f9a71924f1f2f69018e6326ebea0c0a9d8b161428e96baaa4c5f662b32340231741871d70497e9d6928eadf758856f3ff3fd9de2fe78ca6240e13c7493039c7dea912abc82e47c5877936e3b9e0669c073487fedcf942cf546394993e324f803c9e6bd3054eaa2692b6e329ddb40398d66600dbb0331c35ed03e0d2d8b9b367d3b0933ded61d10ea0d4d7b5cda1611430af19e337d5adea4a410ee27", 0xa4}, {&(0x7f0000000280)="6a5528cbe6d058cf4779f2ffe89f0cbc374b6f9d1f8843f8558433d010eeccf31ae472481c0aeb6aad13441bbac07d09b9e1fd0f847362f93847668c8d4426070c03e474c66b87407d045dc4cf34ee186629d04bde2d15a9d8e2e23ad698d5ec5d908bf3f6ecbb0e31fe4d24ca7e1d9471f54939885a1b4b6aff8dd0a565ba6ce0d10ceee0407423aad22f551180d912dbef5b24c094242dc40f233a3a018ebd79966a18c706a8d4abf33560bfabeaccbfe48ff38e9ed38a76b2af1183e59cfff4844d730d3a207b208f6ad2f430fefb4b4235ca36f271cd6820c65db2ad", 0xde}, {&(0x7f0000000380)="9ca02d4de8ebf7160c99123a09fa17ceed46e335d591122b0da32eae12548c1136bf49d0cc90dd93cc369b3275db7e14728c8bdf6da3ea8fbd838f7a50b8911e4253a952110800e8c5e7919956cca6cf81be9e30d9e8b51b5847689c75cb623691f58edd1c7eeb10ec29", 0x6a}, {&(0x7f0000000040)="bbc075ad5aac8d8839e4898a9615a4d1e3384200c67d48b3e4453077aa838ae5f3ea2521c8c02e5fbe", 0x29}, {&(0x7f0000000400)="79fa28bdfff27dc543d96bbbd602626df0aa75256a1c4067c0ce87dd60e8f5e2a5ce0e0ff2c6a167f360f43cb45bbcf9ad99833eb6e2611a8442822187e2984f2678976bd59d27946dd3b88ca8177f91ca1a8e98e18042855ca9cd36aeb69bd0db256defd0fe2764002dc05aa7a13b895aa3fbaf73", 0x75}, {&(0x7f0000000480)="32a2aa909dca2fe764c178", 0xb}, {&(0x7f00000004c0)="4fae9cfdb44cd8d70ef258758e8484369ceab05af6d2a908c8bd9c250a891370e5c6590076183c724810c28d8df9e9f2c2172bf8cbaca9b4b70e1439c34796259fc7e168dc4dbcc8d10eaf05c6066694e4f850e2747a9be72c1199d9c9b5913adb50ff9ee0038377735892b4d10388158c71f0f47a4b351b673b", 0x7a}, {&(0x7f0000000540)="85fcdd539bd3bfdd3f063a094b6aaa94238c3f4377c06f877e25d77b404a655ba6371101b2af424874c4b3fba4cb70365fa92bd2df26b5b9ce1d30401be2", 0x3e}, {&(0x7f0000000580)="d1907bbd154fb74e7814ce7618749da68024c6bc3654bbbb06621df2150333cafbcaa85f3e463aae662eb5bb16ef2abf7bad54c20051d7393fef88e51a3bc6684e69c735e974e3c8ab3914a865d0d7bc0fb4aeae39fa9868bd98dccc65adc6e2eb403396ba", 0x65}], 0xa, 0x0, 0x0, 0x4084}, 0x4000000)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='gre0\x00', 0x10)
getsockopt$inet_opts(r0, 0x0, 0x400000000000009, &(0x7f0000937fed)=""/16, &(0x7f000021affc)=0x10)

03:35:39 executing program 5:
r0 = fcntl$getown(0xffffffffffffff9c, 0x9)
ptrace$setregs(0xf, r0, 0x80000000, &(0x7f00000000c0)="d4c3b5b9e5d7d9344f09363c6b6d3b8e6c24f8ddcea0a65d6b5583eec412e7d3f391958223611cfeba7fbe5ce0324af51d404c0f0c169acdf86fad56a713c31f10d7302a49208f7989aa8b6cc3e4b0247cecdeb806869dc8cf6fe7610d512405f1c0cad0777901069ae5b7fbff7d6eaa4a35ae05c3155ae5de4436e84c107139f5fdc5b6578c74c9cf9c4e671c3d8a393476113d160ab581a000f20f58721b6454d3e0759d")
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000080)=0x68)

03:35:40 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x20000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:40 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3e00]}, 0x10)

03:35:40 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5460, &(0x7f0000000000)=0x9)

03:35:40 executing program 2:
r0 = socket(0x200000000000011, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', <r1=>0x0})
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=<r2=>0x0)
capset(&(0x7f0000000000)={0x20080522, r2}, &(0x7f0000000100))
bind$packet(r0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14)
sendmmsg$inet_sctp(r0, &(0x7f0000871fc8)=[{&(0x7f000086c000)=@in6={0xa, 0x0, 0x2}, 0x1c, &(0x7f0000d1e000), 0x0, &(0x7f0000dda000)}], 0x492492492492510, 0x0)

03:35:40 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:40 executing program 6:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5413, &(0x7f0000000000)=0x9)

03:35:40 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0x9, 0x80000001, 0x6, 0xffff, 0x8})
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x0, 0x0)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000340)={<r3=>0x0, 0xd5, "4f37a4a64daeb9a8e7a905ac13541d388bfa5daae94e9bb0e58089a3ebfedb02191ef87ec26a79b1bd1e6d555994ef11fdd72bd776715eef220fa472aeb1e52449bfc86e7f3039dfb9b715ef6a823bf53af8cf2fa5cb8a65d2495180078ef9618cc082c6b5d512b671be06a72eee4b0defc3eec01edb51d92112d9b246dd11ab660ff34dc32a2a976aed6dbb927d75d8ac9f532c21db7ba717a2f866f4245204c6ab24bdc123d466b7698a93a39be28dbc13c36d3dd30a225711a1a6bcf68f0fb6d40fdcbfae207a3afefc61fefcd7d2a564bcb28c"}, &(0x7f0000000280)=0xdd)
setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000440)={r3, 0x2, 0xfffffffffffffffe, 0x101}, 0x10)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ftruncate(r1, 0x1ef9)
r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
ioctl$KVM_ENABLE_CAP_CPU(r4, 0x8400ae8e, &(0x7f00000002c0))
r5 = open(&(0x7f0000000080)='./file0\x00', 0x10000, 0xb1)
setsockopt$inet6_MCAST_JOIN_GROUP(r5, 0x29, 0x2a, &(0x7f00000001c0)={0x20, {{0xa, 0x4e21, 0xb6, @dev={0xfe, 0x80, [], 0xe}, 0x100000000}}}, 0x88)
ioctl$VT_SETMODE(r5, 0x5602, &(0x7f00000000c0)={0x3, 0x2, 0x1, 0x6, 0x401})

03:35:40 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0xfdfdffff, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  404.136558] binder: 22813:22870 Acquire 1 refcount change on invalid ref 2560 ret -22
[  404.227118] binder: 22873:22874 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:40 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5424, &(0x7f0000000000)=0x9)

03:35:40 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:40 executing program 6:
r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xc11, 0x0)
getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x3ff, 0x1, 0x2, 0x7, 0x0, 0x7f, 0x1}, &(0x7f00000000c0)=0x20)
setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000240)=0x40000000000007, 0xfffffffffffffd77)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = getpid()
getpriority(0x0, r2)

03:35:40 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x10)

03:35:40 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x4000, 0x0)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f00000000c0)=""/49)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20013, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
setpriority(0x0, 0x0, 0xfffffffffffffffa)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000003fe8)=[@register_looper], 0x0, 0x0, &(0x7f0000009000)})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f000000dfac), 0x1, 0x0, &(0x7f000000df36)="12"})

03:35:40 executing program 5:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x1, 0x0)
sendmmsg(r0, &(0x7f00000024c0)=[{{&(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @multicast1}, 0x1, 0x0, 0x2, 0x3}}, 0x80, &(0x7f0000000940)=[{&(0x7f0000000280)="c6a958d39c6e518b71bb8f70fc718c4322cf2da1d2de75176909c91b7a2f7d135704743c2dddf42cbd80cb200899c82642bcda0559a64c68928b1648f3cf47bb99a446ae2e2aec99aedddb392a8dcd789a2effd7605e94f336c8e9fa334768de1c7b2b16e55fb5f30321c9ec38d76e83784c1dd4a5309be185a414d0389cdd1d47c45b5625253a1371648ef69e416b3950d9cc26218dcef322b4b4f2d515a17c5c993795f4a5ffa1a320a87173c79e7bf9bd49368039cc8d83530258b973cf89e24ec4ac9c4d23594354f0fa639cb1f2d9ceec2d803b1d9b6299484ce89b5733832d9e10", 0xe4}, {&(0x7f0000000380)="e27c805be4db54117ab504a96edb59463b376b98ef90977283285663eef7ce6d63a8eebf1905dfc133a0b92d60c25d2f11ec6eff77a33469ae604e45273f43799a6ca678c09d2a56ee2b34d13f73398fdbf104902630dcba26334962d0576de52d95a457a11e2ff6b8", 0x69}, {&(0x7f0000000400)="3e244ece76130a37e8c0433519ddc4f7779a2bdd1ca7bb6446b1fab81674c85ceaf4b930bd5e499b794b9c13a190a30425859b00ce3fcb345d5c5e277578116200b58de6bbdfc0df45d6556c3fd4f1c4da62ba6ed802b8019b703d36c4d1c9113675375e9e9e4b1a58b4d993488642b1245dcdbe0da23816592ef44c881fe2ffb7e946fcb2e385ce1cfbb3a33273d901e18224a2de6ec0537d448677f3980148097dd1619726dfdc32063dfa9fd158458214b93e658e", 0xb6}, {&(0x7f00000004c0)="cc8233ba55c96c1ab9aeba1399b7570c29a0ef02fb884b1b28a6f4b10b469c45f8f852dc8c9a02dd4c12dedce2e84bea72d98454b530002f22bdca1cf3859b34f5d46c922a96e20a9e38d7c7f180e8e8fe11a591abdb7f170f11c0bc1f0285c6c659bcb5c15c009425196c09533410c42d622c29352acbccd027219725ea1bca669a5336dbc8d360df2bde414d37d1574ba6502d6f3112b5a8afe4b7d3558d9ebb7f01e23ab86e20c3b1c31803cc3881eb95a3859ea3ed443d4d5b961392a16ce345ecb001ccff8ecef902fe5aef27dc2b2a669029a667a75b0e0e6b36c554e95c1399f50e6bc3b2cd07a3b171d29175076f199b196ff49a7f9f72766038", 0xfe}, {&(0x7f00000006c0)="84a47a04991acb168eb995f30bf311ec01253ba689deabbadf664b0736f3fbacfc24038cb4ee621a0755262fcea7a8358d45e1ed34c01d307b5cba47bf5f69a6ce4e2d96ce6b34a99dfe1710582bf13324866bde1652ed45f89607442b996fa80104f066c44c94ac78d16ff0cd0c70853e6a8d266321ab45bb645ce6a4bfda8985cb8d8218615e9c0c4460b07316eeabf096770e5c0e1136303698c36fe3db29f869d547e6dde750daf77d5acbdd8c765effb41ac0ffafe5bbee8fdfc0be307f32e54db9f966ffd838f77e19f55d2e1bb780588e41a4d124136afad13d252385398952dc093b08685de9f5c94af7a59ac0b17fd8c9ff309e1587767bb329d3", 0xff}, {&(0x7f00000007c0)="44a5de6ce2812b10b7fd1014ab5322b35d37c38bdbccef745c77a295430a6b1bf671c4c66cdd63a42562fdeabbc117a7b0c735ff8def439c2bf8059e8ffa257913bcd486350927ad4dbd516e9e3b9bad0c49cd6827b0b7be563c7d9ff229bdb65740c0a7826da6f4b3a9a0fb82a59848f106ecee1067bc526d837b376a51697e90461ac166fff75899403eceefa94d620a1f43b31890815ad66054360e4be47f5c29a1a53e19b06e07fe894457cbda3a9dfa812265f5f7629bb39c5c51a353d01bb47677c093d4fe28f8e213d1835ee25f0f83e3c433d0ff5a8ea303102794b60bb6345614", 0xe5}, {&(0x7f00000005c0)="4ff2ab47080f7c6e2b8ab6c20d1bf0b11741a0c81ed8956119c194ba903820f34fd8a07948ecaabfc288ca44815a27be796b4e11a3b6173768a00e398f8a699be9775ad192bc20359582869a6a2e133972b29099c33fa51e2a40a5d5a1c33fbc4a3fdc69d72f04029593afd6437bcf89c61fc31e89389ec0402711e2e8333e3f7053494770b1df2be2f1feca9f533d4c0d40badf94f72ea2bc4b7dbada502a6f12799d5223e09fdfae5f7e7adbdf967b", 0xb0}, {&(0x7f00000008c0)="e1ff9e3795789c90a0eeaee8c22e7f72e7b9", 0x12}, {&(0x7f0000000900)="426f6beb3b3ff492841146764c2923b3ffcdde2b04bfcdb6116dc8d28b81a9cdd6e1bd5d421897", 0x27}], 0x9, &(0x7f0000000a00)=[{0x80, 0x103, 0x80000001, "e128e442614014600a01baf2bc182b2d1a1343684a35e7e8b61b2be43875d800d19c9ff56ccba8949b6ca6ab4ff460cddb54b9401ddbe2deb76038786cdda51042c3ab80335fb5f785436ed1d1cfb7c12f4fdd60af7c05e34898f7b5425abee85e90d573967022677bdb9169d965d0"}, {0x58, 0x11f, 0xf94, "3b721cb9c4a7df40c330d8c9dd5b511e78ea9cbdb423b29be8f6df8b7b1cfa2153b5c4367db7e1716f3ea59b560fd55283817d47c994c79b0b7f3be11e0619f26b3305b0e406"}, {0x58, 0x108, 0x0, "84e55d08155fa08085bcef87aba9e4f8c7acace3c2613879c4f01747abc94c47bee417f2d0357364db4c4dc3ebfa3654720478037e96195ee97999dc8b4b3cbd1349b3"}, {0xd0, 0x19f, 0x90cb, "3de572fa72f6be7313d382f30295ecce665b31f8bd49fe1f10144452154d141c03dbc1cb31bcd74e3cb5932687df5033b9439b8954966687db6df58664e211ff6fb12b51a774246de475aa6cacc624aeb2c32f9ab426caf3276464aaa7f6c5b12ce43a037d3d6a1e731080f377e083204b8fd4d48ee014c3f22cb17a26264f0c29f6ba889cabb0b27ca8ee20f34ab62993020902e541743916f85923418686df067874576ae6209bada24177807f6dcc648c30ed893b99146b"}, {0x70, 0x11f, 0x7, "388bd5c7eac5764c3600ae45ba7fd0ab3fda6b08933b9ef143faa586de789e70a38adae4b3f17e53e215126d70ca78371421c3d84db438617e04a3432dff2e356852754228b194c351d66d602f890f96ae72c49c9e17934faa1303b5a0f2dcdb"}, {0x88, 0x11f, 0x6, "127763b98cc501be1edd7868e91f6493c445567b11af92b5f58038eeae17f8e825cc5635e0eafd6eb5124a621891cc424e30d546041b2ac102b81eeac5d1a890e445737ce91b0f2eb5d42b74aa403818d0d343a65fb0cb85217c8fdad6a354f0718eb13ede056e9adb38c39489bbd9900fde9a6bbfa745"}], 0x2f8, 0x10}, 0x9}, {{&(0x7f0000000d00)=@llc={0x1a, 0x5, 0x9, 0x400, 0x81, 0x2, @broadcast}, 0x80, &(0x7f0000000e80)=[{&(0x7f0000000d80)="3af9cbae8edb", 0x6}, {&(0x7f0000000dc0)="f61ba08aacc9eee11fb5f8256b024eb0be8c15b8e6bbd7c240915db3808ea9a4cc50e7f62f38e85ada7fd41b1611e76448beabbd4dc01e8528ff1d86dadf4d4a3ceed49457248a50325046d1bb5ffaba8281b50a63851e78de01eeb5c7d6fce89ebff655ab728e7985c610ee03aef649d94a71b31fed2ca437da4905545c534d24e784b4d2", 0x85}], 0x2, &(0x7f0000000ec0)=[{0x1010, 0x107, 0x2, "fdd0f0a914df4fe7f8287446ed1f44232b3e0555ce6bffe1d58351af772f533857c5c1db5c0bc4ddfa7cb45a27d90ce78b397aa7e071ebd512051bc33626634beae44548e58ab8386d9cc0aa93c036b2cea948db0f25ba5507aedac585456ee44378571336dbbf48ab3e6569f2dadfa880e43ed058ab496c2f31b4534a3a8b07029f09c07df77f187522befa0bad7788c6b7e638f96d41b6c8b906b51e66af45516f915e76aea6b5be66afc2a452aafbd0de86f0f9a15f2f59f8037dbf65b41435026420cb57d2cf0ab220f21095cb034dbe20a74e5e2ba45756a05f5852b0e19c8f3e4938c184fcea503f48022472ce978d82d33123916fd236087e6ea7d19575d67c4706a9026797ddedf0ceb11191f21563405428e20488ea044f0c824b00a07d6be1cae9084c58e8fbb56903f555f775a23944452a2971bfc10ad538889f9c80bab3968e89e4bd38d271f9171060baa0f68faafd1c857bbbcc96f097dc6074d16266c5d4f763e5ebf44e416f607d12f94c8387e11bf8617c11a80f528aaa2da260ceaa2e4f9d5ca1bf66922840faa2ddd8cd5407b258a885015866ca54bc6cf71f152d9d480b568bc20eb8e537161c712e8c9b9e0e554552caa98d89e0628826100bea59a89a2825a6925814ebab2fd58c11eab939f28502d88cf45e46898f6277066226206c36b50a20ee02f77c3183856d82201b5f7cbf6c5659ea89bb8d424ad09450a8ba6ff0bce35dbbf10e844a6ad36c90f935b8deaea850c86c9412a820c6c672a0c106779fcc25096aeac097d3175459638e1269d6fe635f4dcfa06929c22770ea6103bbc416662886ad8721358d479ef7dec2185811beed6b0e31ab490a6ef9e514adef02bab535ba079f792630d2c4b6cde6379b6b7e95a7b743d4d5a88e4cbf167515d638821b3a15e4a84a4040960462a37764f68cf5742adee725bd570d3f1ff5693094199c7d2265b5d22e3be7f250ba3150485326c97b8e738465685be7b993aabbbd836d326146c7f669b733c5d7cbdc78f0cce41bed4a38960a0869d1ae1543fde3396be70c40769b7173a4dce9253c6a28879d4749ecc3e2fc1c29d6d9c62c8211a804e6599913334472f37f02b2726d7b4912cf2610e96b352b3f6003e7d9d1bf3e1bcbba53324f6e24f117f817a7d6f81fd5eb0779fee10bd8d9564dde51b2d922d62ee45c223c5be5b9e0bd980c3a32bd38befb8304683b364a068ebbb00826c3d07e5d2495eb9d3251fe6dfeb23f0f3c01355b850b5bf119da110fb5e1ec046f73ea9f2de50e19eeb97631d5371fab710abbd6969e5be0cfc97bc19a76e95e0e9c562ecad476d0bb7392badbc1ff202cf5fdf1f3c71c9803324ad83cae7f91b7b3a4dc74dbf70b4684544935a452cb0f0e176003a795a19806d121798b420b180cdebeca2205eb11bbc27a34179c63ae8e2753045f8cc80ebcaf3374e74a220dbfb363ba1b507d9b2b7e1b2c90d50f9a89676e80aa1f1e9d1b8ea8275904c69035bdfffc9dfa55ef6432e606c066c51e84a45b1dca39b294455d4ead22c7c4fa16521d8aff6c632cf338d20d4ba80cc4ac91bb27a7f3d0ab8e744fad54f097eeaf464246eed7d5cc307fbe6d6a5958ee30649105445cb110d31204e59d7f6518a7ebf5f25822af4b7c6823798cdf5063bd428a0857a7368ad81b7aec9a4d86d4f7b842f7cb2ca37fc6a73dd9f288a74b79ab87d914dfe5c9a08740aade7cb555e7fd9d6b1af7ee5dbaff3110d71afd275f6be7b04a848557069ac95f0bddd4e64924fc084de7d5389c687599de81cf008d37bda5f0e05df851dbb7e464abb6002bb08c08d68ec7af010c6965c42f9e49d73a42d73f80b8d983e512c5e84d597ccdeaae357613d75262f25985a049d1aaac22073892a703bfc113482a03a3a0310591e5d2b83cac56712e838a174b4f6142603fe06dfc898c02ccfeff8f5c5010aa052bcf5aeb66c42b9127c21bd03aa9bed6572bb22303142d3367983f2a9773baeab8c355b281a327cb2aabbb969e3a03ae65f4d364fa88a2ca47752c65022691a19fad44b38def6a95b38726cd0bbe93f33c46600762ed855563ede2184b78cad7cf1cc5b21236c70e86f2e9edb9b68b4282a8c60b11c86ecab413fcdb897111fe99cdbe64723ecd376f007eb74fdfa220ba9b642eb69fb35e02eb823c906c56bc01921cc09bd08b0cb679e385d7abfd1da354246e92f9fad94818e456e752edb4af1dce4ac73c2dcd1ab718b35d68942dee55cb18acdd23846ce4c8ac62dd886aed2a3e7db9be823c475fc667512e595895445e804b6805a5a26ad53a580e15a61a5a30ea98b50b1df88fd49ef7da781885d5ef79888152d3b980c7e1606f67bdd2f42607136747133927fe05481c18160782fc0847c60075784c737f90b58d203965613790edc074d7921d382aaeb74dc946a1155e1c64ba420877bebbba05d53a2a1e35d4926d44c3ce463b077cdc5bdd137877c2e649ccf323714f0561a28035dbcb75578d31924340f24d3e47b49c06f075f4ee4a5a4824094e058c4798e51886c707ad7d47f137f57329880917de951571028a3c58cbb695f699dbbea89b88bd4b13cc4df92be91f32e27d46bed564f9a254a2cdd6f62c2694ed9aa68c91353b3ca1504846981d4b6697acef144610de0b9b760a993920ac0a7c677ddee6616cd325304c756f0a679a74833048577d5adae9c41c9a1ee3e0dd2e1bc4c5264efce9c6cbeb74ac585aca988b0c926ff6649c29c7d47a8f3d3dcb9e364dadfde8c0bfa95eb8f483009097c3e1d215cc01a661eac493babf7466ee6e49d4b4e21c243207da8aae8c7c5dd9b26879905d01ec4e214a01c6d5dc02f8deaec266941f33c6f91aeab17478afb9108a090f0774093fc5fdf95778086fa6f573d0e853494ba302e459e00dcf4bd759c31f3bd52c788d29f533d2aadf1a0ebfa252e1e6fa5bc88439524adebea082af4f66012b444fc95cdb3a17ae3fe6fbbc538f4557a2235d1493700546f7abdee3cd3cc6462c996af34003a649849f87f60303ab16d82c9ea66c011650b30432e228659a823a85db661f2b26be87efbd81c671e4f7754ca4a125f1e9b4d5fc933a96b0f1b37b1a1495a3ee6fe19020062c7614777f9a34e255e84910c2ee03a41dcc90a5434246410a12645d97eed6cbf0d1f67930263291fa9fd0b0b34f4805e549c1ed3ab80b9dbb892d5d670d433e3a21cf37635127f46189911400fcda0740fbc7d86e171c3b0dbf1b602ac1ec2e4ac6172a496dd541d0b3be6e2f0b25a7d1a32b1db29aea61021f49132216460a9213c9f575004aae61bc627796792655153b7eadbefa72d28a6a821f3e0230ef8810f1e737070fc421ea0dcc5bef31343903072b4c4817184b5fedb82a5045b06a2b6621deccf3a1177188f4de3ef7c910001be1412c4a2f29e2c4cdcde5a99d0da1d10123408698a7b3195710ddb9d13ac8854749f117a0476ffce815db69ea2de1234127efb8bb65ddea878d2cf6b8b31b8b5a875da5cf58608283316ff9800c9aab7607b0156c715788d468fe894b4f211a4ef68a011b55163aee94942c7720aa0ee73c36a2d268a6fdd9b6c1d7dbca46b33e2dc8ee51bc360321523ec8793e8da8c4c02ed7c69ac6b49f60bb58af101ddbe42befcfc006636e7ee295fa94f1a5570e39d6ccf23c8ccdd68f80eff9720ca426f6624e6cf86383375398710404d7a213cdf1c06cec741bf697edbc40799120f95c4147d5c21b4285d4ca9627a709ec5b7498ec1afda53ffb8776279e748a663b4d575a1d964a4332d3f84db66b62e101dc9cf4ce687b2da38b6d6858ec74a2fc45720ae374e2cac796f6d97625ca0edce96c4e2c34b87543dfc0b94db76aa86a6dc159abfc6884330b2db4ecbbb7c7a132b4fc4b3c5a77d33635a1dba872352db08c8b7c8b9c7d465c57bc0a12c00612c3432fa34146ffefc39127670dd19bc262574b37755716de6ad6c80352debe33d861aa443a0547c60f56e2e645ce33ec070770e1d8ff244b8d3786498006960c0b5d80c960d61421cd2b9bdfddb29391c64573877b6aea34e3d3bf291a424308781e56b0f58a7883342e9fb2ffcbb0102be92dce2c08d446b7841b070691bc69663183178981897191fa7267cad3269ef55ff9ee3947b86111ce80b9b23d7fdc3b9805bcdaf9c2daacfa4d62f2ea10a0fb4f6e7f38ea9b6ba5bb5df069de5bda0455362bce81af26b6c72a12792df55a2401859a8b21719f93247024781d8c87366162711c845d627202f7c4edd69808ce7ce3262e012744b9e0d2af7c7a73586e3725332fa5f38d241528f7d397084f03dbe477123e2e15ca2d7b55493112c3b11a12b01560dea40b608f7b1fdd3845907e3103a5bd89783508d6ef81f1443a9c1d73e13961d38c4a1683d56b9b548d970c79d6e09ac4a9b5faa2bb8aec99cfc86917dc2e7943a0f6baae8970ce8171d0667013e6f9abcac1fda8de40a890713f03afc794e0a7350110332b24e275e85835f2897bf7ff6c078b8f630c22e16074c251367b071d47e200c8f2c65663763e8905fe205d3116721dfe513a94fedd91bcbb5bf353e1325862fcd68289d8b81c4b2af946100784f04cefd21c658969f2101c823fca1cf915bbc3e4afdf59dade917ff9bc60b7315abfb96226ced875a5c24a4ba25ba4b3b22139bf231f76b8cb781b9a15fa6c8984fd8c4ec1e173f1bc5207182f88810ed5847a33c0f19b80840bc60f199994ead1bf4d4a32e77e6bfa8dca6e5d1c90c0add6e47f61b61ff5c72899ff7eb6a72fe30621959671ad18d0c6afbb1ce089883add62b08d25aefc2713a08d344558ad77bebe01682e0159d37babab192ec0ba20a4e3eeac74959778afe588c6b92c356d885ab432bbef8146d9ff535f9019cd98a26b6c16a0b4a8a6e84acda0663b001ba12ae2350a5edc95953afb8898e1654412d0fe1ceba42ac7be8ae764c89a99b7746903683ef23fea9f62b37ad082987e63b4b9a643047ec9ecff55caf82c2ec8967575222ebb9472e44e59f27e3a632ba822ab4d376fd4c4144282363dc74a6f0f12a29e7ffa7b0d01a4e91bc4202351af0f057bb63c98f341ed9239a128153346a9f3514c78d2e1e77ce39377fc06edc8833a21cbef4de7deb3f86f85614aa07f8561f9d40f8d2ded5bc8a47243cb450cfdf52c9ec0b0f3b43ec2f94bf554b5b633abe19fe85f1739c4b6ed13e9630e063adedea07492d7057e5068a2a6f5c3f79364dff0af32b4ec911ee99a45764cf05ec54f8649868dbfafdfed2439cec83a5ef558b0707d11bdc57846e40632bbca2b9ab1b67b2f4306a821f53462a263ecf010a7ac5ce42d77861fc70bfe9caaeaa08ee6de264b74dc28deab7a3d8a230ec7c0dc88a479411b227b5ce7400e2f90893bcb86a5f91e78e26eb62394ad812af95d3f4c1500907f7035d618701fac6be6942b763716c638fbeafa2348117040822c6b04202fa90fc42d5d569a3dd1f62b58d2aa26576360e038444ba857c6a62baa09fa409510322956541338136bd93fa981708cda06488770c311fbc7c8d25bbed7a0907d03facd6d4a7b5acad830eaf39c7c206d6bde49dd5081fdbb225b516cc55d0c6e20a173dc6df96253cca776f41bfee6765a4dec0fd491ca297c6e85f437fd9f1a4d3d7accbf77ad74ac2aebeb1b07ac9791b24bf9be9e917ef079cb93c8b3104eaaeeb2c14fb5ef834746db9d843c44d59312004cd8f4416b24059fd249d55f6d24742f886ec448d52c8e7add6191314a628b"}, {0x58, 0x107, 0x1, "2a623b8e58736b069889d9bf51281648e476dcbf1a66d4fe71b22794156f4ed31eb521b529ec76bb7cbcc77524fa286f7083e91ca9658e25898562d4466c4d878d3f993bb1"}, {0x10, 0x11f, 0x9}, {0x10, 0x116, 0x1000}, {0x88, 0x11e, 0x10000, "d8d7d774133884bff08d060f73918d1182233c3f154e0254e7c1dd544c88ea84a6967337b5aaf44cd49ae261ce4403d352096fc82a8c1364b5169181185c10367a63b293f8ae92ce8b007418b4cb622bdfd6cc8b0367c4d15568390da702a0852a57a9333d46e854293f1b63f5abb27adaabba8d336ef8"}, {0xe0, 0x114, 0x101, "ef59935ced2cd4531dada893100f8b84d38dd10e430827032fa7e7cba325dbf32474c159a542377a689f693becc6b061d0c3a4c8a454453a2ee0fc0d5d1234a3552cfa692afede0797f0f806dfd53de5d7b113e9c4053e24c2766598b4f35d8238d32d875d111d2071f74b2b30fff94691c5f6795f8419888c79033b0a130912a8536092b1d2d7952bc67ef6a58ef90543dc9443e293831eea5da9b162843cdaf6e6666cb26335200528fda44e91af509f6e784aba26762aeff69ae2b0dd12fc8ae05505925beb26d9a27d"}, {0x88, 0x114, 0x5, "b18d9bf84bef727fa49315d27349ab71d2a21a32b9bb0a6324fbd6971d063fab668ac705ac15c649785af0cfc6b974aac845ae34057bb248e7fce27702ecf8ada92aa7a113955a1c3f3bfb769fdb3a689ff65321c1ce3866bb1df06ebcd785100494f4f8c91d8eec8233a14de60c07795cb6549212"}, {0x40, 0x114, 0x0, "8c678e9e2e66765c39cd336e501b4668e25e4b4fed02055b5fc1490d661bc762366816b6848926098125eb"}, {0x100, 0x2f, 0x8, "86fd2c2bd0208258e6c6098248dbbe4e50a882466bc9892174b3607e5f8bf9124374e30c85a9f089628426ffa7641d09d884d7d1a337e32832183c7cf30ddcd7bd0b5441052e59ef2506ccefe13c8d8e5cbed7cb57feba69ad4e8ba834a21aa208be80009027b651128898adc5ba64f7870543f5e7ca914acfd2b134f83b24aa677a59c91cca636098f145870e7e5c3fb61dd8c27f6260940bfb9a8b7c342b1bb9c761bd471e11c802a242ff3af45e8c2e69d0d9ebe67599a2f91e6d642dd30f5cbfc941665dde5bdb197aff3b81e73e7a318db0c5b52da1618187799463f24b131eef49ddbef224a818762566"}, {0xf0, 0x10b, 0x400, "ab4d30ed2890446eeb9be4f8d3323edf277fb319cd830b893d04c4d885e030348026e2553e49af621ca8ae60d3889d24839eafbb89a90d97ffe22b285d8f0b8311c5848e0024b008d09c7d75ed29919c000d956851c1475e540f41014385987dc2b9d1b955dab47c595003fe4542916d3cb8c00500b16fe384cd01ad3879f44a10fbdb692084a99286961b31b8471c6b5a6f6514a0015c09a72fc6ee41eef6d7e3f9a535e134fdfda5119a9be62f704c18182d760b2c4705505df18411ad1414a15427184739cdf5d4c27e92a0e2a584f72b337f242208419b572da5"}], 0x14a8, 0x1}, 0x7}, {{&(0x7f0000002380)=@pppoe={0x18, 0x0, {0x4, @empty, 'gre0\x00'}}, 0x80, &(0x7f0000002440)=[{&(0x7f0000002400)="05e06d3a", 0x4}], 0x1, &(0x7f0000002480), 0x0, 0x4}, 0xb23}], 0x3, 0x4000000)
setsockopt(r0, 0x4a72, 0x21a78f53, &(0x7f0000000040)="762ad32669b93481ac397d2b290e3053d7b849573ddc3444b9f1319096ba86cbd471c775a092868a8a89ed48b775e90e78bb8943eebb2795dadc00c8aaf94b79b5933021d5bfa3352b9f84888c686b89d6daf1f3cfac1376d59b814f15966274d8a6c3a8ced6270e07b337755e33a3b71baa3e2a0afda91486503250f0bdfc5fb2ab581f4bc0de8f7e6b4a620b475dc760e94429bd57e8f1624bcc1bcb4af3633ae0d6fc1cc718", 0xa7)
ioctl(r0, 0x8b0e, &(0x7f0000000380))
perf_event_open(&(0x7f0000000180)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
geteuid()
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000680))

03:35:40 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x541f, &(0x7f0000000000)=0x9)

03:35:40 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000a00]}, 0x10)

[  404.468911] binder: 22909:22910 ERROR: BC_REGISTER_LOOPER called without request
[  404.527771] binder: BINDER_SET_CONTEXT_MGR already set
[  404.530401] binder: 22909:22913 ERROR: BC_REGISTER_LOOPER called without request
[  404.550856] binder_alloc: 22909: binder_alloc_buf, no vma
[  404.556597] binder: 22909:22919 transaction failed 29189/-3, size 0-0 line 2967
[  404.593607] binder: release 22909:22910 transaction 112 in, still active
[  404.600718] binder: send failed reply for transaction 112 to 22909:22910
[  404.603825] binder: 22909:22910 ioctl 40046207 0 returned -16
[  404.638994] binder: undelivered TRANSACTION_COMPLETE
[  404.644221] binder: undelivered TRANSACTION_ERROR: 29189
[  404.649791] binder: undelivered TRANSACTION_ERROR: 29189
[  405.006101] binder: 22873:22937 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:41 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x500, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:41 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:41 executing program 6:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_UPDELAY={0x8, 0xb, 0xf}]}}}]}, 0xffec}}, 0x0)

03:35:41 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0]}, 0x10)

03:35:41 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x40049409, &(0x7f0000000000)=0x9)

03:35:41 executing program 5:
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
lsetxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000faffe7)=@known='system.posix_acl_default\x00', &(0x7f0000d48000)="0200000002000000fffffffffffffe0100000000", 0x14, 0x0)
execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)=[&(0x7f0000000040)='\x00', &(0x7f00000000c0)="0200000002000000fffffffffffffe0100", &(0x7f0000000100)='/posix_acl_access\x00'], &(0x7f00000002c0)=[&(0x7f0000000180)="0200000002000000fffffffffffffe0100", &(0x7f00000001c0)='system.posix_acl_default\x00', &(0x7f0000000200)='\x00', &(0x7f0000000280)='system.posix_acl_default\x00'])
r0 = socket(0xa, 0x0, 0x5)
setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000340)={0x1ff, {{0xa, 0x4e24, 0xffff, @mcast1, 0x401}}}, 0x88)
mkdir(&(0x7f0000000300)='./file0\x00', 0x1)
ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000400))

03:35:41 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = dup(r1)
ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000040))
openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x400040, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MCE(r3, 0x8004ae98, &(0x7f00000000c0))

03:35:41 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x7a, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:41 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  405.113885] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0)
[  405.135893] binder: 22952:22955 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:41 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5421, &(0x7f0000000000)=0x9)

[  405.192136] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0)
03:35:41 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xd000]}, 0x10)

03:35:41 executing program 5:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080))
read(r0, &(0x7f0000000180)=""/11, 0x5)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000))
r1 = epoll_create1(0x0)
r2 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000380))
r3 = socket$inet_dccp(0x2, 0x6, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
r4 = syz_open_pts(r0, 0x0)
pipe2(&(0x7f00000000c0)={<r5=>0xffffffffffffffff}, 0x4000)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ip_vti0\x00', <r6=>0x0})
setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000240)={@loopback, r6}, 0x14)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100))
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000140))
dup2(r2, r4)

03:35:41 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58)
r1 = accept4(r0, 0x0, &(0x7f0000000040)=0x31e, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0xa, [0x0, <r2=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x2c)
getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000200)={r2, 0x401, 0x10}, &(0x7f0000000240)=0xc)
r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000080)='.\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r1}})

03:35:41 executing program 6:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x800, 0x0)
getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000040)={0x0, 0x6d3, 0x6, 0x3, 0x7, 0xdf, 0xfffffffffffffffd, 0x1, {<r1=>0x0, @in={{0x2, 0x4e23, @local}}, 0x2, 0x1, 0x100000001, 0x3, 0x7}}, &(0x7f0000000100)=0xb0)
getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000140)={r1, 0x503, 0x1, 0x7}, &(0x7f0000000180)=0x10)
r2 = socket(0x40000000015, 0x5, 0x0)
bind$inet(r2, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r2, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r2, &(0x7f0000000740), 0x0, 0x0, &(0x7f00002b4000)={0x2, 0x0, @remote}, 0x10)

03:35:41 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:41 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x541d, &(0x7f0000000000)=0x9)

[  405.929445] binder: 22952:23006 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:41 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x4000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:41 executing program 2:
r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x9, 0x500)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x5, @local, 0x4e9d}, 0x1c)
r1 = socket$inet6(0xa, 0x2, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000080)={{0x10001, 0x800}, 'port1\x00', 0x10, 0x400, 0x6000000, 0x0, 0x9, 0x8, 0x9, 0x0, 0x4, 0x80})
setsockopt$inet6_int(r1, 0x29, 0x2, &(0x7f0000000140), 0x3)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x10102, 0x0)

03:35:41 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2f00000000000000]}, 0x10)

03:35:41 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:41 executing program 6:
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000100)=<r0=>0x0)
r1 = syz_open_procfs(r0, &(0x7f0000000140)='attr/prev\x00')
mmap(&(0x7f0000000000/0xae0000)=nil, 0xae0000, 0x0, 0x4d031, 0xffffffffffffffff, 0x0)
tee(r1, r1, 0x0, 0x4)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r1, 0xc0045540, &(0x7f0000000000)=0x401)
pread64(r1, &(0x7f0000000040)=""/8, 0xff5c, 0x100003)

03:35:41 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5412, &(0x7f0000000000)=0x9)

03:35:41 executing program 5:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080))
read(r0, &(0x7f0000000180)=""/11, 0x5)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000))
r1 = epoll_create1(0x0)
r2 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000380))
r3 = socket$inet_dccp(0x2, 0x6, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040))
r4 = syz_open_pts(r0, 0x0)
pipe2(&(0x7f00000000c0)={<r5=>0xffffffffffffffff}, 0x4000)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ip_vti0\x00', <r6=>0x0})
setsockopt$inet6_IPV6_PKTINFO(r5, 0x29, 0x32, &(0x7f0000000240)={@loopback, r6}, 0x14)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000100))
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000140))
dup2(r2, r4)

03:35:41 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x6c, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:42 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:42 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x4020940d, &(0x7f0000000000)=0x9)

03:35:42 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000005, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000000c0)={<r1=>0x0, @in6={{0xa, 0x4e20, 0x200, @mcast1, 0x9}}, 0x1000, 0x3}, &(0x7f0000000000)=0x90)
socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_inet_SIOCDELRT(r2, 0x890c, &(0x7f0000000300)={0x8, {0x2, 0x4e22, @multicast2}, {0x2, 0x4e21, @local}, {0x2, 0x4e20, @multicast1}, 0x40, 0x3b, 0x5, 0x400, 0x2, &(0x7f00000002c0)='syzkaller0\x00', 0x5, 0x7, 0x3})
getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000040)={r1}, &(0x7f0000000180)=0xc)
r3 = socket$inet(0x10, 0x3, 0x0)
sendmsg(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000880)="24000000280007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0)

[  406.039202] binder: 23012:23023 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:42 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000]}, 0x10)

03:35:42 executing program 6:
r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x111000, 0x0)
r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00')
getsockname$packet(0xffffffffffffff9c, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000180)=0x14)
accept$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14)
accept4$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14, 0x80800)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000006c0)={{{@in=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@dev}, 0x0, @in=@multicast1}}, &(0x7f00000007c0)=0xe8)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000800)={'ifb0\x00', <r6=>0x0})
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000840)={'vcan0\x00', <r7=>0x0})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000001ec0)={'bond_slave_0\x00', <r8=>0x0})
accept4$packet(0xffffffffffffffff, &(0x7f0000001f00)={0x11, 0x0, <r9=>0x0}, &(0x7f0000001f40)=0x14, 0x800)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001f80)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@rand_addr}, 0x0, @in=@local}}, &(0x7f0000002080)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f00000020c0)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002100)=0x14)
getpeername$packet(0xffffffffffffff9c, &(0x7f0000002140)={0x11, 0x0, <r12=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002180)=0x14)
accept4(0xffffffffffffff9c, &(0x7f00000022c0)=@hci={0x1f, <r13=>0x0}, &(0x7f0000002340)=0x80, 0x80000)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000002380)={<r14=>0x0, @local, @multicast2}, &(0x7f00000023c0)=0xc)
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000002400)={'vcan0\x00', <r15=>0x0})
getsockname$packet(0xffffffffffffff9c, &(0x7f0000002440)={0x11, 0x0, <r16=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002480)=0x14)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x14, &(0x7f0000002500)={@local, <r17=>0x0}, &(0x7f0000002540)=0x14)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000002580)={<r18=>0x0, @rand_addr}, &(0x7f00000025c0)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000002600)={{{@in=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r19=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f0000002700)=0xe8)
recvmsg$kcm(0xffffffffffffff9c, &(0x7f0000005e40)={&(0x7f0000002740)=@hci={0x1f, <r20=>0x0}, 0x80, &(0x7f0000004d80)=[{&(0x7f00000027c0)=""/169, 0xa9}, {&(0x7f0000002880)=""/142, 0x8e}, {&(0x7f0000002940)=""/186, 0xba}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000003a00)=""/194, 0xc2}, {&(0x7f0000003b00)=""/131, 0x83}, {&(0x7f0000003bc0)=""/9, 0x9}, {&(0x7f0000003c00)=""/134, 0x86}, {&(0x7f0000003cc0)=""/184, 0xb8}, {&(0x7f0000003d80)=""/4096, 0x1000}], 0xa, &(0x7f0000004e40)=""/4096, 0x1000, 0x1}, 0x100)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000005e80)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000005f80)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000005fc0)={0x11, 0x0, <r22=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000006000)=0x14, 0x80000)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000006040)={{{@in=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r23=>0x0}}, {{@in=@broadcast}, 0x0, @in6}}, &(0x7f0000006140)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000006480)={{{@in6, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r24=>0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in6=@remote}}, &(0x7f0000006580)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000065c0)={{{@in6=@ipv4={[], [], @loopback}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r25=>0x0}}, {{@in6=@dev}, 0x0, @in=@remote}}, &(0x7f00000066c0)=0xe8)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000006800)={{{@in6=@local, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r26=>0x0}}, {{@in=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000006900)=0xe8)
sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000007140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000007100)={&(0x7f0000006940)={0x788, r1, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0x174, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x100000000000000}}, {0x8}}}, {0x7c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x4c, 0x4, [{0xfffffffffffffff8, 0x4, 0x7ff, 0x5}, {0x9, 0x0, 0x1, 0xfff}, {0x3, 0x1, 0x8, 0x4}, {0x1000, 0x7fff, 0x5}, {0x6, 0x8a, 0x54, 0x6}, {0x0, 0x1, 0xfffffffffffffffc, 0x4}, {0x401, 0x7f, 0x6, 0x800}, {0x400, 0xffff, 0x1, 0x10001}, {0x80, 0xfffffffffffff15f, 0xfffffffffffffffc, 0x4}]}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}]}}, {{0x8, 0x1, r6}, {0x158, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x80000001, 0x1, 0x5, 0x6}, {0x80, 0x3, 0x4, 0x4}, {0x8, 0x2, 0x38ea8989, 0xfa93}, {0x9, 0x5, 0xfff, 0xfffffffffffffbff}, {0x0, 0x2, 0x5, 0x382a}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xe6}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r9}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0xb4, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}]}}, {{0x8, 0x1, r14}, {0x258, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r15}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1234}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r16}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r17}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r20}}}]}}, {{0x8, 0x1, r21}, {0xf0, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7e}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r23}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r24}}}]}}, {{0x8, 0x1, r25}, {0x7c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x73}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r26}}, {0x8}}}]}}]}, 0x788}, 0x1, 0x0, 0x0, 0x810}, 0x4)
r27 = socket$netlink(0x10, 0x3, 0x0)
ioctl$UI_SET_PROPBIT(r27, 0x4004556e, 0x14)
bind$netlink(r27, &(0x7f0000000000)={0x10, 0x0, 0xffffffffffffffff, 0x120c03}, 0xc)
bind$netlink(r27, &(0x7f0000000040)={0x10, 0x0, 0xffffffffffffffff}, 0xc)

03:35:42 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe]}, 0x10)

[  406.184314] netlink: 8 bytes leftover after parsing attributes in process `syz-executor2'.
03:35:42 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:42 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5416, &(0x7f0000000000)=0x9)

[  406.813115] binder: 23012:23070 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:42 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x2, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:42 executing program 2:
r0 = open(&(0x7f00000000c0)='./file0\x00', 0xa100, 0x80)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffff9c, 0xc018620b, &(0x7f0000000100)={<r1=>0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000180)={r1})
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020aea5, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil})
exit(0xe3)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=<r4=>0x0)
syz_open_procfs(r4, &(0x7f0000000040)='net/packet\x00')

03:35:42 executing program 6:
r0 = getpid()
mkdir(&(0x7f000082f000)='./control\x00', 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x8})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000100)=0x6)
write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30)
unlink(&(0x7f0000000240)='./control/file0\x00')
r3 = open(&(0x7f0000022ff6)='./control\x00', 0x0, 0x0)
fchmod(r3, 0x0)
mkdirat(r3, &(0x7f0000fc3ff6)='./control\x00', 0x0)
close(r1)

03:35:42 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070")
r1 = syz_open_dev$sndctrl(&(0x7f00000001c0)='/dev/snd/controlC#\x00', 0x4000000007, 0x0)
perf_event_open(&(0x7f0000001000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1fffffb)
ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0xc4c85512, &(0x7f0000001000))
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x14000, 0x0)
getsockname$packet(0xffffffffffffff9c, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14)
sendmsg$kcm(r2, &(0x7f0000000740)={&(0x7f0000000200)=@can={0x1d, r3}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000180)="4baf1e8b2eb4", 0x6}, {&(0x7f0000000280)="0d4d6451169ec01cd69bfa7eec250cffb7c5965ad7d2c2a1286c0991eff8d70d3b382b29e5aa65cf56becd412a824e96a0373542e2bb0a7a46c47fbdbb3fc9957136b78082fded44afa1b9d4f8e32480e9c4e47fdae71c7dba8cf7ca9fb1f319916d338c8bdc", 0x66}, {&(0x7f0000000300)="faa076a1c1f4a1c4916c0d3edb4d5dc88f49a23deb517ba6f08d7c4770a36e6a83773bdcf035376ff1803e2a092449c905c89f72062a1b43b0ed08f98088073bd6466b113b3cc9f44245014fca448fa8f154ae887bbdd6b79db4f33de2896233bc05d79e0027ea47dfac77db91c41d0e9f98e466539871780262718e8aa091e42bdddca83558a5ff5dc08b7cdf145eb039bbe7a46fb1a52fb4e77d01f46bd5aa6f6c34c81db54bdc98c69481bd710e2530769c57879354d2eef8b48d31bbcb67d70aa0078f", 0xc5}, {&(0x7f0000000400)="72a922689c75fdc392", 0x9}], 0x4, &(0x7f0000000480)=[{0x20, 0x11d, 0x5, "32928efd4cb39002472811185d0579"}, {0xb8, 0x13b, 0x3e8, "c320d1d26a74b9713f4c5821491fc761bd2f1727cbdb0db1d146cdd65691508e54f607f2de7c2bf61f0b280e6452a21608e143b4648e2eb8a392c3203af55aebc59fa05b9042b88bb1f21928f5b4ff50b85437939488be82f40da98de90afbe8393fb62f5e083d19de2023d4aa2948ec5f1c1fb0df5487213a8b209753cad575a6a7b0182a0615d17dd36fdaa0cbaf796fe32099068db6fcc97b3b187710664c6dd84a29b4b39fa5"}, {0xf0, 0x0, 0x384, "5d5e648b15e71f0a2ae2bc589236a855494f6be0b9be9474bee3059265442c5469ccc4a05b8bf384ba9394404164317ec77aed17ed75818e44275c4023258a5be1b11a2c0173f60f958c632ffcc595ffbcbd52b0e72193f217bc58eb7a85c2fa3f7405a869165a94597548ac0c22fe6ee5991d38331fdc6e0e8bd333495e714eb75d39e736e8a199441cd32513f525f2551d62279bc812ace51e7535d2e11d5be8870c583ca40baa9528418a2ddb1931330b2a7f7696d13bfaf649d635960746790145286a5ac613622770b98fcd86a3281b31785672fb111792"}, {0x18, 0x11f, 0x3, "761f"}, {0x40, 0x10b, 0x8001, "91fd813c7e633b1a636fb2c4b08723288000d756df35fc64b2002ffeb6a2bd4d1daf4448ed2db6bf782b3797d6307190"}, {0xa0, 0xff, 0x7, "5144461074559f146a3aaf1e5dc992a43676c22850acf8d0fac7167937e14c508fd5290e20a00aebc6765915d9443bf482ebcb4989a646ed9a04e07b953c738803b6c111bdaad0b544d0d0ad65b3135ff621f3d52ab8589104ddb5aaed773830c9ab5d79d89e3d17e9c61adf78bbd61938abf9c73856a4b488cfa1f84ca595c655ca5c8afeba4403e50c"}], 0x2c0, 0x40040}, 0x4000000)
ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000040)=""/55)

03:35:42 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:42 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3ffdb0]}, 0x10)

03:35:42 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5441, &(0x7f0000000000)=0x9)

03:35:42 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x74, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:42 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x10)

[  406.906839] binder: 23074:23077 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:42 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:42 executing program 5:
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c010000404061ab937e", @ANYRESDEC=0x0, @ANYBLOB=',\x00'])
r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x4000000000000000, 0x20002)
lstat(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000340))
read$FUSE(r0, &(0x7f00000040c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_NOTIFY_DELETE(r0, &(0x7f00000001c0)={0xfffffee9, 0x6, 0x0, {0x1, 0x0, 0xd, 0x0, 'cgroup.procs\x00'}}, 0x36)
ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f00000000c0))
mkdir(&(0x7f00000003c0)='./file0/file0\x00', 0x0)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="90000000000000000200000000000000010000000045000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f757024636772ef000000000000000000000000000000000000000000000000"], 0x90)

03:35:42 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x540b, &(0x7f0000000000)=0x9)

03:35:43 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, 0x10)

03:35:43 executing program 5:
keyctl$session_to_parent(0x12)
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0)
keyctl$join(0x1, &(0x7f0000000000))
read(r0, &(0x7f0000000080)=""/246, 0xf6)
r1 = syz_open_dev$sndpcmp(&(0x7f0000000180)='/dev/snd/pcmC#D#p\x00', 0x7, 0x200)
socket$bt_bnep(0x1f, 0x3, 0x4)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000001c0)={0x5, 0x3, 0x6, 0x10000, <r2=>0x0}, &(0x7f0000000200)=0x10)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000240)=@assoc_value={r2, 0x3}, &(0x7f0000000280)=0x8)
accept4$llc(r1, &(0x7f0000000700), &(0x7f0000000740)=0x10, 0x80000)
r3 = memfd_create(&(0x7f0000000580)='/dev/sg#\x00', 0x2)
r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000600)='fou\x00')
sendmsg$FOU_CMD_GET(r3, &(0x7f00000008c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000640)={0x3c, r4, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000804}, 0x48000)
getpeername(r1, &(0x7f00000002c0)=@can={0x1d, <r5=>0x0}, &(0x7f0000000340)=0x80)
sendmsg$xdp(r1, &(0x7f00000006c0)={&(0x7f0000000380)={0x2c, 0x3, r5, 0x36}, 0x10, &(0x7f0000000680)=[{&(0x7f00000003c0)="9ef4fcd4496262ff291fcb12089721b9b3e87e2a7af01ba2", 0x18}, {&(0x7f0000000400)="b4a07ecefc3e8a4043fc8c2d4dd52cad46392a516ebfc4d708947e6f9d1dc678547ca7509b9c95348a05f293cf1ac05734165225599d6a3ebea91d6b29d01e1950d22f962f778ea6e08ae3e675019aa6855eb2024fcb43d9d1dcdfada9ece4ae15be6bb1546784aa39c81efbcda808cd7f27b5ab5794496fa284da", 0x7b}, {&(0x7f0000000480)="e5b3767bc2db257bcedc472d59f4b7270bb43fbe3fe539c6cb9db2635590538e4eff0d1d2edfa0509c914c62cca1b1fad07086e3d7818fa6f72bcd9ddbc37ad8aa813c8aa7bf57f33745882cdd1bb12d7e6b196646cee1f1203e7b882e2fc3f7b1fc1def652f2d8089fbb42cbcf20f028ed1b3fc3e8d8b89acb2a3d5776a86d5eb03e0e1ddd0b267d7fe84b92c8f2e047a99d46f89ca37268d4367f5eee903657e9ed70bc012c98f85a98bf2e70d3945b65571721bb4fdf4502464d68251972895708bb3bf150c6a5c83777f7ba5e3af", 0xd0}, {&(0x7f0000000780)="ea64d470fcd3b85d504cd8ef1779de2b00abc2d64cd5d1b67530a5b1eac63d21eb209378eaeba1697c4490f22d118fb4dd9478a439e56147c80d9617d95ff03f3ccfdc5b4b6da8ad2102a9742f3e6b69a13831c129da7781481ab98c812626d1c99a3493d56e190be04f61003399ffa7d20b8cb8f6e1362710b6e01939aff1ade3e71d250cf7bc016362809574a1bcb687d6200dc327c44e97a729bd4ec44e2b6eaf71058676e0bd1196658a8ae9b14236a459ed5b5f2403186c564e8ab6cd2e9a2ce330f38eb654bd42a2c76963a71fb751a4811a7adb00f85fd69a4a71ad43f5e59737b0fdcc5850a3bdada7890ee74a74565e7316934520", 0xf9}], 0x4, 0x0, 0x0, 0x20000046}, 0x40)

03:35:43 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:43 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  407.160319] sg_read: process 1909 (syz-executor5) changed security contexts after opening file descriptor, this is not allowed.
[  407.697174] binder: 23074:23131 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:43 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:43 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x80045440, &(0x7f0000000000)=0x9)

03:35:43 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa0020]}, 0x10)

03:35:43 executing program 5:
clone(0x4f6100500, &(0x7f0000000000), &(0x7f0000001480), &(0x7f0000000040), &(0x7f00000001c0))

03:35:43 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000040)="c4c27d1a28f04083248bccc4e3791d170066430f3a41e000b9a10a0000b8ed000000ba000000000f30c462d1bafe440f3566baf80cb88c91668aef66bafc0cec66b8d8008ec80f0118", 0x49}], 0x1, 0x0, &(0x7f00000000c0), 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
dup2(r1, r3)
dup2(r3, r2)
ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x6)

03:35:43 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:43 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x100000000000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:43 executing program 2:
r0 = socket$inet6(0xa, 0x6, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x10}, 0x2c)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000180)={<r1=>0x0, @in={{0x2, 0x4e24, @rand_addr=0x80}}, 0x59886fad, 0x6}, &(0x7f0000000240)=0x90)
getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000280)={r1, 0x8001, 0x8000000000000008}, &(0x7f00000002c0)=0xa)
r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x1, 0x200)
getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, <r3=>0x0}, &(0x7f0000000100)=0x14)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vcan0\x00', r3})
bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xe, 0x5, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000000000000000000000000006127580000000000000000000000000000000000000000004f9c6dee5bb16cc1c51c3c27790c0e65d99a6e4c500067a511586b3dcbe420109db55e3fff7d9ebab85bd02472838a7ddcd7e8ae7b"], &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x14)

03:35:43 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  407.847338] binder: 23140:23151 Acquire 1 refcount change on invalid ref 0 ret -22
[  407.866648] IPVS: ftp: loaded support on port[0] = 21
03:35:43 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001740)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f0000001800))
getpgid(0xffffffffffffffff)
r1 = socket(0x2, 0x1, 0x0)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000000c0)={<r2=>0x0, @in={{0x2, 0x4e23, @local}}}, &(0x7f0000000180)=0x84)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000001c0)={0x7ff, 0x202, 0x4ba, 0x1, r2}, &(0x7f0000000200)=0x10)
setsockopt$EBT_SO_SET_ENTRIES(r1, 0xfeffff0700000000, 0x80, &(0x7f0000000040)=@broute={'bro#te\x00', 0x20, 0x1, 0x130, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000300], 0x0, &(0x7f0000000000), &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001300000000000000000069703667726530000000000000000000766c616e30000000000000000000000076657468310200000000000000000000697036746e6c30000000000000000000c201c9a511d30000000000008d89a2f47b8500000000000000007000000070000000d000000072656469726563740000000000000000000000000000000000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000"]}, 0x1a8)
ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000440)=ANY=[@ANYBLOB="40000000000000007f0000000000000004000000950000000200000000000000ff01000000000000fcfffffff25bb149ffffffff0d03d91300000000000000000000000000000000000000000004000000fcffffffffffffff000000000400000000000004000000000000001c0000000000000000000000000000000000000000000000001000000000000000000000"])
ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000240))
openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x111202, 0x0)

03:35:43 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5415, &(0x7f0000000000)=0x9)

03:35:43 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}, 0x10)

[  407.925328] binder: 23140:23160 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:43 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:44 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0xfdfdffff00000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:44 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070")
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440)='/dev/fuse\x00', 0x2, 0x0)
ioctl$FUSE_DEV_IOC_CLONE(r2, 0x8004e500, &(0x7f0000000080)=r1)

[  408.041319] x_tables: eb_tables: redirect.0 target: invalid size 8 (kernel) != (user) 29
[  408.066707] x_tables: eb_tables: redirect.0 target: invalid size 8 (kernel) != (user) 29
03:35:44 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  408.131854] binder: 23182:23184 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:44 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfc00000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:44 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5450, &(0x7f0000000000)=0x9)

03:35:44 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000]}, 0x10)

03:35:44 executing program 2:
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x40000, 0x0)
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x1, &(0x7f0000000200)=""/4096, &(0x7f0000001200)=""/252, &(0x7f0000001300)=""/242, 0x7ef63928e4f224b6})
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x3c87b2741a160a5a, 0x4, 0x4, 0x5}, 0x2c)
r1 = getpid()
r2 = syz_open_procfs(r1, &(0x7f0000001440)='attr/prev\x00')
ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000080)={'bond0\x00', 0x400})

03:35:44 executing program 6:
r0 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x5, 0x1)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000240))
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000009000)='/dev/audio\x00', 0x800, 0x0)
r2 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x0, 0x405)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18}, 0x20)
write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)}}, 0x20)
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(0xffffffffffffffff, 0x111, 0x4, 0x0, 0x4)
write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)}}, 0x20)
ioctl(r3, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0xfffffffffffffe4e}, 0xc)

03:35:44 executing program 5:
fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c)
r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600), 0x0, 0x0, &(0x7f0000000480)})
socket$l2tp(0x18, 0x1, 0x1)

03:35:44 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:44 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:44 executing program 5:
pipe2$9p(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RUNLINKAT(r1, &(0x7f00000001c0)={0x7}, 0x7)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@noextend='noextend'}]}})
write$P9_RREADDIR(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2a000000290100000000000000000000000000000000000000000000000000000007002e2f66696c6530"], 0x2a)
write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0)
write$P9_RWALK(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="160000006f0100010000000000000000000000000000"], 0x16)
write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0)
write$P9_RWRITE(r1, &(0x7f0000000180)={0xb, 0x77, 0x1}, 0xb)
write$P9_RGETATTR(r1, &(0x7f0000000640)={0xa0, 0x19, 0x1}, 0xa0)
write$P9_RWALK(r1, &(0x7f0000000940)={0x9, 0x6f, 0x1}, 0x9)
r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x6, 0x288040)
r3 = dup3(r1, r0, 0x80000)
renameat(r2, &(0x7f0000000480)='./file0/file0\x00', r3, &(0x7f0000000600)='./file1\x00')
write$P9_RREAD(r1, &(0x7f0000000440)={0x18, 0x75, 0x1, {0xd, "6da9c5a38d8a44f8ac32e38ecc"}}, 0x18)
write$P9_RATTACH(r1, &(0x7f00000000c0)={0x14, 0x69, 0x1}, 0x14)
write$P9_RREAD(r1, &(0x7f0000000700)={0xb, 0x75, 0x1}, 0xb)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000008c0)='9p\x00', 0x0, &(0x7f0000000a80)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}, {@cache_loose='cache=loose'}]}})
r4 = creat(&(0x7f0000000300)='./file0/file0\x00', 0x0)
write$FUSE_LSEEK(r4, &(0x7f0000000400)={0x18}, 0x18)
write$P9_RWRITE(r4, &(0x7f0000000340)={0xb}, 0xff69)

03:35:44 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5452, &(0x7f0000000000)=0x9)

03:35:44 executing program 6:
r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='eth1^vboxnet0^[\x00'}, 0x10)
bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000180)={&(0x7f00000000c0)='.\x00', r0}, 0x10)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="020e0000140000000000000000000d0005000600000000000a00000000d723dbfc0000000000000000000000001b00000000000000000000080012000200020068fe74a7000000001f00000000000000ac14ffbb00000000e4945b9de2757ab5ac14140000000000000000000000000005000500000000000a00000000000000fe8000000000000000000000000000ff00000000000000000000000000000000931b06ad2484dae2dbdb01e1cbcac6d7f1cb51222afcc5bea32635b504f4f5"], 0xa0}}, 0x0)
socket$key(0xf, 0x3, 0x2)

03:35:44 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="71e67a111fde54fe46b904832c8fff73d41196c3cdf8311cfc093a52a7d10000", 0x20)
r1 = accept4$alg(r0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000005540)=[{{&(0x7f0000002140)=@sco, 0x80, &(0x7f00000027c0)=[{&(0x7f0000000200)=""/10, 0xa}, {&(0x7f00000021c0)=""/167, 0xa7}], 0x2}}], 0x1, 0x0, &(0x7f0000005700)={0x77359400})
sendmsg$alg(r1, &(0x7f0000003b80)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000003c0)="e054c4ad1f4f0249c5229a656302a0bcd343edc79a91c7fbf60ff87bdff39efc1515628e108ca8a51572ee9309e811a3d3553f8579a1d294efd49416c5cf607b", 0x40}], 0x1, &(0x7f00000000c0)}, 0x0)
recvmmsg(r1, &(0x7f0000002480), 0x871, 0x0, &(0x7f00000001c0)={0x77359400})
r2 = dup3(r0, r0, 0x80000)
ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000000)='selinuxself\x00')

[  408.919097] binder: 23182:23216 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:44 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}, 0x10)

03:35:45 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x6c00000000000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:45 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:45 executing program 5:
r0 = socket$inet6(0xa, 0x4005, 0x1)
ioctl(r0, 0x3, &(0x7f0000000140)="0a5cc80700315f857150701a97a3a6bb9ea13396186e6fbe0ec4a2ff2e3128713b1f368237551acafb7ec5ed9036dc6cbb8b7d97334c9ea2cbb6259ca616e95a055cfe27921dc6d864aae6ac76d2ce4b57b85d5afb4543214c9b679bfd09c75cd9bdb0d6370ae3aa9282f8d7e42d738ff7f57a00f0d188a66e08d59c9c6e5e907f62a09efb1e70d2f3b460000000000000000000000000000000000000")
r1 = socket$inet6(0xa, 0x80007, 0x10000000000)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c)
openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x940, 0x0)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r1, 0x28, &(0x7f0000000080)}, 0x10)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000000200)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a7810c687f18e21bf2d668f732e12c36a00230d2f5b19e5696a60be3ac378850feb3e4dd5fdf27dd79a45f9b3c97f70a17eb97f584dfdfcc4b83115d410b23e0a270e62e5c89cd345f794961fd756381e5a1f59b8c185ad78826b87095a5fb7724c42a804e19fe80632f6afd9c6f2406c95953bd7268eda7727ef090dc"], 0xb8}}, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@empty, 0x0, 0x2}, 0x20)

[  409.134167] binder: 23243:23244 Acquire 1 refcount change on invalid ref 0 ret -22
[  409.195275] binder: 23243:23250 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:45 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xa00000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:45 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5409, &(0x7f0000000000)=0x9)

03:35:45 executing program 6:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
socket$inet(0x2, 0x2, 0x80000000)
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:35:45 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:45 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
set_robust_list(&(0x7f00000003c0)={&(0x7f0000000300)={&(0x7f00000002c0)}, 0x10001, &(0x7f0000000380)={&(0x7f0000000340)}}, 0x18)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000240)=ANY=[])
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0xffffffffffffffff)
mknodat(r1, &(0x7f0000000180)="2e2f66692e65318c", 0x0, 0x0)
r2 = fanotify_init(0x0, 0x0)
fanotify_mark(r2, 0x80, 0x0, 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00')
pipe(&(0x7f00000000c0)={<r3=>0xffffffffffffffff})
getsockopt$inet6_buf(r3, 0x29, 0xfb, &(0x7f00000001c0)=""/111, &(0x7f0000000100)=0x6f)
llistxattr(&(0x7f0000000080)="2e2f66692e65318c00", &(0x7f0000000280)=""/51, 0x33)
unlink(&(0x7f0000000400)='./file0\x00')

03:35:45 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}, 0x10)

03:35:45 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x600000000000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:45 executing program 5:
pipe2$9p(&(0x7f0000000500)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0x1fb}, 0x7)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}})
write$P9_RREADDIR(r1, &(0x7f0000000100)={0xb, 0x29, 0x2}, 0xfffffffffffffff0)
fcntl$setlease(r0, 0x400, 0x2)
write$P9_RREADDIR(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="5b00000029010000000000000000000000000000000000000000000000000000000d002e2f66696c65302f66696c653000000000000000000000000000f8ffffffffffffff0013002e2f66696c65302f66696c65302f66696c6530edaf37778cd3ab9916a1ed671ab54f39d7f71edb98d9519d63348cd1b027b0475716fb64187392ebdeab4652522a2605ebd6a7f671453038def687e2800bc0b61809d106e55af3f73aed524bad131c5100df7272ae3a3d3731317b243b707a08b6b6be44c416e74e021c7c0f9a9d9f8c270bb0ccfdc5d4d2410d63949486764ab46e8cd0b4e51c44f5eb835bd9e0d5a9ab2baa4efc859eb35fbc7cbde431db78f4223796f0a9125f2603f4cd2ad1307460d8b0a4a1c463c3731725ffd1a30c68c6be4f7dca9e8a9b426012"], 0x5b)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})
lchown(&(0x7f0000000080)='./file0\x00', 0x0, 0x0)

[  409.791841]  loop6: p1
[  409.794510] loop6: partition table partially beyond EOD, truncated
[  409.803189] binder: 23271:23273 Acquire 1 refcount change on invalid ref 0 ret -22
[  409.826043] FAT-fs (loop2): bogus number of reserved sectors
[  409.831927] FAT-fs (loop2): Can't find a valid FAT filesystem
03:35:45 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  409.832508] loop6: p1 start 1 is beyond EOD, truncated
03:35:45 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000]}, 0x10)

03:35:45 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1d)

[  409.938631]  loop6: p1
[  409.941303] loop6: partition table partially beyond EOD, truncated
03:35:45 executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/vsock\x00', 0x100, 0x0)
setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000800)={0x2, 0x6, 0x6, 0x100000000, 0xa2, 0x0, 0x7, 0x5c, 0x8, 0x9, 0x100}, 0xb)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
mount(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000300)='nfsd\x00', 0x1090, 0x0)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
umount2(&(0x7f0000000040)='./file0/file0\x00', 0x0)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="90000000d62200000200000000000000010000001400c6da0000000b000000000066ce656d316e6f246576656d33000013f12b7969ad3ec186616a1a0a3c0000000000050000e3ff000000619fcd3823b7c94f5a3276ce8c9461000000000000051c0005000000000079737465746a48be1b31486dcc6370757365746367726f757024a3d030914ce145fe700471595c"], 0x90)

03:35:45 executing program 2:
mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000005)
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40, 0x0)
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000500)={<r1=>0x0, 0xffff, 0x20}, &(0x7f0000000480)=0xc)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000300)={<r2=>r1, 0x97, "7f8bc603adb36989b4dc7c2367fbabfdbf567d243233fe9d983fce0d17903fe1341510e0346c7811e32c23979158426e81708e4d1051d754c68a6eab303343054d0ad005dcf0b4e8a49731fab01c1f42fc5b2a7a384db52f23307b2b71311564d90ab3030b56a47f5461877115935c66127082632c1ca8c78a0082b2e6c44845c3c4a802e8e94a122b1326bf40fdf649d65556e9c096e5"}, &(0x7f00000003c0)=0x9f)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000000c0)={r1, @in={{0x2, 0x4e22, @multicast2}}, [0x7, 0x1, 0x80000000, 0xa1e, 0xffffffffffffffff, 0x3, 0x9, 0x0, 0x8, 0xb150, 0x200, 0x0, 0xf0, 0x9]}, &(0x7f00000001c0)=0x100)
r3 = getpid()
ptrace$setsig(0x4203, r3, 0xffffffffffff0002, &(0x7f00000002c0)={0xf, 0x4, 0x5, 0x1010000})
ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000200)=""/178)
getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000400)=ANY=[@ANYRES32=r2, @ANYBLOB="26000000bcb800143b72dcd54f28ede22ebd70a94ab8bfb181187f3380cf2d9c8433a120a500d9e52da1"], &(0x7f0000000440)=0x2e)

[  409.978904] loop6: p1 start 1 is beyond EOD, truncated
03:35:46 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:46 executing program 6:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
socket$inet(0x2, 0x2, 0x80000000)
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:35:46 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x10)

[  410.149259]  loop6: p1
[  410.151958] loop6: partition table partially beyond EOD, truncated
[  410.191833] loop6: p1 start 1 is beyond EOD, truncated
[  410.581085] binder: 23271:23339 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:46 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xf401000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:46 executing program 2:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000140)={0x8, 0xd})
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x1, 0x1})
r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0)
recvmsg$kcm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000080)=""/57, 0x39}], 0x2, &(0x7f0000000280)=""/246, 0xf6, 0x4}, 0x40000000)

03:35:46 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xa)

03:35:46 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:46 executing program 6:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
socket$inet(0x2, 0x2, 0x80000000)
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:35:46 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xb0fd3f0000000000]}, 0x10)

03:35:46 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x5000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:46 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  410.690342] binder: 23343:23347 Acquire 1 refcount change on invalid ref 0 ret -22
[  410.723349]  loop6: p1
[  410.726072] loop6: partition table partially beyond EOD, truncated
03:35:46 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:46 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xeffdffff]}, 0x10)

03:35:46 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x3, 0x0)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000180))
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80, 0x0)
getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000480)={<r2=>0x0, @in6={{0xa, 0x4e20, 0x2, @empty, 0x8}}}, &(0x7f0000000040)=0x2)
setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f00000002c0)={0x3c, @local, 0x4e22, 0x2, 'lc\x00', 0x3, 0x1df, 0x14}, 0x2c)
setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f00000000c0)={{0xa, 0x4e24, 0xd064, @ipv4={[], [], @multicast1}, 0xe0fa}, {0xa, 0x4e22, 0x100000000, @dev={0xfe, 0x80, [], 0x20}, 0x5000000000000000}, 0x2, [0x1, 0xfffffffffffffff7, 0x9, 0xffffffff, 0xf0a0a46, 0xffff, 0x5, 0xfffffffffffffff8]}, 0x5c)
getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f00000001c0)={r2, 0x85, "676498ea592ecb26c50e588f5fac36b6d0d49617827033d844b122fce02508f552f0b39c2f771ccc4b6ce5e043f6aafaaeb7582a07c96f85cae511eca747cece61e0f445cf1a3ba8d30db15bd14854ea83f1862f0331da285b259ba75ec7a4d2ea72eefcdbb6b5b8182dbd9aa6734967bfc36df66efb53553d2c6bcf1cad87abdf6e3cc4a7"}, &(0x7f0000000280)=0x8d)
close(r0)

[  410.783075] loop6: p1 start 1 is beyond EOD, truncated
03:35:46 executing program 6:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
socket$inet(0x2, 0x2, 0x80000000)
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:35:46 executing program 3:
r0 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x0, 0x202800)
ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f00000002c0)={0x0, 0x1, 0x7, &(0x7f0000000280)=0x200})
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0xb)
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000040)={<r2=>0xffffffffffffffff})
getsockname(r2, &(0x7f0000000080)=@pptp={0x18, 0x2, {0x0, @loopback}}, &(0x7f0000000100)=0x80)
ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000140)={[{0x8, 0x8, 0x7, 0x0, 0x868, 0xff, 0x7e, 0xf9, 0x9, 0x8f, 0x0, 0x9, 0x7}, {0x7, 0x9, 0x2e4, 0x6, 0xfff, 0x0, 0x866, 0x9, 0x3, 0x5e, 0x3, 0xaa8}, {0xff, 0x100, 0x4, 0x6, 0x4, 0x3, 0x2, 0x7ff, 0x9, 0x8, 0x0, 0x7, 0xffffffffffffff81}], 0x7})

03:35:46 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:46 executing program 5:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0xa, &(0x7f0000000080)={<r1=>0x0, 0x0, 0x10}, &(0x7f00000000c0)=0x18)
getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={r1, 0x3, 0xffffffff00000000, 0xf8c, 0x40, 0xfffffffffffffff7}, &(0x7f0000000040)=0x14)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x200, 0x0)
write$UHID_SET_REPORT_REPLY(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="1ca400000300000001013b001430ba2e0fa7d2a2e4d424573549f2cfa0f334301d56cac333b3feb0408036cf782c8dd294428f9937b90176e52c8eee7e509ff200000000000000000000"], 0xfffffffffffffe50)

03:35:46 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x10)

[  411.024196]  loop6: p1
[  411.026920] loop6: partition table partially beyond EOD, truncated
[  411.044858] loop6: p1 start 1 is beyond EOD, truncated
[  411.490097] binder: 23343:23406 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:47 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xf000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:47 executing program 2:
r0 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x3, 0x0)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000180))
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80, 0x0)
getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000480)={<r2=>0x0, @in6={{0xa, 0x4e20, 0x2, @empty, 0x8}}}, &(0x7f0000000040)=0x2)
setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f00000002c0)={0x3c, @local, 0x4e22, 0x2, 'lc\x00', 0x3, 0x1df, 0x14}, 0x2c)
setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f00000000c0)={{0xa, 0x4e24, 0xd064, @ipv4={[], [], @multicast1}, 0xe0fa}, {0xa, 0x4e22, 0x100000000, @dev={0xfe, 0x80, [], 0x20}, 0x5000000000000000}, 0x2, [0x1, 0xfffffffffffffff7, 0x9, 0xffffffff, 0xf0a0a46, 0xffff, 0x5, 0xfffffffffffffff8]}, 0x5c)
getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f00000001c0)={r2, 0x85, "676498ea592ecb26c50e588f5fac36b6d0d49617827033d844b122fce02508f552f0b39c2f771ccc4b6ce5e043f6aafaaeb7582a07c96f85cae511eca747cece61e0f445cf1a3ba8d30db15bd14854ea83f1862f0331da285b259ba75ec7a4d2ea72eefcdbb6b5b8182dbd9aa6734967bfc36df66efb53553d2c6bcf1cad87abdf6e3cc4a7"}, &(0x7f0000000280)=0x8d)
close(r0)

03:35:47 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=<r1=>0x0)
perf_event_open(&(0x7f0000000080)={0x7, 0x70, 0x9, 0x1000, 0x80, 0x7fff, 0x0, 0x2, 0x4010, 0x0, 0x20, 0x15, 0xab9, 0x1, 0x5, 0x9, 0x1, 0xbced, 0xfffffffffffff67e, 0xce, 0x2, 0x1, 0x4, 0x800, 0x9, 0x6, 0xffff, 0x0, 0x400, 0x2, 0x101, 0x8, 0x9b8, 0x80, 0x100000000, 0x5, 0xffffffff00000001, 0xb51b, 0x0, 0x4, 0x2, @perf_bp={&(0x7f0000000040), 0x2}, 0x1, 0x4, 0x1000, 0x2, 0x9, 0x0, 0x5}, r1, 0x9, 0xffffffffffffff9c, 0x9)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:47 executing program 5:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x200800, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000280)={{{@in=@rand_addr, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in=@dev}, 0x0, @in6}}, &(0x7f0000000140)=0xe8)
ioctl$TUNSETOWNER(r0, 0x400454cc, r1)
r2 = socket$alg(0x26, 0x5, 0x0)
r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40)
ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380)
setsockopt$inet6_int(r3, 0x29, 0x100, &(0x7f00000001c0)=0x400000000003, 0xcdac443b19221c3f)
bind$alg(r2, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4543(gcm(aes-generic)))\x00'}, 0x58)
bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58)

03:35:47 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:47 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x10)

03:35:47 executing program 6:
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:35:47 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0xa00, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  411.621101] binder: 23418:23420 Acquire 1 refcount change on invalid ref 0 ret -22
[  411.630715]  loop6: p1
[  411.633319] loop6: partition table partially beyond EOD, truncated
03:35:47 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:47 executing program 2:
r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200)=""/28, 0x1c)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000400)={0xbf})
getsockname(r0, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, &(0x7f0000000000)=0x80)
ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00000000c0)={'irlan0\x00', {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x13}}})
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000004c0)={0x0, 0x0, 0x0, 'queue1\x00'})
r2 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000))
tkill(r2, 0x1000000000013)

[  411.674024] loop6: p1 start 1 is beyond EOD, truncated
[  411.682505] binder: 23418:23432 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:47 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}, 0x10)

03:35:47 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:35:47 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x400000000000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:47 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0xffffffffffff1cd0, 0x0)
accept4$bt_l2cap(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xe, 0x80800)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)

03:35:47 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  411.881815] binder: 23456:23458 Acquire 1 refcount change on invalid ref 0 ret -22
[  411.908788]  loop6: p1
[  411.911491] loop6: partition table partially beyond EOD, truncated
03:35:47 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xb0fd3f00]}, 0x10)

[  411.937395] loop6: p1 start 1 is beyond EOD, truncated
[  411.951249] binder: 23456:23475 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:48 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x20000)
ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000000280)={0xff, 0xfffffffd, 0x8, 'queue0\x00', 0xac4})
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)
ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000140)={0x5, 0x807, 0x2, 0xd376a94, 0x3, 0x9})
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000080), &(0x7f00000000c0)=0x30)

03:35:48 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:48 executing program 6:
syz_read_part_table(0x0, 0x0, &(0x7f0000000000))

03:35:48 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x68000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:48 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x700, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:48 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa00100]}, 0x10)

03:35:48 executing program 5:
r0 = memfd_create(&(0x7f0000000140)='dev ', 0x0)
write(r0, &(0x7f0000000040)="164690f91220", 0x6)
sendfile(r0, r0, &(0x7f0000000000), 0xfffb)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
accept$alg(r0, 0x0, 0x0)
clock_nanosleep(0x0, 0x0, &(0x7f0000000100), &(0x7f00000000c0))

[  412.521530] binder: 23502:23508 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:48 executing program 6:
syz_read_part_table(0x0, 0x0, &(0x7f0000000000))

03:35:48 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  412.590656] binder: 23502:23517 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:48 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0047fc2f07d82c99240970")
getsockopt$inet6_buf(r0, 0x29, 0x40, &(0x7f00000001c0)=""/163, &(0x7f0000000180)=0x10307)
r1 = fcntl$getown(r0, 0x9)
r2 = getpgrp(0x0)
r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x80000, 0x0)
kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, r0, &(0x7f0000000040)={r3, r0, 0x9})
msync(&(0x7f0000008000/0x2000)=nil, 0x2000, 0x4000000400000b)

03:35:48 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x100000]}, 0x10)

03:35:48 executing program 3:
r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x3, 0x400000)
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000080)="e58bf97eb71371bd71f327dbf71e2325", 0x10)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00', 0x9)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)

03:35:48 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x1000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:48 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:48 executing program 6:
syz_read_part_table(0x0, 0x0, &(0x7f0000000000))

[  412.775334] binder: 23539:23540 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:48 executing program 2:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2, 0x20000)
getsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000040), &(0x7f0000000080)=0x4)

03:35:48 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0x10)

03:35:48 executing program 3:
r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x140, 0x84)
ioctl$VT_SETMODE(r0, 0x5602, &(0x7f0000000100)={0x40, 0x21fd, 0xffffffffffffffff, 0x5, 0x5})
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$invalidate(0x15, r2)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)

03:35:48 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:49 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x401000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:49 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040), 0x0, 0x1c0}])

03:35:49 executing program 2:
r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0xfffffffffffffffd, 0xfffffffffffffffc)
pipe(&(0x7f0000000380)={<r1=>0xffffffffffffffff})
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000003c0)=<r2=>0x0)
write$cgroup_pid(r1, &(0x7f0000000400)=r2, 0x12)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x300000a, 0x31, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f00000000c0)=""/216)
r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x2, 0x103180)
ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f00000002c0))
bind$vsock_stream(r3, &(0x7f0000000340)={0x28, 0x0, 0x2711, @reserved}, 0x10)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r3, 0x0, 0x28, 0xb4, &(0x7f0000000040)="932716be53eabb43d13dacc18d98d2020f475b1f2cee9b9e9c6604d5b6fd01a8c378e4b0aa3ae186", &(0x7f00000001c0)=""/180, 0x4}, 0x28)
ustat(0x1, &(0x7f0000000300))

03:35:49 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000]}, 0x10)

03:35:49 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:49 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0xf7afb6c55e98a5eb}, 0x10)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:49 executing program 5:
unshare(0x8000000)
r0 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x5})
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000080)={'raw\x00', 0x1000, "cc5dd7c5d2090e8e9565c7b414f2a867645bfaeb20a0305fbd0443e8511c4b846e74b3669b01fddf0c723b35153b8aab643a702095e0102a071fca350c62fac4ab4c4e21e39bbcb2d0955331fe326dd05fa6719e53837e65a584c30bf2948a8543062c2f72c139535801ae85aec9f51993747805256122451d8e6d20eedcc50b224529469907567ab8946ae841c03d768ace2d2814df178963568a95a8efb3c37ad6d7a87527e54483cad26e167782c0a6a8265e6232033e3a6ee922441fc9d450a3792bee73f8bceb814b511392233f59f6950803bfd3c216bea2bfdd4c0e49687c29dd5a64c62a88afd787e03a52387c9c13bbd78abdb7140e9c3c7f680b2008dbddc1d5430997d198ee6ea34fd10bd670f8359a0d1d3f48c305ce49be7385ccd1b98afac872d343918a871d9a0e1b2461a8e383f2ccc113bf70ec7696725923d1c743b4d79a12a1ec4b58238ab29ab63f43df3c50f98b89db97e6b461a3fba079969d6eda90de07c9721ce35eddff680696c566947f2ec4ee8c4ecdf81b7a3f468010a97e7f8ca62847ffc9d8f39b2d582665d0e5f0f104c182ea39aaf39a2fd88a3422430b7a1363375b11ea7c1e51ca271ca57f89b9bcd91d20741d433b955a7c574eea809db226de88fcde5efcd59fb5b32b83b00842b467ff1e8af93bc544395e335681e26a701d63ec53bd0e4e5c268bc195a11713d0207165051215dc22ee84f94d72d1a54a219688a2a373575210ac835d040862e206c9a00d04ddeeae840c9c26feefb4c7098c25df857072cbdbb7a7327af542252ae49e94f2647f59db545e54b62255fa588be1ab022c84751f2abff445fe621457179970c57ff78d0416e84adf8ef05090abd95dc907569a64b73d9f3a4de34ab1c3392fe24b731b6d32c763748ca00024a18a58a37fb5b06716f0baa987ab705d5362c39c9ee77c7a09008d98c18757f3811da67b5241a176ddb7a1a9b0ffd66e2af09b6fbf257df99addded3e1ba6a5ecbe96a37d7af0e60a1b9712f9e2c2047cc64c1ea8041fee64ebb81fd699dad9ca9c05c008309f26d4d3e4be0e538f505c6529f1737e525059cb3a6d924e1e63e36e8e7c6b8be028051b6fd8bad408e6c65b55276f417d07dfe207b19ef89ad341a5bc34d5dd483b688cb70e815ad5787e6d83329eeed9ba9351c6e5c02a51aac0a1ff0cc6e019315b2de1c0ccb31f136d7f4eccc0a076237f46dc88c16965082fb676b7b9beff0c39f24058a2752f51fd9694de295d810245f7fb0737ede6dd1cf5e484a07ad1cfff0249324874b10ec9a38fcb2c7507cf31bed8acd4a74f7c981dd145e53dd2b5bb65afa18219c1e3ea7e2c0a11bcbd73ee5b8477fb07a71f25288ce9ad8c6bb42602f5d0d97d046b92cc404e5771e301f0a2038fdd5c6731f11a5575d18d96763b734ab73022b1f97d654b3f7305b9326909149c5f348705016b0cebd69020c41aa1c3c5f96fefe06b3542c235c133a59cf3b379a3ed31e176944144e4b94cc84a881d1835ca4f0ad53a454fe13a20de2eadf4d525385cbba733a9542774a14276acbbd856fd2c58c12103106a891f0170fff50eeb1155288bf799860235d180eba5171d0eef99d1923096b486a4a74fc5fc523f53eef5b8244b9efbe5561b4c7cc91f9a6b5a40952706450adca6188705e45dab67a81a39cce463a29373d70a6b30f33892f5fcc0f62f1a29356e1e2414301398909712dca1804acc8f8b52f8f7c84f39562fb2c342c816b190ef333ed0ac4a3e9ad97f4e8438467849a2785460fc4c9c0a84624c681d442f6459454716444cc6dfa5a1ea1b57ccf0538d1d271de313afac4c9b79a41b2208ee2e6fca71f89ef1e1a005dc9f01e8c04d36b73dc12406ad5c65e1beb7b2b2f948f4a7b1b3f2a7f3b2009409a6dafa5d80805105b2035bf328a488b910c1352cd279d4fb0da11a5e2675511fb75f9d7eac4ab1241ce0c8bfd2e4081b83e11f08d77f4db162f366b615a9c2db775e757c91ded00fcc8cfae38a39677425a78e2ddabf00ae9e43aedfc4bd05114726131bfae5d773b4f7a52a5e76cb87b91ba124531997564147b9b4a1f7fe2c776ce6d3e8246a48165498b61dbfe91063365e741a008da8f0f2cf77273d0cdfb9374cb73c72af324119de82a35be848f2040372fd5171ba1349a911434a00fa6a4963396d470ef0bcb5f5ded091998c683761eead1100fb82926b0eb7436bc09230f4df8559d295cd67c9786ee61b9898ef5030323038a7dfc4b3d409c3a7e2c91d388476ef7ad324feb9d816640a116ee20a6d5349c2ca0ec69fbb27bfb99a242dbd0bbd034dffacc17713be0665cc550a11c33feff04e17c05a7c9d14d58eafd525f3c224479839800bac7064b49815bcae56a6c2bcfeadb162102be6e51eb7df0ba5a28c01774b5a2c05ccf105d6325a367da509f74863a9f6904ba3af478f52a1b36a249a730b6864c8a43bc9905d1e117d789f7430347893eca503781d5bf23233ca255d0a62008d3ad167d233d60e32295d54f9b516aec5363acd95b53d55a696e6d45beceb16724c17300af7297472a8977b6b2330c04e8665f37e3b0cb303e179f01a08c3c1cbb13e6a06ae88a8e295bec898b33207965441ee34afd0ef5799e2ba84a9a42c60be686c1010001d3c9cddcc26812771b5898db85e15693bd26dfa6070d0bd12763bf7b3295da54626ab3a2ccdbff84bc358c3c3e304de3dca6ef9e71db1722e7db6e28ec38d4152ce6ef869d5fb8ad173bdad047e5b73001a2ee707c86f0209a48ac4b4a005dfecfbee2f77870f2865a8427b2e00cd25cfc8e2c8562e04393c69d97453cf23289e6b7932a7d5fd66621e8a62771740eec28ab34c589f30bd2f6c1e261c87adc4da200ce2cac3eb5e10d051e7e6791959e92a2d1f34c8aeaccbc923bd06454ec0ee8a09a07e3a9d34a4db1434055c825410486adcf1c38187d9866c465f03d1715b271df1f7a90afb8348e2fe3b49cfe5d5602f086dfad9dd109a39b02a3726a3d45254eb5474a7e34d4da3f879667a59734699e3ecccd3471d50962b1744b65cdb2a7f7f0b6bf36318113d7f6373bb8eaa25abf51cc28b17b1c4223edf6c7be42e7dfc9f328efd863602777a8a719c9a79e7455e633cfaea44b99a21b715dd3d8d7d6d78a9d1d73591b4dc3a7e4ec4239cf8a8e16d7733d09f895658d0ea55c74792f8c2b8a445d483a8f6ee49d27ef84e922d9d7a301f7d720e8eef171f2d0d9d29318609574cf21f4f88050b2b3f8cc08fc298f4421f457a26ad42fdbcbb639066cf37067d3c58a35c14d75c5dc4a16291e42e4af13605997d8f500d95b990758db0fa4122080a1bc63b6fce6c6fd3b39ef1434f021b0b88ce2a5ac06f1fce17fecd74021311889256d4f745df648c5a7b493947416fbe659954e403609feedc1bee154f0ffda39593c6999952516950bc947f89042fc53ec94fa786020c64713fd4648dcff492be160610637f3d6b4bc850b723dc3319e6e46ae39a9a71a9d716b51174f4547c9fce37527fdc8f191feb77dde97a8ee9abddbc9f53dbf41a4a3822d5bf1d6f8f93f84d1a3bd5c89391a69cefd07a1664524a8b85b1d713d1c6bd8a877365caf0f13fbb935d62823d17bc00495e685946a6aa143ca5110b2c78beaf4a10036a84edcc91cb53bae27b3c732f15551aa668b27cd068a67f86630cebc49c043867a82413dff6674e847c2b38da099981ef376639ec47f76c2149f3c081cc173a503bdbdaa610c3e9b908e8450df24cb0cfdd41c603db4c84a04316542bc763e476048989cd5a3085c4a03746e8dfe8d097c739f1ea25ad7ad3bc907ebe8c2883ffb30e11b78ae145f7d1c49048426f679d152cf7c630479a2311cd90b3b52bcbcf80578aece45a04f3e4f070faa1de584b61cd35f95ea736395a338f6a7349eced970ae95d10131f6a9e3ff62d4f983a352143c6271c86b7b9e7019e45cf7eddf04c66d9c505f75e719db91c0bfdc46e400faa9b5172b93aa00fba8534ba1b25adeb0b72e4928b7944981521a00cb143d40a0e442572b5b9822a1e2545e7b99aff3a11b96b2a3b1577d4f52a893edc13b5e9b6b302f705844c11a56cbed350d6740e76fe4ef76326e8f1c9b659760e367fda52891da3cd7f4d496fb78c047f79096339669d5029113612d4fa8266b8a9ea0f8208d9daffea164a3de8412a01e0dab38d6561a8920d4e874b81c1fd9e339f7871386c87e9f1140fc082144a6570e03f6bf1ef0c1fac268d9d06d9faf68b7a2519bc6ee054f9f3d000de8649b1cc0bd10583cf82b0f89f8a16c80ef37769a21c605a80d3221f73dbde146abb1f9cdce33749d69a9bb412f5bf624569aba1e7d730d1bd5fa068f848a47e2d80f228eaefcde1edd14f3843bffb22532e34aa1f59c8b812486e8f838ec047f75f1a10c377f24b5e51587e4d23d0ab152651d00f41849d4f2cf15ee74e828fb1fc949704b7196246506997c163ddb5a61d4bba2d1aa88b3af4087e4361b078f0697978bb5d96e444716ebffa79cc9edcd12f25e1cbe009cf33dfaf7432fea99686af20420e23620f31298466418317f1daabe11840ed69bd5914b3474247cd4dd937fe6f7b4327493061a30a0c54de8450fb254e31f57fdd3b90bfff3ce1b8de3def6c9003aed706af66299a2b16e9be6f1a499335d2efa96cfd84a53008c5542787672cb03e17d5621919e1387c1656ca12bca1f9db0d8a2e34ced5d096631771256b224f621db61754a45df8b9af1ffbe93d8ab815c73095177892874f65959d0b12311a3315d82557c92db384fd878f895f32174e2967e51912655eb2167a83f4522c661b49a3367b72eca06a9e8d766ae496bf427ad4ff8b09977be9027fc132e995289d9d1dc66d4d0668935075a1bd4d72b991bc670a2af0da08af0276967c1e6003854b240a595774796d87d862aa5509f8b1265904c575961bae41eb52b12fef8f3f2c6120800db510f891335c0fa7c8b1f460cb06bfaefc69b3d0e2f3da0498879892dff64cc6c2d437642f86d7c97c221c88b206998c63d8135813b05fe4fd20ab34983b6a4c0bf0b1cac2f25b16ef9de8aa9fcf632d29b1ca9050cc3b02ec1dfbca1999da5b4c62e7606e1e0caf903bfbd0fe0b0158746ec74fe8c1c7e51e903be549e18da702a94f4e591d06ad3ea174b3e8fa34cba4fbd7efa8971c6632795124b403992c1814b107701625dc295d37d89953af73bb811e881f8f9f45c46491305c2437dec9929e3c30a46b42336de0afd58c45f0dbd6a08aaf9fc280c57504f01dbf887814aab3b428c8667b6fe4a0c4782559309607091f747d09bf1c236b0776c2ac86d973d1445f370cee4a981a7a10699ed37f6589f90aacc4bb056fa648d229b6ba28b8f880b20229cbd0888167d6afa5c109c17dcdfaceb729d7af841bc9eb8b0fcde6e01532cf916825ea9a689dacfeb18e53bdff93fae0ca9232c521eaf1726d297e805ee15bf18934e18dc8f5ba49c9983e2bb5ae4d8aacb34f1302806424ab839b4875bef31b5b2af18fe542477632e70b6ea375e084235d7cb94a25f214260421123ea9bb43ce500d76eb42f8c26f0cae87d878a571582b9b6aedfffdf80d6c75303e8408bd29fdea2bd1c5639cca5608f833d93bc6ac6c7673b8c52d5563b460c4381a38eef498039e6cd536c1edc6c6c12e481d1a82d18b2e43fae39835d0f0959695ef51a06e6e9e4ff701dc43f2b28641158220a206d82538308db6a53c02b60faac7fa4774a72c0d530d1a90c2d7bb6f173e2"}, &(0x7f00000010c0)=0x1024)
mq_timedreceive(r0, &(0x7f0000000000)=""/24, 0x127, 0x8, 0x0)
ioctl$int_out(r0, 0x5462, &(0x7f0000000040))

03:35:49 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:49 executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000580)={&(0x7f00000001c0), 0xfffffffffffffddd, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000090c000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012000c000100697069700000000014000200080012000000000008001000000000005f861c25c681a5fa8553dd04492eb90e26fc13e4a95b2fc8bbf7f9984b3e9d049dc01e"], 0x44}}, 0x0)

[  413.456872] Dev loop6: unable to read RDB block 1
[  413.462000]  loop6: unable to read partition table
[  413.491521] loop6: partition table beyond EOD, truncated
[  413.497239] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
[  413.571235] binder: 23539:23611 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:49 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0xffffff7f, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:49 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xd0000000000000]}, 0x10)

03:35:49 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x40)
getpeername$unix(r1, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e)

03:35:49 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040), 0x0, 0x1c0}])

03:35:49 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:49 executing program 2:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0)
mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000))
mount(&(0x7f0000000400)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f00000003c0)='bdev\x00', 0x100000, &(0x7f0000444000))
mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f000000a000))
pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00')
getpgid(0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001dc0), &(0x7f0000001e00)=0xc)
r0 = socket$rds(0x15, 0x5, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000008100), &(0x7f0000008140)=0x6)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100)={<r1=>0xffffffffffffffff}, 0x106, 0x100f}}, 0x20)
write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000280)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0xcb, @loopback, 0x100000000}, r1}}, 0x38)
ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040))

[  413.694050] Dev loop6: unable to read RDB block 1
[  413.699121]  loop6: unable to read partition table
03:35:49 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  413.740083] loop6: partition table beyond EOD, truncated
[  413.742781] binder: 23628:23631 Acquire 1 refcount change on invalid ref 0 ret -22
[  413.745778] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:50 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfe80000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:50 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x10)

03:35:50 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = dup3(r0, r0, 0x80000)
ioctl$VT_RELDISP(r1, 0x5605)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x7fffffff)

03:35:50 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040), 0x0, 0x1c0}])

03:35:50 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:50 executing program 2:
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip_vs_stats\x00')
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f0000000280)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-generic\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000001c0)="b7f2288a911993f0265df5cf1cdd8b55", 0x10)
r3 = accept$alg(r2, 0x0, 0x0)
write$binfmt_script(r2, &(0x7f0000000480)=ANY=[], 0xffffffffffffffde)
recvmmsg(r3, &(0x7f0000000000)=[{{&(0x7f0000000080)=@ll, 0x80, &(0x7f0000000680)}}, {{&(0x7f0000000200)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/113, 0x7ffff000}], 0x1, &(0x7f0000000300)=""/73, 0x49}}], 0x2, 0x0, 0x0)
getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f00000000c0)=0x2, &(0x7f0000000100)=0x1)
prctl$intptr(0x1d, 0xfffffffffffff2fd)
write$cgroup_int(r0, &(0x7f0000000140)=0x6, 0x12)
ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r0, 0x40045730, &(0x7f0000000180)=0x2)
ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f00000001c0)=0x100)
clock_nanosleep(0x0, 0x1, &(0x7f0000000080)={0x0, 0x1c9c380}, &(0x7f0000000040))

03:35:50 executing program 5:
r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000280), &(0x7f0000000180)="a4", 0x1, 0xffffffffffffffff)
r1 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240), 0x0, 0x0, 0xfffffffffffffffe)
r2 = socket$inet6(0xa, 0x80806, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="025cc80700145f8f764070")
r3 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000300), &(0x7f00000004c0)="848432503e1ac2bae9d92c5d144121fbb1962144eae8978bd4f065eadead9ca85fd3c49e925de4007488bf80a2152f25efb149bbddc4493ad0c625b2e5cfabf2f745b9a6586673f693fc49f3b2e10e38afb34f9befefa874c9e7033ccc0e967bec6de22d59ece236cb34ca95781888a02e9796e3342b40b123e5f81ff5e34b907efecba4cfbf634fd3fe7f546dba4cdcc4fe13ac83893eef8276820db8efd0e90729fb71a71d96dd945238acddb8375d4b349d571748902d266efb9ab909b8b6", 0xc0, r1)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x240403, 0x2)
ioctl$EVIOCGKEYCODE(r4, 0x80084504, &(0x7f0000000340)=""/202)
r5 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f00000001c0), &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffe)
keyctl$dh_compute(0x17, &(0x7f0000000480)={r0, r3, r5}, &(0x7f0000000640)=""/155, 0x320, &(0x7f0000000600)={&(0x7f0000000580)={'wp256-generic\x00'}, &(0x7f0000000000)})
r6 = getpid()
ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000140)=<r7=>0x0)
kcmp$KCMP_EPOLL_TFD(r6, r7, 0x7, r2, &(0x7f00000002c0)={r4, r2, 0x7})
r8 = syz_genetlink_get_family_id$ipvs(&(0x7f00000005c0)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000800)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0xa60c7651dd67c47e}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x98, r8, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5a76}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xfffffffffffffffc}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x82}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7ff}]}, 0x98}, 0x1, 0x0, 0x0, 0x800}, 0x40)

[  414.332221] Dev loop6: unable to read RDB block 1
[  414.337271]  loop6: unable to read partition table
03:35:50 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x101000, 0x0)
ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000140)=0x3daec06)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)

03:35:50 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000]}, 0x10)

[  414.408932] loop6: partition table beyond EOD, truncated
[  414.414617] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:50 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x4c000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:50 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:50 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070")
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x84001, 0x0)
ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000200)={0x1000, {0x4, 0x1ff, 0x8001, 0x7fffffff, 0x26d1, 0x1ff}})
socketpair(0xa, 0x0, 0x9, &(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000180)={&(0x7f0000000100)='./file0\x00', r4}, 0x10)
r5 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r2, &(0x7f000000f000)=@abs={0x1, 0x0, 0x1}, 0x6e)
bind$unix(r5, &(0x7f0000000040)=@abs={0x1}, 0x6e)
r6 = syz_open_procfs(0x0, &(0x7f0000a92ff7)='net/unix\x00')
sendfile(r1, r6, &(0x7f0000000340)=0x102, 0x800009)

03:35:50 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000", 0x20, 0x1c0}])

03:35:50 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000040)="0a5cc80700315f85714070")
ioctl$SG_IO(r0, 0x2285, &(0x7f00000001c0)={0x400000053, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, &(0x7f0000000180)}, &(0x7f0000000140)="ab2e27f215c69e75843bd3040493953f330ec534b3e7bd600318069fec14ffb594", &(0x7f0000000600)=""/4096, 0x0, 0x0, 0x0, &(0x7f0000000080)})

03:35:50 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x10)

[  414.533880] binder: 23628:23680 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:50 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000000100)=""/200, &(0x7f0000000280)=0xc8)
r1 = socket(0x17, 0x803, 0x9)
ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000300)=@generic={0x3, 0x8, 0x8})
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0x9)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4)
r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='/dev/ptmx\x00'}, 0x10)
setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f00000000c0)=0x800, 0x4)
ioctl$SG_GET_ACCESS_COUNT(r2, 0x2289, &(0x7f00000002c0))
ioctl$sock_inet_udp_SIOCINQ(r2, 0x541b, &(0x7f0000000380))
ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000740)={0x6, 0x0, [{0xf000, 0xe, &(0x7f00000003c0)=""/14}, {0x5000, 0x5e, &(0x7f0000000400)=""/94}, {0x7000, 0xfd, &(0x7f0000000480)=""/253}, {0x6000, 0x5b, &(0x7f0000000580)=""/91}, {0x100000, 0x63, &(0x7f0000000600)=""/99}, {0x1, 0x91, &(0x7f0000000680)=""/145}]})
fcntl$getownex(r0, 0x10, &(0x7f0000000840))

[  414.632836] sd 0:0:1:0: [sg0] tag#2065 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK
[  414.641639] sd 0:0:1:0: [sg0] tag#2065 CDB: opcode=0xab, sa=0xe
[  414.647863] sd 0:0:1:0: [sg0] tag#2065 CDB[00]: ab 2e 27 f2 15 c6 9e 75 84 3b d3 04 04 93 95 3f
[  414.656825] sd 0:0:1:0: [sg0] tag#2065 CDB[10]: 33 0e c5 34 b3 e7 bd 60 03 18 06 9f ec 14 ff b5
[  414.665770] sd 0:0:1:0: [sg0] tag#2065 CDB[20]: 94
[  414.671847] binder: 23697:23698 Acquire 1 refcount change on invalid ref 0 ret -22
[  414.685625] Dev loop6: unable to read RDB block 1
[  414.690637]  loop6: unable to read partition table
[  414.725070] binder: 23697:23707 Acquire 1 refcount change on invalid ref 0 ret -22
[  414.725421] loop6: partition table beyond EOD, truncated
[  414.738525] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:51 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x40000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:51 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:51 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2f000000]}, 0x10)

03:35:51 executing program 2:
r0 = eventfd(0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='pagemap\x00')
sendfile(r0, r1, &(0x7f00000000c0)=0x730000, 0xffffffff)
sendfile(r0, r1, &(0x7f0000000080), 0x3d3)
openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x800, 0x0)
ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6)

03:35:51 executing program 5:
r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff)
ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f00000004c0))
r1 = socket$inet6(0xa, 0x3, 0x8000000000002b)
getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000480)={<r2=>0x0, 0x1}, &(0x7f0000000540)=0x8)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000001b00)={r2}, &(0x7f0000001b40)=0x8)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c)
sendmsg(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000005c0)="3c92a890325a0e772585edd0636ff9c6af78f08e4bb0de45b0fd1dc6674c6fe162826904c38f0af58be7cc2949f739cbf566b699af5ac46589f43b4130246c3d3fa318dfcaf20fe64f32f606b2a88108b354c03f795f6f762c97a72d50b19191b2490dffd0aa6ecf1e2ab88794afab566ba12ea4506fd5f03be44d92baf3413a889c61bcbdfac681a8494b5c9bca9bfaa0244c70c17190823fd367079926c9dd8d5e63bc65693f725b4d0b39798b6d0fda859e1abc6b26d0ae97e11f327eb709951a7c87fbe7a6d63d98fccb3dea972a23157b1a97f9b6ced28f161d1f2dddc0bf60884dfc5cae270b77e8cf19b2abbb42aafaa3bf29b88c8a7e23f6fc50346a3da5bffcdc7a25c898f5f574e7569ab2c09644709e3723e99f46d3c5e29447413f09211114cef7d311b94cba0a63f162994a36a4972e96347bde4ff1c5e8e333a9fcab9057ecefc9e961b712207a2017e07d3c4c3f04701e851ea1d077d8223394ab4e2946c07d14a0d38cdd5909e710294cd4f8b7953224265b93fdae2202c42ab076c0aecac311926925753f408a27f247dc463027ea7aa3fb7378024cee52c657019a88cdf762b00a7dc63153215c82f2914233707aea15c744aa2a531a4839112c3ddab8c0e224d050a048bf6266656de2efef83b37fce55ea9d7a6a558f6dce35c46ecc9aa139d526fdc6d1e5b4fbd083816027aaa8bf450e4b0777ccda08c5c63406d38e4cc08d8e0bcda20dad6f7be3713002811f25d568c8eca502c364727f2965114326a92b8333b8d29c1741e69742fba96a75ddc98cff7f0b61449fa1b468ec1620aac455025408047f0284a13f164bf223e635a8be678310fb1d92657919edfd561b5b3cb4db24dea937bee502027137fbd71fb96001b79884d6fd463041ecc3df6c9008002d2e7306ca55abdebbb31caf0a35f0dd8bf7370a95b0deb5e52c98e53f8c926ba522f3aa6e1c2958b7bc25483906751dc16bf0b1a176ba20c274042a956b33e5d9cfa4891d2a4d108a6c72b4235e59ed01057c5c2de7162b3a4b1e7d1bc8f60ee9eb2cc620f00e082c7566c06a1763846183364ff36d2cd18d99a03515cf2093ea22343701d9745e1525060d04c922a888549df55346b97b6dfb406cb750f87d43063cfb7933450e408330700469ebe4bb06cef9c568f10f2bcac31c21990b37fa22ca8afd2c2b328ce21270df2e92a81304e0f9284c39340cbfda7a81e8693bacf4ae32407c04c0ecb3e0eb639d7bbefd35f2782e91f7bc4e2b345fc88252ab375b2fb36d31c20e91dd88c850c32f82166e19d8373b7ab436fd56b5a3710872203ebacf68b32783bcfce494152f304a2fc2f1ba2285e3c69d15b4bf23272d5a96e35c997d6f4d2fbcb63600acb33e4b50a1c94835a346a78a129fb34e6b6c6e8f4e0f8473f9bd82a11986f2a6b9e1c7feffffffffffffff7719410883b5fd597a4ae7046a6d492d164e17d5082ade546a6b68eabb03633635a8ff207b0ec2a2ed73e89996aacaaff8b3dadb246a462a66b1b5a1bbc9c949ea5236d57383622fe513afc6fdd350c46032061a2ed2fd6d3a5f4a21b24f740bbd6a378edf004fe9b055e1aeb713a5c0a541700c1e52c2e186fbdb940af4426ad130da8917e7d03490994d335ec6d3f266b8a111285582d2b699a0ce54219aae24b1874c1d53180000000000000000000000000000eaa80cee1c6b3f1f1d37759027f79e5ca9f87886e49c83837023ebd8773dd2987d5779e1caaa4b2633b983657cb3c6a3e26899dd9db964feb27e3c50766a8e69dfcdca0342a1596025afbd99ba75ab8710cf77612b8805b308fed58d50bf69361859afca7da8568914c0a056e39c6557729888af50", 0x52d}], 0x1, &(0x7f0000000100)}, 0x0)
syz_mount_image$gfs2(&(0x7f0000000000)='gfs2\x00', &(0x7f00000000c0)='./file0\x00', 0xffffffffffff0001, 0x5, &(0x7f0000000400)=[{&(0x7f0000000100)="dc33a544fe47d904cafcd162aa4fcb0780274c23a2901df275527e12a296c800fae106eb82922df75a9ff54d927cf6e01757c87210292356b0d75038aee1b9d9d19f3afeea642eb81b09429ae8f63bc263bc7671df3064ec3c52f7e11d5e1987a2c869b99968667f25a9c065", 0x6c, 0x8}, {&(0x7f0000000b00)="c7df3216a24cd4acee6ec4cfda9cd4371220850a719fccd2dacd9f7a499740c1ba718cd4a2f11cd3985f1aad248cd41c5034672072b505ec72ffd1b71bafa2812f4ff2ee4d47b4b32ed6f989a6046e6b5c614ef4af753c59fa7b3c8f72e0cbdc35f230030d1645e00f9469edec4c7f2bc1d40da73b05d2819da22e34004a79e8e61f0d34ae68c709ec94bf60c94d3f152009b0b9cb4252f82f1418dc6da2cad24dac2ae82bd975e7c1118ed2b3dc60a2326d9125e4a0fb50bdd2d2cef6c2ac7a857e35f45302272c48017b0e33e854f95f64686d657a78b049f4e023761de323dc4b2876c301c1101c5451ab84f240a2b585e730a01d7e17fe34098cad2e41dcf3018203a06909d0afadd360bdb705e2f768ed0a5c7e40fcbdb84bbef38e6435a77e0d8187c2316bdb62070eb10cf82f42422fef3524fde40bba98a7103eeae4928c48c896044f98df517dbdce4a5eee642d14af67559989f51bf43a79056cc3bc75a2c5bb3f0551c0c03d79e102e58abaf196cdfb694c768a06cebe63005a7dbb16b1204d06367210449bf33acd3de2dafcfea0b9d570ad378cbc3c44dd941faa5e0a46f645bcf76d6c831167be051d24aefc24d7d21c63f11e7a9ebe22336ee8726d0aa590e86239e4909ba450b982068146d069efcfde7f3cb8e4cc77602f91664b6a1124262fb91b08199053508867da93017b8dfe9273c7a41cb2041a8dc5571605221570fd29a0cad18da80f48c77593affafb08fe1e4229c941d40ece55079211600d5591356c9a0597c42e9e3491e33b39a2cc7406c45943d014c96fa0217393db7177f4c62819b22eb206539d2cf4ae47bbad0ffd6a17ff97fb3825ce9644b6fb3c0188f7baeaced74d3c7fe3417f14658811df1e603b871022c3a0fb46c538bf173de4d6a5b3f34b371caab2223724d553f2a972e2fbb6a3dd4e6d31cdeb4ce86d899e8330166241b248f180f853babb329fb773aafcf5f1339b3a1055b20a3b1db22cf85a0c66ea3d4df543f51aa80f77118505681890e51e39a0a114b5f43930f9bb723e9c82320c8c8038422017ac631d5643d2f775bb5a259e3492c3bfdbf075bfa3019a57f913a74dfb577cfaa51d662dcffb6ec194392295c6fd6ae6b1212850ff99505db195cd6e32bd75f88bd9be9e85158f10227be80aea5c07a63dfab3e9c8576fdd3611b77ef4875113b05a887529cfb5c6e0708ff955202f9517518c5cbcd0cbd4b79dde2f8dbca1a1353c39bf404278de5d3b82e4fdf0c207d797f3ed42266fed94095105e22b36fa5dbcfc489f6f4cc332351baf36faeacd2824ebd2faef9fca0101ccb39b467c53a281f67fba786b8f68ae75056623be0ef9c0836077b023ddf7d7bd552ba623ad7487943d32c7196f6644bb080cf41568ae45ea22c9a05c535e2300139ca0b46fcaa9de30482f7ae060c72b37df4289175c695b8bc2c6e45f33c178494c30b69b92f85466de1da0587a2d828fbf6861218a8d80a0125f9713114ebc29160cced3d68100a78db87e1dd411c55fd57e28861cb10878ba8e2e1f63720350e47e5e83343c8d26b06d7422e2519f7dd60a8d74292157b216f3a1426eefb8566fe9cf2991204faa9fe69a0ca9c56b333720cd02af8bce6f2bda4710a38bdab775e12cfca9a30bf9b29c693f025d78f12656be126bd5b0c270b8217b763889b9db2ba93289d534e83d11ee36c639269b4ae0fc788fa309ee39a44742dca42d5847e63723970ba0a2c0b33834ffba77b99cf0dee2c5b16c6ae2e5bb65a683ee6d2a4319ebbba1ee5c04c557ff31ad9132e188ec9cdd544861615f92bc93a9b8ac2f33fc4449fc20ce35bfbcd692cefb889ffe3bf1b844244cc1ea838a95c723c585da1071999c1386092bf07d314bee5d3dcc010704cf3d73e52a3bb02a6192fda2f595d4ea39084b4bb203ea7a891037e2a73e3a73a9fb30284ac46d36899e9ad453053292904e27ad84b5357c91857e54d9d0814bb9704e44ef434ca276349ef0ad1859db6d2a5385bbeb6a8b8b95c5137d8769f75c8dd451217a9f51b9db6d7978696f6cf44ad992267f01eb0532dfd90bc1c1831532f0b908e6a5d3a469b457ec8232b5c9634a31b283a47e5f882b4909ed0ebb8bf9e3c830a0cc3d51c05ae4d2eb3c9ec1fa0cda2ea9ed9bc233256715104110a773e94ba3905800fe612d785ddb8e1ed3d302dacdeefa6a08ae1fcfee41f605cd5d977f599db3ad5024272ec2acb0794d815713db59eacf51d02fba9b43bfb684bedd27657e4fa1325f8bfdf23bcbb1e20085a3600b9b77569872402b0df23e46c4cb122f1137abf2d35d689843d032c710da4ec8a33f9bb8195e0235748fc0123060864598c78338ba9b8a22aca6024c61fe07c20d185d67d6091c1934350be4e6e4e1b4da4fdd8edb7a437200bba584833d41c5435cf0f036b27706ec9390c4a660cd3369eef1a45ca2c8a93453e1d2c0d1d653158f6b3fd7a1d425ee32bd83388e2479c226305816fe0c750697b2c684ab7f3170a22ab643e7b1a3e557114f836ac5fbaa1f26247b0f5111479a164490b0fa3ada56922699ab0e75d66b3227c20ca7220fcb9f9861f5050712d902a56f1d4bb88e9d6e250ac0180da47162e6b7643cce40006ebebefa73d386ff60a5e0c2a37e64b0fc33644013ea8f1820f94462e5351c9e443002c8a53d7057ef5e14fa8acf05a405a77a725ca48afb155713d2c4d2533906be7e9f3913a60e2bd4993a8c77c2c9127296f8678b2ab1763fc0472842723779f06578ffb2ed1e6e13303196e59e55d8edc6be2281ac7365a1b5ab88063379e68f8a0b057c397e23deeb54e58268e6807622b07b982a800d512104c11a9fb8069fddc84eec7ecaa0e7d7be4910e34eb2c51d2a7b94dffef43f9ad6ccf9d1c15c0623bc5f1a12514b5b28169145fd96245903551a12d2caaf493449b9e1dfaefafcdbf19891a78b349571f3bf2bc68d2b28c3aafff315cd64fb88384eeb84ccee2f80ee93034943335cf29292e6bbdbc2a1e42610841596a6d48e2b6633d765ae5e60dd9eee79adecf3fc1e2fd43087a7f24fd2b6e73375244cf694542782b3f429cea9340854034897ae27ad1ebd228ad7ee383a7cd25d93e9b2c09f0ac664fc71fd93eaa257dc9377c563a734ddea8d1262a5a40ca42b6533de4260a81c4a47ab4b2f566551de3b767b04732b45cf3200ed8d417a0cfa91543f71997d4aec1e3a12add3283e2ccc6e5028c7ce32fd1fdda8f9e1822189ae86ccb8722460c0dd8d3f619c7c4f8583777cdc9c1056c2b192b89bc34caea215f2bcf649fa33ee3a81fbccfe4e65b39d701a0b9ccf714bedd29daf1686c3640e6d24966c8251f7e64126cf20068ac893e9a7086abe8eae8231163192785a5a92b7c7b78d3d06e2003eb03537571e2cdb378589654089698b470a6f527459abd4ae00a4413f9fcf1f09e855d9c9c0361b946a414ce3c5f1d8feeae6b6d97ab6e900fbebf5ed1e2be148d2610cc07c330373ac553f04bbc29760b2107d79bb77d6d7d9aa99c4d2211a90da07e21463938a792e6811664c22f1c21ea7d3e06066354f4840d6c7644c8db09f26a1e78938cf2a8ecbe85c475c5eb4327939fed9b56b8cb5796a3905acee8456a8accfa1909cdeb8639e107938aea44b62e348f0b527382205e2cf893c513c9ebd18fdcad1800146a279b2e1b3655d31766428cf7205be75db253c8778eaca9bec9c9450634ce52b6ea74fd003bc046ba264ff047e072ebf74013b7feab4a6ee764ca4c9a6b6bbcd58fc8ad32b3b0493ca470922ce7510803e6a45ef84656739a200faff8e4146a2bfcf08cdcaf7e2b4e848ef962432a4ccb82dd1b0b32059ed7de9ff1cad12dc928ed1b1c9e0cdc56fe2e521572307929f128816696921f83e50fff626a76bd2f6097ec94c7a14696291ee168a88df800e83909419404bc06b52b028e4a9fde376f55e93e9ef237ce9daa273451c2281eb2dd6afc043cd5b481d1c91da6d2c30f05dad482493be502afab450fb06c47a21180bba5bc1e4f9d3a2c734272c2ca23d9631279fbb3d3fcadf3724f85c25c073e020c39e00ee770b059fa3549be155e73ca95739a75593c47d6fbe1dffea189e9d930710ae91fc65081fb48587f5840a5b8457fe317d6d41b2c2fa46df9873b2165330790eac36d09219adbcbf3f901b1c0edc90dc5703164f28c45f0efb65dd0e4120ffb30c1db2d4eed2b72a0ed9ac3776bb7f33e5378a7ff5445aaf65da9420cbd793c91f7dfaa639044e335a8c1b0453127ff5b12b6791c459a1fb566c7637481e986b83fdbe3c5aaf4ca51d49c25a665586f23f36a6222c2bdeceaaf9ce6ce37cbfcb37f5ddf59b1fa6488fced72a32917257a47f6cc596d809b04506db8922806a3e2398580c0e18e48580f2e3337f57dc4c8302a1a683289b5c7b74e3135d96742c6cdd656bc7c05dc786b38c5c3d671ffdb521f145037958c02896ce5276af04282cab3b704d104ebadda27b3cae0c40be52dd5e48500f69acc0188aec2b0e94506d1b2a59af8ccbc7e0df152bc834e4df6cddad35bbe820c27eb46b415995547ba6f2f0b3e37927abf327d4845e1224bbb777c017d4f251bf58cd4dae72f6a634d9d3add623bfeb116a323290ab9f02cfcdb34842b05bd2c343daca864a4296e55ceacd678bc4e7e341f82b463f15e9904e37e5072bf1d47e4aea02ef2b1609a74b2cb3902248d8f1aa3d87a01eac5d8c90a6d8c317f342addb2ee160409bfb934fe3d06bbbbd7f74833b0f5a526efa7ea8862a472299a0c3068e7674c89898280cef5551ce68d19940f26a41a7478597a855b708de0cdd7f4872e1630bfeabed59fd3e0ed6dee685f118f47b9a9a42c27856a5f0c148171234ffbb86f709ce25b8257f257d773b954ffdaebb14cac9d28f38fa627ea7e8f18853c035ee6734d35777e34dd81084011765f11599933da90e6b705f71017812c492c5678c6ec1b5b81d7fdfcb597a47436329d206712723a21b856fd16a9e83841c4886c125aeae059e4562f06d1b11535ff7d862da1feee97339f62bebd2e3481f076d673fc8f5ae010bd4dae31be258f72178abab49eeded5aca8d57df73dcb3e5d5277b2767c0a8a4d11c865269c39f6333572c090adbeb77494c45db8d6e0fa735778eada7d7c67c285f66e3fbd0dc8e9ddca4e8ad75eb311817cad367c920f5f4ebe6612bc8d864a532785556c4e209c13f57d56506dc5c2d5e6df8f2b8bcda116fb04d9665bd162b408a5ce970518323aded356522859cc034e19d4b70a32100c5188f736aff4a3c223dc6f6fa414affe9d0e64e9f449bde7c631d0ac98e6b768c49dbb69554adbbd6fbfbb56b43fcf7374cc2d13931766d0ef34053a5fcd4f55e09bc1953fcc7435fc9c317f63994811bba6041a8cb2d3004b102f99c6bfa0506eb756c6e0d9261d6f5396c60a1da365808bfb806d6e18e0c62ba274afa5a5946e51e023c18cacd068c08e6270fecf08f17a81443053cdfd6d9a296976047d7d7809a6ec978b1f0058ab40facf0c40b36c617b29b4616eed76caed89a810b815f4d3f6d504114434ca559fe0b91aaf7dfb1bf3a263654a62466933309b3080ddaef010a6333d317e92665413679a27f385f68381ec8518854ea969d4267c8dfad376fb63417eab9b6b1fb314a97473b853d620a08b67fd82ce005cb8e18677bbfc49fcbde6325793c5adb6c2c48d615202075f33c0fb3b9c0686d2f05570c6c67d42f1e639133de4482aca55370e88641faa6d51cd392ff3", 0x1000, 0x923e}, {&(0x7f0000000180)="795b9270ffac10cf1246feb7d439e3ab6165315139971ee8665a58d0842fd44141b39eed4ee3394072e6d7d978ac059674823e47fc7d3a0644127fb984912ea02986e275b6bd6a88ac7dc86ddde05897f78f60d1814beb2b8f8919d67aa8f23557292bc03548d192ad4580c98863c13dc2d5abb1ba19b1c2936b1f176c27307198fe2db17712c86c056d27ce65f29d3f9dcf5da8d2f5dc4a3c350ddbf29fde5f73ffe8ae0b0ff48d67769d0f5957495d4e5a1753ff2849a19c462409c2311f6593ae27d6ba2407246daad87e9a6c3852996a83a9073d7355d8428f66a35d56db6dba0523b04441d41ed80888aaa599", 0xef, 0x400}, {&(0x7f0000000280)="1ce2d487481adaed17e01d4670fc52d04c5532ce83226c45ddd96da44f57c6dee17cab2cb61f99d69e15b6af0d0ea857da3f1b9a2744f8fc0255d4ca05be3d183f7bd1b3272e5847c72bb34fb37cf81a6c86a7acc7ca3f3732bab639b67601cd9922733d69be4c97ae5dd86986eff19f82f19aa6bd3cfa33edb6c59743a0fc7473065cea265df7b4a2618461578122d93f240469ef205ea2b1b6c851faaee5adf2d67c72a44cdefc432c355a7ca92ba11d440b414e8f5f0159882861579c82dae1160f8655254d2b4033526c5b88ca7ee8825560d387be4d1308f7137138008d3a5508db585b495d49f9cda8b4289aa3c86840ddb6592953da5d59401ea8", 0xfe, 0x4}, {&(0x7f0000000380)="95837e1b9538d698eba181abb2318c49fa016eb00db76b8443f2ca522c0436b9463e1fb6429bc0a0fce31d7394a341388e0822a036d2d5b1eba9142f2aca958b61edc13beee88ee708ea0667e394b2e03c8b4e02", 0x54, 0x1}], 0x1000800, &(0x7f0000000500)=ANY=[@ANYBLOB="62617272696572385e54b2e527da3de659de3663d373722c00"])

03:35:51 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x4800, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:51 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000", 0x20, 0x1c0}])

03:35:51 executing program 3:
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x101000, 0x0)
ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)

03:35:51 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  415.209046] binder: 23734:23736 Acquire 1 refcount change on invalid ref 0 ret -22
[  415.226085] gfs2: invalid mount option: barrier8^T²å'Ú=æYÞ6cÓsr
[  415.232290] gfs2: can't parse mount arguments
[  415.239406] Dev loop6: unable to read RDB block 1
[  415.244360]  loop6: unable to read partition table
03:35:51 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdef]}, 0x10)

03:35:51 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x8000, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x2502, 0x0)
pipe(&(0x7f00000000c0)={<r2=>0xffffffffffffffff})
fanotify_mark(r1, 0x8, 0x0, r2, &(0x7f0000000100)='./file0\x00')

03:35:51 executing program 5:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0)
r0 = open(&(0x7f0000000380)='./file0\x00', 0x0, 0x0)
r1 = openat$cgroup_procs(r0, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0)
userfaultfd(0x80000)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
read$FUSE(r1, &(0x7f00000003c0), 0x1000)
openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.events\x00', 0x0, 0x0)

[  415.295618] loop6: partition table beyond EOD, truncated
[  415.301362] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
[  415.316997] binder: 23734:23750 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:51 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:51 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x6000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:51 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000", 0x20, 0x1c0}])

03:35:51 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000]}, 0x10)

[  415.520563] binder: 23773:23774 Acquire 1 refcount change on invalid ref 0 ret -22
[  415.558615] Dev loop6: unable to read RDB block 1
[  415.563625]  loop6: unable to read partition table
[  415.625375] loop6: partition table beyond EOD, truncated
[  415.631094] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:52 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xb80b0000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:52 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1ff)

03:35:52 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:52 executing program 5:
ioctl(0xffffffffffffffff, 0x88912, &(0x7f0000000080)="0a5cc80700315f85715070")
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000140), 0x7}, 0x20)
r0 = socket$kcm(0xa, 0x122000000003, 0x11)
r1 = msgget(0x3, 0x100)
r2 = getuid()
r3 = getegid()
fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000480)='/dev/rfkill\x00', 0x408640, 0x0)
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r5, 0x4008240b, &(0x7f00000004c0)={0x1, 0x70, 0x7f, 0x4, 0x7, 0x8, 0x0, 0xaa7, 0x1006, 0x7, 0x3, 0x100, 0x5, 0x8, 0x401, 0x0, 0x7fffffff, 0x0, 0x625bbc1b, 0x0, 0x7f, 0xd200000000000000, 0x5, 0xffffffff, 0x100000001, 0x3, 0x8, 0x3ff, 0x6, 0x7fff, 0xbf, 0x20, 0x7080, 0x5, 0x7, 0x7, 0x80000000, 0xc70, 0x0, 0x3ff, 0x2, @perf_config_ext={0xfffffffffffffff8, 0x39967444}, 0x1215, 0x3, 0x9, 0x4, 0x8, 0x1c2a23ea, 0x8001})
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, <r6=>0x0}, &(0x7f0000000200)=0xc)
fcntl$getownex(r0, 0x10, &(0x7f0000000240)={0x0, <r7=>0x0})
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000280)=<r8=>0x0)
msgctl$IPC_SET(r1, 0x1, &(0x7f00000002c0)={{0x1, r2, r3, r4, r6, 0x10, 0x4}, 0x3f, 0x60eb, 0xfffffffffffffff9, 0x8001, 0x80, 0x66, r7, r8})
setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f0000001480), 0x4)
r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rfkill\x00', 0x10000, 0x0)
ioctl$EVIOCGSND(r9, 0x8040451a, &(0x7f0000000380)=""/210)
sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x40030000000000, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f00000001c0)="035db86376863a68fe800000000000004208d549d7c403469d7f6e6a6ac7d846ed2fa163e15ffb509e", 0x29}], 0x1}, 0x0)

03:35:52 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}, 0x10)

03:35:52 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000", 0x30, 0x1c0}])

03:35:52 executing program 2:
r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff)
mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8, 0x6012, r0, 0x180000000)
recvfrom$llc(r0, &(0x7f0000000000)=""/124, 0x7c, 0x12102, &(0x7f0000000080)={0x1a, 0x320, 0x401, 0xffffffff7fffffff, 0xfffffffffffffffe, 0x20, @local}, 0x10)
pipe(&(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000100)={0x1, 0x8, 0x80, 'queue1\x00', 0xf3})
r3 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$read(0xb, r3, &(0x7f0000000240)=""/31, 0x1f)
ioctl$TIOCNXCL(r1, 0x540d)
preadv(r2, &(0x7f0000000300)=[{&(0x7f0000000280)=""/115, 0x73}], 0x1, 0x0)
getsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f0000000340), &(0x7f0000000380)=0x2)
r4 = semget(0x1, 0x2, 0x84)
semctl$SETALL(r4, 0x0, 0x11, &(0x7f00000003c0)=[0x7, 0x1, 0x6, 0x7, 0xffffffffffff8001, 0x57a4dc1b])
getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000480)={<r5=>0x0, 0x3}, &(0x7f00000004c0)=0x8)
setsockopt$inet_sctp_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000500)=r5, 0x4)
perf_event_open$cgroup(&(0x7f0000000580)={0x3, 0x70, 0x81, 0x4e, 0x7fff, 0x0, 0x0, 0x77a, 0x8000, 0x8, 0x6, 0x5, 0x6, 0x0, 0x0, 0x40, 0x1, 0x10001, 0x7, 0x3f, 0x8, 0x8, 0x8000, 0x934a, 0x4, 0x7fff, 0x4577, 0x196e, 0x10001, 0x8000, 0x0, 0x1, 0x9, 0x2, 0x100, 0xffffffffffffff8d, 0x8, 0x4, 0x0, 0x81, 0x0, @perf_bp={&(0x7f0000000540), 0xb}, 0x8, 0xfffffffffffffffa, 0x3f, 0x4, 0xfffffffffffff001, 0x9, 0x130e2f01}, r0, 0x5, r1, 0x2)
ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000600)={0x63, 0x101, 0x8})
ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000640)={[0xfffffffffffffe01, 0x7, 0x4, 0x40000000000000, 0x8, 0x1ff, 0x100, 0x2, 0x9, 0x9, 0x101, 0x8, 0x3, 0x800, 0x7ff, 0x7], 0x3000, 0x111482})
getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000700)={<r6=>r5, 0x2}, &(0x7f0000000740)=0x8)
getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000780), &(0x7f00000007c0)=0x4)
setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000800)={{0xff, @local, 0x4e21, 0x1, 'nq\x00', 0x4, 0x7ff, 0x64}, {@loopback, 0x4e23, 0x1, 0x0, 0x8, 0x2}}, 0x44)
ioctl$TIOCGETD(r1, 0x5424, &(0x7f0000000880))
getsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f00000008c0), &(0x7f0000000900)=0x4)
semget(0x3, 0x3, 0x8)
getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000940)={r6, @in6={{0xa, 0x4e22, 0x401, @loopback, 0xffff}}, [0x1179, 0xffffffffabe5d445, 0x2, 0xe56, 0x2, 0x9, 0x4, 0x1, 0x1, 0x8, 0x80000000, 0x800, 0x9, 0x223c011f, 0x7]}, &(0x7f0000000a40)=0x100)
socket$inet6_sctp(0xa, 0x0, 0x84)
connect$nfc_llcp(r2, &(0x7f0000000a80)={0x27, 0x0, 0x2, 0x7, 0x1, 0x6e3, "290822be8766ab39036bc38d96dfda8fa849a425dfd3dd290c28a04ba605ad59a169a6b51a54e272a10af4d99537e06d2d573735261771734a06a112632b0d", 0x34}, 0x60)
getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000b00)={r5, 0x6, 0x207e774e17740e54, 0xfffffffffffffffe, 0x401}, &(0x7f0000000b40)=0x18)
ioctl$sock_inet_sctp_SIOCINQ(r2, 0x541b, &(0x7f0000000b80))
semget$private(0x0, 0x7, 0x10)
syz_extract_tcp_res$synack(&(0x7f0000000bc0), 0x1, 0x0)

[  416.174231] Dev loop6: unable to read RDB block 1
[  416.177624] Dead loop on virtual device ip6_vti0, fix it urgently!
[  416.179248]  loop6: unable to read partition table
03:35:52 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TIOCNXCL(r0, 0x540d)

03:35:52 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x10)

03:35:52 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  416.217359] Dead loop on virtual device ip6_vti0, fix it urgently!
[  416.245879] loop6: partition table beyond EOD, truncated
[  416.251728] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:52 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f00000001c0)="0a5cc80700315f85715070")
r1 = socket$inet6_sctp(0xa, 0x10000400005, 0x84)
r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x18000, 0x0)
ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000180))
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)=ANY=[@ANYBLOB="0100001c44778a23af6b984a91b3bed044b1cbf3faa13498500a927b68cb5e680f05a8abb33cda6693b2f8beaa4894146663f5df3204020000003679072ff29f119fd1ff1f64d1fa3af91a74919a9497ae8c3cd50b42736dcb54d3ab11da", @ANYRES32=<r3=>0x0], &(0x7f000095dffc)=0x8)
r4 = getuid()
ioctl$TUNSETOWNER(r2, 0x400454cc, r4)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x14, &(0x7f00000000c0)={r3, 0x68, "c5d9d23d12e28fa43a3eb85561860523edc08320ebeea42648092725d4fa5e4512e35bd57bab89ddc19ff37f09240cd8c294ce7d9627be1c52a884403a8e0713a1707e243deb73b8dae705566e908c0d1dd1382821a38594aa6b0d421d3c0c41fc90950a55a4e47b"}, &(0x7f0000000140)=0x70)

[  416.310583] binder: 23773:23825 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:52 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x7fff, &(0x7f0000000080)="0a5cc80700315f85715070")
syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x100000, 0xffffff2c, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5dc]}, @local, {[], @udp={0x0, 0x0, 0x8}}}}}}, &(0x7f0000000040))

03:35:52 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:52 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000", 0x30, 0x1c0}])

03:35:52 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x300, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:52 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa0010000000000]}, 0x10)

[  416.506652] Dev loop6: unable to read RDB block 1
[  416.511748]  loop6: unable to read partition table
[  416.526765] binder: 23850:23854 Acquire 1 refcount change on invalid ref 0 ret -22
[  416.541556] loop6: partition table beyond EOD, truncated
[  416.547183] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:52 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xe803, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:52 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:52 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000100)="26abf41e02cb454816a528f2a18a4369238ca1c22aff2c2aa8ecc38c6b05e49df14284e87efa4122607f8bb348ff7f2facc54d7521df852bfb6b2333cabf5bd9c95be3eb14cfa0736f")
readv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000480)=""/156, 0x9c}], 0x1)
r1 = socket$inet6(0xa, 0x3, 0x1)
setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4)
connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c)
sendmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0c00000000000000000000000000000051f3fe74b5f875bfc3eb72779a2345cd6f649fbae3d99653c33de00ca7433acd086fee99f8e2c212c646d93d4c95b375c8b850aa5b1753b299cca0c545282738316ae993bf82ddf74e3f154c2cbb8dd8617661016e7c9e4848114d0bd4008ae9ac2dba2f84ff54eb0c86aec6a947f6ea4c622a39a7c879c7c2d2e27c20fcc8c85cfcee6e960105d4d67f38ecae46c8efabdce263fb299036f0f945756ae916f1d10881058e0332b2b8b73d6ab0b5d3a08422d94579a64a9e7237446555fcc83ea419f23eb8ad84"], 0xc}}], 0xb, 0x0)

03:35:52 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:52 executing program 2:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
listen(r0, 0x6)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10)
setsockopt$inet_dccp_int(r1, 0x21, 0xb, &(0x7f0000000040)=0x5, 0x4)
sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp={0x18, 0x2, {0x0, @rand_addr}}, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(r1, &(0x7f000000a080)=[{{&(0x7f0000005440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, 0x80, &(0x7f0000005640)=[{&(0x7f00000097c0)="bf", 0x1}], 0x1, &(0x7f00000098c0)}}], 0x1, 0x0)

03:35:52 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}, 0x10)

03:35:52 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000", 0x30, 0x1c0}])

03:35:53 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:53 executing program 5:
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = dup2(r0, r0)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f00000000c0)={0x1, 0x8, 0x0, 'queue1\x00'})
prlimit64(0x0, 0x4, &(0x7f0000000240)={0x0, 0xfffffffffffffa16}, &(0x7f0000000280))
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000180)={0xff6c, 0x2, 'client1\x00', 0x1, "95d2d09362888aa8", "749c3067724581d77956d380754be166d1207c272fbc60c8171accc387749f8c", 0x40, 0x8})
r2 = semget(0x0, 0x3, 0x28)
semctl$GETVAL(r2, 0x0, 0xc, &(0x7f0000000000)=""/43)
r3 = getpgid(0x0)
perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x7, 0x1, 0x6, 0x0, 0x0, 0x8, 0xc000, 0x2, 0x0, 0x6, 0x800, 0x100000000, 0x3f, 0x0, 0x7ff, 0x8, 0x6, 0x7fff, 0x7, 0x80000000, 0xfffffffffffffffe, 0x9, 0x2, 0x8000, 0x7f, 0x701, 0x1, 0x7, 0x2, 0x0, 0x1, 0x5, 0x7, 0xf8, 0x5, 0x7ff, 0x0, 0x2, 0x5, @perf_config_ext={0x7f, 0x4}, 0x80, 0x6, 0x3, 0x4, 0x7fff, 0x3, 0xfff}, r3, 0xe, r1, 0x1)

[  417.074525] Dev loop6: unable to read RDB block 1
[  417.079566]  loop6: unable to read partition table
[  417.104104] loop6: partition table beyond EOD, truncated
[  417.109852] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:53 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}, 0x10)

03:35:53 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000040)={0x1, 0xb0db, 0xa4c5, 0x761c, 0x800, 0x5, 0x7, 0x101, 0x0, 0x1})

03:35:53 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x38, 0x1c0}])

03:35:53 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d0000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:53 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3e000000]}, 0x10)

[  417.326099] binder: 23850:23913 Acquire 1 refcount change on invalid ref 0 ret -22
[  417.339688] Dev loop6: unable to read RDB block 1
[  417.345018]  loop6: unable to read partition table
03:35:53 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x4, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:53 executing program 5:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000011c0)=<r1=>0x0)
r2 = accept$inet6(0xffffffffffffff9c, &(0x7f0000001100)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, &(0x7f0000001140)=0x1c)
getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000001200), &(0x7f0000001240)=0xd)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000001180)=0x2)
fcntl$setownex(r0, 0xf, &(0x7f00000010c0)={0x1, r1})
r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x202200, 0x0)
getsockopt$inet_tcp_buf(r3, 0x6, 0x3f, &(0x7f0000000040)=""/4096, &(0x7f0000001040)=0x1000)

[  417.383615] loop6: partition table beyond EOD, truncated
[  417.389336] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
[  417.514169] binder: 23927:23928 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:53 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:53 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000040)={0x1, 0x6, 0x7a})
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)
r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x4000, 0x0)
getsockname$packet(r3, &(0x7f0000000380)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000003c0)=0x14)
bind$can_raw(r3, &(0x7f0000000400)={0x1d, r4}, 0x10)
getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={<r5=>0x0, @in={{0x2, 0x4e21, @rand_addr=0xe30}}, 0x2, 0x4, 0x60fa, 0x0, 0x21}, &(0x7f0000000280)=0x98)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f00000002c0)={r5, @in={{0x2, 0x4e23, @remote}}, 0x3, 0x8001}, 0x90)
ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f00000000c0))

03:35:53 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}, 0x10)

03:35:53 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x104, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:53 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x38, 0x1c0}])

03:35:53 executing program 2:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x8b000)=nil, 0x8b000, 0x1000004, 0x10000032, 0xffffffffffffffff, 0x0)
futex(&(0x7f0000001000), 0x8c, 0x1, &(0x7f0000191000), &(0x7f0000000000), 0x0)
r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x9, 0x4080)
getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'nat\x00', 0x0, 0x4, 0xc9, [], 0x9, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f00000001c0)=""/201}, &(0x7f0000000340)=0x78)
ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000380))

03:35:53 executing program 5:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x2, 0x3ff, 0x1}, 0x2c)
r1 = socket$netlink(0x10, 0x3, 0xf)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000440)={0xa, &(0x7f00000003c0)=[{0x9, 0x1, 0x8, 0xc9a1}, {0x2, 0x8, 0x1, 0xfffffffffffff25d}, {0x4, 0x3, 0x6, 0xd1}, {0x2, 0x7, 0x80000000, 0x5}, {0x1f, 0x81, 0x8, 0x401}, {0x80000000, 0x800, 0xfc4, 0x1}, {0x4, 0xcc0f, 0x81, 0xbb}, {0xfffffffffffffffa, 0x40000000000, 0x19, 0xf0}, {0x604, 0x5, 0x8, 0x1}, {0xfff, 0x8, 0x50, 0x6}]}, 0x10)
r2 = socket(0x15, 0x800, 0xfffffffffffffffe)
getsockopt$inet6_tcp_int(r2, 0x6, 0x1b, &(0x7f0000000300), &(0x7f0000000340)=0x4)
r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x880, 0x0)
accept$packet(0xffffffffffffff9c, &(0x7f0000000240)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000280)=0x14)
bind$packet(r3, &(0x7f00000002c0)={0x11, 0x2, r4, 0x1, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x14)
r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x400, 0x0)
prctl$setfpexc(0xc, 0x80000)
getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000100)={{{@in=@loopback, @in6=@remote}}, {{@in6}, 0x0, @in=@multicast2}}, &(0x7f0000000080)=0x75419ab5)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f00000001c0), &(0x7f0000000040), 0x2}, 0x20)
setsockopt$RDS_RECVERR(r2, 0x114, 0x5, &(0x7f0000000380), 0x4)

03:35:53 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xd0]}, 0x10)

03:35:53 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  417.972326] Dev loop6: unable to read RDB block 1
[  417.977365]  loop6: unable to read partition table
03:35:54 executing program 5:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
r1 = dup(r0)
getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000080)={'nat\x00'}, &(0x7f0000000100)=0x50)
rmdir(&(0x7f0000000140)='./file0\x00')
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)=@proc, 0xc, &(0x7f0000000040)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000000170f0000000002000000061416770065e1e6926b3161cd83f38af922ec22ecd67718841333012e24fe6f0295209adecb27ac4623a7ea1189ce0a53fd1e30d4156ed8a3c694eaf409549d48d7734b67598ddc0e288af54c34aa0eaa6ca434b6f00be6a8abb091d62f1859e3fedd4be4e9e61665c3d3e2368d0c94b1650eb20baa7964a2de9d56765f011d98ffa4f3cac83a54f4edfbb7e24559319c6dc55b8732ae5e509996d2cb0f58ec7e4b6679662f5dda34c6f296b9e2119b0486e3a8672d7bbd740920d692b7057559bdcc28a3af0bcd8ab0267f23819e3416c03d8f00ba3f65c9a42d4376ad73cddc903941ca78f31d3fada19a0000000000000000000000"], 0x1}], 0x1, &(0x7f0000000240)}, 0x0)
setsockopt$inet6_buf(r1, 0x29, 0x40, &(0x7f0000000080), 0x0)

03:35:54 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:54 executing program 2:
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000400)='/dev/autofs\x00', 0x4000, 0x0)
ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000540))
r1 = syz_open_dev$mouse(&(0x7f00000004c0)='/dev/input/mouse#\x00', 0x0, 0x80000)
r2 = accept4$inet(r1, &(0x7f0000000480)={0x2, 0x0, @remote}, &(0x7f0000000500)=0x10, 0x801)
fallocate(r2, 0x0, 0x0, 0xfffffffffffffe01)
r3 = getpgid(0xffffffffffffffff)
r4 = getpgrp(r3)
r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x200, 0x0)
ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000003440))
kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000240)={r5, r2, 0x3})
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$int_out(r0, 0x100000002, &(0x7f0000003480))
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
sendmsg$key(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="2e1401091c000000271000000004d50000f3ffd004d40000000002001000000004d3000004d6000000000800120000000200b76b6e00060000000600ff00090600000101000000000000fe8000000000000000001300000000aa7f0001190000087260998ed21e5a000004000700000000000700000001000000020000000000000006000002000000000a00180001084600e64aa3d2f61feadf6705869dcc67feb80b335d633d621352439bfc70ceb18e74aa5fcc8f548f55d04123efacaabc01000000dd3d05fa964bbe00005e182e0b01993a645df1188e93e9a6c74fe58da1a754a405d2d646f556f9c65e22754a509fbbda87187cb90c937df308505a2e7dcd4cbc34c7499d3c2ead1b7240da4281e118a27079b8548651a85da43c9bd572b6a7bfcd33a6f163a202f1ef31ac1dd0750d87307f1ff815f4f11cb4b2b44f9f1db0767162896130d378de44761bc3d4961196c845a00c41613ea40b492c924fb30d05e11b01462b6302db1b11ad445efc0a661a33a678105df6b0c25d07d2ea4a7d4e42ef7af8730edd21715c035af34ffde4a372461a38b90900000000000000ecfc61a2e7ff9d712f9ea6ad9b45d9d18828d7581422cbb01760d6e6fd1ac6fe8ce317562498b4d57a8f924e491fd95a1f5d20a92d2e136cbefdd6d5729804bf2fce38e0ff9692e4ef899c1c6d881b1b168eb011474442e547966d64cdc5be46fe8374cf50e7a7a28ba5bfe6a147789500ff5d2379e287f10a14d587bdf6046d7d88c6975f6eedf2f15f1b3c4464ea519fae3613bc083cd2e05e41c4ba636ba05f8a21924f434f0dcd40473946e5005bfe0431b6d4d94bb400000000000000000063bf28114432f8e1ddbe886ffc5e926f4490e7ee254aa44f6e3de6c166415d02bf132369ab2036fb4c59b433304eeecebaf8f252e69b2d6a8e4ebcef54ae8d25df0b581f6cf2934cb9cc940c1c6e442ed6060ce810c8d9a8e3ac0a581e043fb8c18dde4af5e920ca4daea1a95bb8b0e2d8157773a09408abaa17cba444"], 0xe0}}, 0x844)
ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r2, 0x40405514, &(0x7f00000002c0)={0x9, 0x0, 0xcb, 0x3, "73797a312dfde3cd9919594d00", 0x200})
r7 = socket(0x10, 0x2, 0x0)
fcntl$getown(r7, 0x9)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000080)=[{0x2, 0x100000000}, {0x2, 0x4}, {0xb, 0xfffffffffffff001}, {0xb, 0x2}, {0xb, 0x6}], 0x5)
clock_gettime(0x0, &(0x7f0000003380)={<r8=>0x0, <r9=>0x0})
recvmmsg(r0, &(0x7f0000003200)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/116, 0xfffffffffffffe64}, {&(0x7f0000003540)=""/221, 0xfffffffffffffe82}, {&(0x7f0000000100)=""/22, 0x16}, {&(0x7f0000001980)=""/197, 0xc5}], 0x4, 0x0, 0x0, 0x80000001}, 0x4}, {{&(0x7f0000001a80)=@nfc_llcp, 0x80, &(0x7f0000001b80)=[{&(0x7f0000001b00)=""/98, 0x62}, {&(0x7f0000000440)=""/3, 0x3}], 0x2, 0x0, 0x0, 0x3}, 0x2}, {{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000001bc0)=""/107, 0x6b}, {&(0x7f0000001c40)=""/111, 0xffffffffffffffba}, {&(0x7f0000001cc0)=""/188, 0xbc}, {&(0x7f0000001d80)=""/58, 0x3a}], 0x4, &(0x7f0000001e00)=""/51, 0x33, 0xffffffff}, 0x9}, {{&(0x7f0000001e40)=@nfc, 0x80, &(0x7f00000034c0)=[{&(0x7f0000001ec0)=""/209, 0xd1}, {&(0x7f0000001fc0)=""/30, 0x1e}, {&(0x7f0000002000)=""/255, 0xff}, {&(0x7f0000002100)=""/160, 0xa0}, {&(0x7f00000021c0)=""/97, 0x61}, {&(0x7f0000002240)=""/203, 0xcb}], 0x6, &(0x7f00000023c0)=""/207, 0xcf, 0x7}, 0x7}, {{&(0x7f00000024c0)=@ax25, 0x2d9, &(0x7f0000002a40)=[{&(0x7f0000002540)=""/135, 0x87}, {&(0x7f0000002600)=""/38, 0x26}, {&(0x7f0000002640)=""/191, 0xbf}, {&(0x7f0000002700)=""/219, 0xdb}, {&(0x7f0000002800)=""/62, 0x3e}, {&(0x7f0000002840)=""/233, 0xe9}, {&(0x7f0000002940)=""/234, 0xea}], 0x7, &(0x7f0000002ac0)=""/105, 0x69, 0x40}, 0x2}, {{0x0, 0x0, &(0x7f0000003080)=[{&(0x7f0000002b40)=""/182, 0xb6}, {&(0x7f0000002c00)=""/178, 0xb2}, {&(0x7f0000002cc0)=""/227, 0xe3}, {&(0x7f0000002dc0)=""/204, 0xfffffffffffffec1}, {&(0x7f0000002ec0)=""/144, 0x90}, {&(0x7f0000002f80)=""/55, 0x37}, {&(0x7f0000002fc0)=""/130, 0x82}], 0x7, &(0x7f0000003100)=""/226, 0xe2, 0x4cd6ff64}, 0x3}], 0x6, 0x40000000, &(0x7f00000033c0)={r8, r9+30000000})
syz_open_procfs(0x0, &(0x7f0000000040)='net/netlink\x00')
creat(&(0x7f0000000180)='./file0\x00', 0xe6)
getsockopt$inet_buf(r1, 0x0, 0x2e, &(0x7f0000004640)=""/4096, &(0x7f0000000280)=0x1000)
sendfile(r7, r7, &(0x7f00000000c0), 0x80000002)
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140))

03:35:54 executing program 3:
r0 = inotify_init1(0x0)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
fcntl$getownex(r0, 0x10, &(0x7f00000006c0)={0x0, <r1=>0x0})
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ptrace(0x4207, r1)
ptrace$getregs(0x4209, r1, 0x72fffc, &(0x7f0000000000)=""/38)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x9)

[  418.057097] loop6: partition table beyond EOD, truncated
[  418.062967] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:54 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, 0x10)

03:35:54 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x4c00000000000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:54 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdba]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:54 executing program 5:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000616ff8)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
mmap(&(0x7f0000f9c000/0x4000)=nil, 0x4000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
sendmsg$unix(r2, &(0x7f0000bba000)={&(0x7f0000c57ff8)=@abs, 0x8, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0)
recvmsg(r1, &(0x7f00003d6fc8)={&(0x7f00000000c0)=@generic, 0x80, &(0x7f0000000440), 0x0, &(0x7f0000f9fff8)=""/90, 0x5a}, 0x0)
sendto(r0, &(0x7f0000000140)="607eb2dde0041f34741f3caff212b312115742f78523708fd394b2e1466df270af4184a95eb0468d34410138733167ddfd4bc2861abc009ce40ccca11b207b32e0ed694a8572099379111a3fb5e17ee27fe17d32daa1f06e7008d493780298e1bd853d95d6e729459cffaf52d0e4124a9691d3dc8c96b5178ce34b424d79d26a4769040f98c20d6a180ef385551f1a714ec55994c1a7d40d5907e7dd287cd63525254646ff2e2f0f1f569a97d0cc82d3915d271598471c970d9149191d403bd52e82c50330122c10222d5890c7c89db908db30d38f94080593299e3a2a5fc5db901c6e16411625f6e54538cd4451ab753c38783778302860e3fdf241ac57f749ceaa9dc801a10dc828933bb1c4f0fad71f67568b22eace807b73f0cda8fe12fd158097f9cebc03763f7e8e9e0ea8abe17a2b51e579059f3a5464b491055418fa482eac90090e46fabed12fb9789338004613ee976e83e10c2899acf90adc78c40626cb8fbca8ab446b8f38a9a8e7db3ba75170319f2a85721d0f4a17ab5ec0207221871f1137a560843018023258606ef32849db3eb01bf168f65ad76e3b357f4431fbe6a155593a1c0c1291568d1fb4d37b9ba6481dc6379fb19de372bab2c8a2d77326ba8b12e5d161863615d423812f5f1e32c98c995ebe807e3497e317ad11f5597b3a08fb37636d5d652cc019a8ed2c21f4f9ea7d5371a2b941ee1be3637ab1923603a1d4d86cb188a3682b7b78e702c05d0591a2c7088d5de0c2a6264a4bec44e6c564b4467398b39e6e43f14a93c5a2872778656abf33dad8ad412a10ae8679591bcc4d80be27bb4ca57c75cabd709f0f5a4d1c1b19a0fc9e427ef6997ef9f0ce9b8eb8562c65499e0bbeef891c481e50b22d377ed81e707f169a578a7d2cfbcee2e5b7bab41e48bd48133bbd6c35a7a1db12d38a6d51d13422ae8b405b5c73ce4e4844940283350fb8ed1db460c264d58892c3c942f0a08b94ef6fdc3a1011718e716362364f046ec78404495a75b4ffbd70a39ec81da3d3b0e73e6aea346eb7f5d6f6b26db106d353b15566726b891a230e16553e4b4b86e102f63ecd3372212229f99caa0c3a8a0d70ef75c0a2c72a7e2038e16ab5cba5e3a301aafbad06f17032a1c4f4601e24a85f5f2f257bc0d37acd6a476f12d3ddfd341f816602dce49d4c6e4baff8011e2a59b7664927bef28a432c307db16868a39cc543745b39a1b0671644ae5552c18e3d551601d48513b8690e34ca1d32f29d1dbc040ab442ec0cb6a477fd67bc7f27c27cd2b5cf1175d381200c1e68b04d12600d84ec19c5b1af220d915b9d0b4ac75baed15349f4e25230556c2eae7c40ec31b224da2c51207e34d62f587a9a49726f2a172eaa42b19c13e480718166b0cc88a5776ae195c53662d127cfe01fd62b105531933310ad6811c75fa8c889750e883199976e512b6f7c48326151dda21301b6c9ba69dabb3fe961994e48efac44c039914c33c981b590060a43f0ece179062430091adfcf7d09915f457294b608c00d71247ff7fadc7504cdb5cd78ff9e17dc0cae88f6d6ce1a9fe0ee693aef390dbc3118db5ec2945e1c99e20554d0931f15ac4635b83f32532e1ed20c351467b587a10345ba4a776db082cd7ebba1358e6850caac3b6964722064abd7406ac052d22a582f282c412001de34dab455c9882acbf48c281ffecc3d2632573b4dc8bef52cca441790710b8681d2774d87ffdbbace6cf87c034eb6b2af4dc9fab0e4cafaa8432978259753cd989fba3fafc4084511ac118270d80aec3f79a0154284b751b18e06025ef5aca6cae2ded741622c3d925cfb44dabd33468b2302dc719283ddf0daccdb682ca24b98e853b6b63149099307003386f2592ece27e7c49cc9b7710f6578d1d5a574bcfe114b45e7685d277fdcae991a09f2ca431901545a019455aa4020a91900c7b74aec28f3486028827cd4df05dce3cd3f864eaeaa377395c910594d262872d318237ff130dd74c7e4ad1dc4193517e1b52095a05bb9d55510ce52a691d8b6d3bed05cadf56ac378b81c521721b2706e517e909c4258f28ecc9f272e2dd9861510ec7c8519ca8b1ed4f7014f57d0f97f3f509e0469eba5bbe0c583afe589b9f32db0170a492173609cb077549f4ca6b760ec004f07520fd28c322a72c33293e59c47dc84ebdc9d3388a5fa82e9548e4a19d4795e1ec473145017bead1cc20e94629f06bd4b4fe1bd9a0c9b1d7e777c1023bd194f03833fd7c174749dc569e8c381fdaf47bdf0ad1fe80442752539e66dd465c79ac0547099f7beee2ed9099752252c94f6a4675bb85e10131adbe80261600692dbd5380899bacfb09d61bb6ce9d783773b8f233e98c6d32b391ca43203335d9613a7389e8139082c14bff5ab1caf6bee0d9ffad0b261be57497c5ff356b3ac3a969d2f787faad1f7b1d9b5118c073483e46dd678083b13d4df6e602cb533e3f8b199817f13c0d83cbc99ce3eaa020dce5aa69f7a0d0baa71be1949fbda57d98758740a74458bf5dfa081e06da89694c6b5a5d0da3a9e81be5391c1fed00bce9f18d2b39a936053e912125a5f15cceb4cc6e61e9f2ee3bd103ab16b79c144b068006e2f1adc65dd36134215cb4aa8c37758fec78c85e96d86f70d9d74d502fa9ec48942a7ffd0770a45d41be58c37b7439edc2380ad2b53ba3209963cddde492f716836eb39a939dcef83088b4ef9495948920781122dc2cfe32353159bb7ff6a3cd858dab0a72b4cfc0ec219ef0245a9dcfb1096c50116b7c62fc8e8765fc96d4267a18f265ca1df01627d27aba0a0d52edefd58fbfc7eb0fd8dbc83511356e22e1ce16b42199560fb08e03444d9b2d5298f0d4864c0dd9c55f1b1b0f3ca97ad2a147bf48adc5e510297cf1db9abb3867dc237822c62dd0c0153f14fbf262631090e985fa6d9c5b0ec2c18d70fbd8853b8e35dd26f8a61a340e30cd99f656bf0b5b18bd980f3666cf5c46b5ea7715bbab222e18fb68cdd32d560e8cc2c36a9137faa0e9a18b714e04929a183101dde7f8aa1277530a4cbf9f4996266ff61b01562634f37d0c5ea01d6f5172a9f7ce4067ac049f3854544565a66ff19ae0c13985cccd1df4386a15f954d0c1696996747272c8577c3b4eaa07236f52fed54c9e06a306caa8d84ef4490cfc71b0ea3f4bf11aac25aee3670bcbbea65de88b1327bab66e79713caac1b12b9faa55ad48b9172515a79311544ce7c9f3ae467a26fc67d612e8f826dedf25c4b9dce605eb9a44d25e42e564933a7ce628a26d066e54a23ac3bb72cfe598ee6b7657e57f3aa0a9edf86a09abaaea41e4d58ce0bf3b539ed3962709248c71e3d0f21b6dbac34c696552c98e52a6424853fbf45b680f8b32fbc96271bac6b7db3b6cd9063c1fd5eb8508548389a7667710b28718edebcf7513d3cbad6848dde0b4ef97732eaad77fc80027d1a8dd624b2426fd86e4fe5e575aada2659637b5898703249c272846c97245856c8b00d986d33c1e21890382cd06ad484483bbf2f758d1c8167a49868bd8db01ad6e13e224e270ca5f957d265274895fc0327135f3fc475b4d8d10a7b0eb3e8f9c4d599903f65ce965d5a3ec769cb2c0b215d6241dd3eb92ae6ad4c4bc28df7f3909824b3212533142e29ccfb0ceeb40b8af829340a4b8936c6703c1328210536b4aaaf571ca23ab691aed6d8267f4bc9b92f1aa9adfe819da7bdc8dec9fb82c7316fe51c10eec01581725a5eda124ab675437b67bc555c79f16a067676673ec389f8b96cd1a5058cb789f2066d51b02c22fd4a63938ae2382e173275daae10ab453727cec1182799dd9dda6329875a837081f9cce81ea0164aca0a9707563a91b2369650b8813c5e806b850416a5be710edc9056c20eb6d1fff710c2cdf8e004291334b3c9d7f31be318bafbcb0cc580dfc0e214186552ac22de5d4c26713b1a41487d6ec63edd24c1eb6a6748e0922b8066352fdd4c7c642fc5a266f3ef42f0bf0bfed477d26ea77eb08db77c2f37857780ddb483e94041b722e9dda5cf48a241fbb4e51e6f2a12e7f9ece77a0fb9190061c6c1101647958b1d40482a81f97ddefefe9648e8e2e94017844540f78a05341e614167adbd20743b17a784bf40a000a8eb4aca477c2de0d7b42a23b21e6bc2e3879f2436235d7f629490e6f4f14ae6d0a269b0ec59ed2be4501faf3d1fa2f30c5564dee3cf0345116471b8552040add5a57f0ca8645796437e39549e7e553e1db44a078512a01f7eca3d549cedf70b85430261eb7f45b0bcef61ff09b3b689b6f14001c24f2605908fb67cce8ae00db6e49556873ec0fb08c3d3f70097957ebda016def9889f964657018ba0375adc8efea2629e2f95f567f173d0c8748b2b7e3a73619354d54b17194a452c490d66b5a22bdc908e3a99898810253bcb4cca555af3a9942402e3f175fa9a62097eee9af10626dfada5f0c9e4a913578c1ada413fdcd50112c9968c6347d238ea1b9e58d283669bc1eb4a4036239638cacb9829ddf595537d429e1ceadd4b28e8d316713aa4415eecb50b563bba1032bdab7a00794f67328900abf4c3191b32045012d92966539ef950769f703e83030c9584293d62d5692255c19db9f4a09362084df78a86ef0d12c9291285378f04c80ff456e8d78d4423ae5ce331c91010b5f8edb085b358295c2cc4e0f3b93ed651fb610782cdb3f79d888b069fcb2a31924acb140e58981b57080b1b4a6ea64a1245366de4c1b118702e8d0629bf6bb0cc9d9e6032044a55af37ed0612e4570aac29cd48caba912e3cb118f7d6ae8261560d9447c3213286b8e5ee4e58bedb2c8e8ae424c9ce53a344dc6a9230d89956484c25d815b7af43a9907a2443df760abd629b7b0d566da7dd790e331edcf3dfdb0cc64d0efc65bf66643c8a0465ed0441e934dd324abb89f378d24b9f653c09af9caa7997c2374a1bc917303a0310a637386e741a911310bf6d8b8e47f4fdc4a30d3e6f7307a95196032c76c8dca6bffe24ebd597afbc126a922cbda36b2b804faee096bf99c3e6314f93ac03e1062fb2a90543146397282ca13e2851ab0f5f16ffd107878f76174f34cc093ff46aa886d068805e15deaabb7787d5599e0b94411dcb7a7046ac315d21eb7c6729c81e66565490a133c69a7bb4c77dbd8eb3e2eabadfb2dd2142cfef38b9dbcacdaf1af7d4ca345ea21aba264f2b464fe45e12876a18e3c72c6d823839435b0501a00ee174cb604b774a0319f4a7936e880bc01723183ea7eae6fce1760397444417be2ba5612140b89089c24956b2859ec7f682308425e3592a682ee341b7f5b2bdc92389dde9556cc44914b1567a780d3bfbc1d59141f8812dd5fc09aec2b1dd2dc88f3c371b65095b2694351f175313058f9215962579d90da9c876e86778b39de82ccaaf59e627cb4de7dd4456c61e130b7fc5822eaa68019078a341ae66d5ae1bf49b280e695df8996c10d285fedf87ccb0d4c8f2064e22f074e5890c0de8a3d3a33674b451fd8ad0dfb9041d4578397e175406d944fa5d22c63f95bb37fc6504dd4bc262809119df587a3e59a6f4ff4264c3e9d88df6bd72c3316b75b4f62f7057bed7fda47844ddb1c53f6d1a70b26dab80d4fd6496ccf93b06fbba78c593b8e9e56be2f9381823adfa6dd946c7a56dcbc0ed2542723f496fb098af7060cb558167554ef337fc6e449975728f8f0905154962f2a004b06dda8fd69a5aee17f85d5d519f9765280a4e0b3dcc9ea4bd08d455894517cac8c18bd1bf237c40184779c6f2c870", 0x1000, 0x40, &(0x7f0000000000)=@vsock={0x28, 0x0, 0xffffffff, @my=0x0}, 0x80)

03:35:54 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x38, 0x1c0}])

03:35:54 executing program 2:
r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0)
open_by_handle_at(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b3ac000010000005f2162e55afd561af8d1a26f6310bcb8962caf1f6f9a4007505af310c26879d2ab6759139ad9b56ba1ff54"], 0x0)

[  418.300682] binder: 23927:23995 Acquire 1 refcount change on invalid ref 0 ret -22
[  418.381283] binder: 24004:24007 Acquire 1 refcount change on invalid ref 0 ret -22
[  418.399293] Dev loop6: unable to read RDB block 1
[  418.404300]  loop6: unable to read partition table
[  418.410105] loop6: partition table beyond EOD, truncated
[  418.415917] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:54 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba0d000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:54 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x803e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio\x00', 0x12100, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00')
sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0xb4, r1, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xc9a1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfc}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4d553353}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7fff}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xf6f9}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x4)
setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000080)=[@in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e21, @rand_addr=0x5}, @in6={0xa, 0x4e24, 0x8, @dev={0xfe, 0x80, [], 0x16}, 0x6b7}, @in={0x2, 0x4e24, @multicast1}], 0x4c)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0xfffffffffffffffd, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x401)
ioctl$TIOCCBRK(r0, 0x5428)

03:35:54 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}, 0x10)

03:35:54 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfcff0000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:54 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = getegid()
getgroups(0x1, &(0x7f0000000640)=[<r2=>0x0])
syz_mount_image$jfs(&(0x7f0000000000)='jfs\x00', &(0x7f00000000c0)='./file0\x00', 0x4, 0x8, &(0x7f0000000580)=[{&(0x7f0000000100)="04c12d325c41191c702738876f1ea2e2ba261f04d8a31552160eb94630c8d652cec4f9785a9b8cee6c68a83f79529edd40d0704997fa873ee51b2fbef469407001a63d1e5ab4064bccb81477fdc4c9c8bcfdddc52ae9eb1d3e499babef4d04ae98510d607b9ca6ef240d8bfef8c4b1e81b2ecfc1f72bbac351433b781fc61eec247c8903482347d898e1c224cc40dc82aa9ea0d53d1a82092efdf03d7079c4800ae25bb35e8b1f6455b7eed9f9a542bd14ea235dbe834fc797a48dd42a47a37d5f103eab82b01f875d5530a9736b2ea86553bb", 0xd3, 0x2}, {&(0x7f0000000200)="0bcf1743b4989135f81fc837f2b1a97a695ed22ca67ff1651ffb778667623a2790a0c2c1a7027228dae3978ecd42d2f3875343437e6ec00e54c56088375e18b7b500e733dfb47b6ab5f8f5232aa316f2e16f0e11974ba5d6f0e160fcd1c74a4f89dc21d17d6baffec7b496dd571e6239249c19bedf17e1dadd426ff4bac7cf74bb599f3348b5ca2f73fa90600db5b879cff2d3cf72ac60912c542ca47b4e248002563e6afaf4b9f6a59db8030319f31451af35bc3234548abc2a39474d1c60a87ff798c84a588bf231e2c95a19fccae5c5c9d497fedb1a4111aa", 0xda, 0x9203}, {&(0x7f0000000300)="479406fe862560c2d2476d23046b348524d8d34e96c555d7eb03d2737c1588762d3b23668d877dd74c74dedc8a9dffe5db9eb19f3ab5018ce29785bf3eeb907455b2be6bab11da824db29e40f3ee8448db8d5d707f65d809e83ca6e2af40850f12aa17573a03e5d02378666811a80ea99c588627d10f0b8ffcdf0eb7f235f1f52c421d82285246ffc62df364afab8150385bce74aabb087a0c0b754a48f75dcadcb21c", 0xa3, 0x5}, {&(0x7f00000003c0)="d737f7ac43c8bdd62a70f14e78", 0xd, 0x81}, {&(0x7f0000000400)="229ba6c47b248aa5afc7306aba8d2842d09109d7348a", 0x16, 0x4}, {&(0x7f0000000440)="ff0e4410a39ffca336fbc7da84ee4d99e818bcf7f45d91131589d0f60cb246363b148070b8229cad736c4e71265fceeee56cbf5ab7245430b035ce471c8c7c9599b0", 0x42, 0x3}, {&(0x7f00000004c0)="fd50d89a0d781ec49cb336a1e2c953afe5", 0x11, 0x1}, {&(0x7f0000000500)="56a3dbccc80d78aa5ca993faed148cac46ec3dad17e536b712c7a98f09cf5ed2144a42cdc718cbeb59ec6daf2ae788296f9afb1259b3f13ebb0f6b12ad4a6b69d152713828ecc3422d8e7f469a46fd40a55a7816c46298751e", 0x59}], 0x4000, &(0x7f0000000680)={[{@gid={'gid', 0x3d, r1}}, {@discard_size={'discard', 0x3d, 0x9}}, {@noquota='noquota'}, {@gid={'gid', 0x3d, r2}}]})
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x5}, 0x4)
r4 = socket$inet6(0xa, 0x8000000000000802, 0x0)
sendmsg$inet_sctp(r4, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x3, 0x0, @mcast2}, 0x1c, &(0x7f0000fc8000)}, 0x8000)
sendto$inet6(r4, &(0x7f0000b0cf6e), 0xffed, 0x0, &(0x7f000001b000), 0x1c)

03:35:54 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)
ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000100))
r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
setsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000040)=0xf8a, 0x4)

03:35:54 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x3c, 0x1c0}])

03:35:54 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  418.761145] Dev loop6: unable to read RDB block 1
[  418.766244]  loop6: unable to read partition table
[  418.773111] JFS: discard option not supported on device
03:35:54 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)
ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000100))
r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
setsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000040)=0xf8a, 0x4)

03:35:54 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5028}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x200000, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x17, &(0x7f0000000080), 0x4)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0xc)

[  418.842682] loop6: partition table beyond EOD, truncated
[  418.848360] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:54 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000]}, 0x10)

[  418.896647] JFS: discard option not supported on device
03:35:55 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x6800, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:55 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1={0xff, 0x1, [], 0x300}, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:55 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)
ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000100))
r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
setsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000040)=0xf8a, 0x4)

03:35:55 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x3c, 0x1c0}])

03:35:55 executing program 2:
r0 = epoll_create1(0x0)
flock(r0, 0x2)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
write$P9_RFLUSH(r0, &(0x7f0000000000)={0x7, 0x6d, 0x1}, 0x7)
ioctl(r1, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070")
r2 = epoll_create1(0x0)
getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000100)=""/161, &(0x7f00000001c0)=0xa1)
flock(r2, 0x1)
setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000040)=0x4ac1, 0x4)
ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f0000000080)={0x100, 0x100, 0x3, 0x0, 0x0, [{r1, 0x0, 0x1ff}, {r2, 0x0, 0xcb}, {r1, 0x0, 0x20}]})
close(r2)
flock(r0, 0x5)

03:35:55 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000]}, 0x10)

03:35:55 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x4, 0x4002)
ioctl$KVM_PPC_GET_PVINFO(r1, 0x4080aea1, &(0x7f0000000280)=""/4096)

[  419.174799] binder: 24004:24067 Acquire 1 refcount change on invalid ref 0 ret -22
[  419.245021] Dev loop6: unable to read RDB block 1
[  419.250020]  loop6: unable to read partition table
[  419.253381] IPVS: length: 161 != 8
[  419.255201] loop6: partition table beyond EOD, truncated
[  419.264955] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:55 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x3f00000000000000, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  419.287716] binder: 24084:24085 Acquire 1 refcount change on invalid ref 0 ret -22
[  419.339487] binder: 24084:24089 Acquire 1 refcount change on invalid ref 0 ret -22
[  419.356693] IPVS: length: 161 != 8
03:35:55 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x600, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:55 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)
ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000100))
r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)
setsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000040)=0xf8a, 0x4)

03:35:55 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x3c, 0x1c0}])

03:35:55 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2f00]}, 0x10)

03:35:55 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)

03:35:55 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0xba0d0000, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:55 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x7a00, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:55 executing program 2:
r0 = socket$inet6(0xa, 0x802, 0x0)
ioctl(r0, 0x100008912, &(0x7f0000000100)="025cc80700145f8f764070")
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000080)={'syz_tun\x00', &(0x7f00000000c0)=@ethtool_link_settings={0x23}})
r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x2000, 0x0)
ioctl$KVM_GET_SREGS(r3, 0x8138ae83, &(0x7f0000000140))
close(r2)
close(r1)

[  419.639308] binder: 24101:24102 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:55 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x3f000000, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

[  419.683292] Dev loop6: unable to read RDB block 1
[  419.688404]  loop6: unable to read partition table
[  419.713336] loop6: partition table beyond EOD, truncated
[  419.719010] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:55 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000]}, 0x10)

03:35:55 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)
ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000100))
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0)

03:35:55 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x1, 0x20000)
ioctl$KDDELIO(r0, 0x4b35, 0xb21)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
setsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f0000000080)={@empty, @broadcast, @local}, 0xc)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)

03:35:55 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x3e, 0x1c0}])

03:35:55 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x3f00, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:55 executing program 2:
r0 = epoll_create1(0x0)
r1 = epoll_create1(0x0)
close(r0)
r2 = syz_open_procfs(0x0, &(0x7f0000000100)='mounts\x00')
ioctl$INOTIFY_IOC_SETNEXTWD(r2, 0x40044900, 0x2)
poll(&(0x7f0000000000)=[{r1}, {r2}], 0x2, 0x1800)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040))
mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0)
mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f00000013c0)='ramfs\x00', 0x0, &(0x7f000000a000))
mount(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='devpts\x00', 0x51022, &(0x7f0000000300))
setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f00000000c0), 0x4)

03:35:55 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)
ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000100))
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0)

[  419.918720] Dev loop6: unable to read RDB block 1
[  419.923755]  loop6: unable to read partition table
[  419.950305] loop6: partition table beyond EOD, truncated
[  419.956025] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
[  420.438982] binder: 24101:24161 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:56 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0xba0d, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:56 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x1a000]}, 0x10)

03:35:56 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt(r1, 0x3, 0x7, &(0x7f0000001800)="9124025542705780339a88a92194af7163d74a474ff3ec71d8f5107631b0b4c675496be3b56f21d72269bb2abd18de7a52f89c29b98923faf6f5e3049b3807a2a041ba5df3f57d8fe5a7a598214cb438078bb26a7895a4438438b83bd6c9c0a6dce5f80d304540927e824eebce23066f1eafcf6ca529209840e0cd540efb03b7b3d3c6b3b185dd16a458a73d2ccc4eda74cb32e630859db645c71d6eacf19b6488b1ce6549c5d75524", 0xa9)

03:35:56 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x3e, 0x1c0}])

03:35:56 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)
ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000100))

03:35:56 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x600000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:56 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x3000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  420.545393] binder: 24168:24174 Acquire 1 refcount change on invalid ref 0 ret -22
[  420.564748] Dev loop6: unable to read RDB block 1
[  420.569733]  loop6: unable to read partition table
03:35:56 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0xdba, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:56 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:56 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x10)

[  420.596402] binder: 24168:24182 Acquire 1 refcount change on invalid ref 0 ret -22
[  420.610862] loop6: partition table beyond EOD, truncated
[  420.616540] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:56 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x600, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:56 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)

03:35:56 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", 0x3e, 0x1c0}])

03:35:56 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0xba0d000000000000, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:35:56 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000dec000)={0x2, 0x4, 0x1, 0x7}, 0x2c)
bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000040)={r1, &(0x7f0000000000), &(0x7f000089b000)}, 0x18)
r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x40, 0x0)
setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f00000000c0)=""/16, 0x2000, 0x800, 0x6}, 0x18)

03:35:56 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:56 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2f]}, 0x10)

[  420.801193] binder: 24203:24204 Acquire 1 refcount change on invalid ref 0 ret -22
[  420.855697] binder: 24203:24216 Acquire 1 refcount change on invalid ref 0 ret -22
[  420.869750] Dev loop6: unable to read RDB block 1
[  420.874719]  loop6: unable to read partition table
03:35:56 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:56 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0xcba, 0x4600)
ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000080))
ioctl$VT_RELDISP(r0, 0x5605)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:56 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1100000})

[  420.911894] loop6: partition table beyond EOD, truncated
[  420.917720] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:56 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x5f0c, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  421.060792] binder: 24237:24238 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:57 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:57 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000]}, 0x10)

03:35:57 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055", 0x3f, 0x1c0}])

03:35:57 executing program 2:
r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1f, 0x800)
r1 = dup3(r0, 0xffffffffffffffff, 0x0)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000080)={0x101024802, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x10})

03:35:57 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0xba0d000000000000, 0x0, 0x0, 0x1100000})

03:35:57 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x5000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:57 executing program 3:
openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x80000, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x402000, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f00000002c0)={[{0x1, 0x6, 0x2, 0x400, 0xf648, 0x1, 0x1, 0x5, 0x3, 0xbd, 0x0, 0x5, 0x20}, {0x200, 0x7f, 0x6, 0x4, 0x1, 0x8, 0x7, 0x9, 0x1f, 0x7fffffff, 0x3, 0x2, 0x2}, {0x20af, 0x10001, 0x100, 0x4, 0x1, 0xd2, 0x2, 0xaa, 0x20, 0x8849, 0x2, 0x5, 0x3}], 0x6})
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)
getsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
ioctl$UI_DEV_DESTROY(r0, 0x5502)
setsockopt(r0, 0xffff, 0x20, &(0x7f0000000080)="7a2c2861d2a9c65b94ac62e356c8ef7a8e6b11369c23deb116c55e867ec11811cb931fb160b0f21a2de16f350e3867be39833c0076028cc623c14b70085f418dd94c31d935835947c9010f20722d3f104e2146dd6e1a6a010f7df1f2dee5b9dbb229d5a91ab6301d1af80abebe8b49682cdc4565c5599c7e337ab039edb9d2c6d4056f8c041d1a5886e6d9cac20d85275e5d4bb302ba9d62dfab376c7a80f0e8cb7ca2050b0c7c1771a6a59b8d6c1fe1b2dc5299ba7a4513c734a92b9e1060e8ebe2d74fe8b1473df219c5201c5a38f42c8bff088d5176d7", 0xd8)

[  421.450027] Dev loop6: unable to read RDB block 1
[  421.455199]  loop6: unable to read partition table
[  421.477141] loop6: partition table beyond EOD, truncated
[  421.482811] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:57 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x3f00000000000000, 0x0, 0x0, 0x1100000})

03:35:57 executing program 5:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:57 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000480)="0a5cc80700315f85715070")
r1 = socket$inet6(0xa, 0xa, 0x401)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r2 = dup(r1)
ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000180))
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000002000))
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000240)={0x12007, 0x8000})
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_mreqsrc(r4, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local, @rand_addr}, 0xc)
getsockopt$inet_mtu(r4, 0x0, 0x29, &(0x7f0000000040), &(0x7f0000000000)=0x4)
ioctl$sock_inet_SIOCGARP(r4, 0x8954, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @local}, 0x0, {0x2, 0x0, @remote}, 'team_slave_1\x00'})
close(r4)
dup3(r1, r3, 0x0)
recvfrom(r4, &(0x7f0000000080)=""/72, 0x48, 0x40000000, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r4, {0x2, 0x4e24, @multicast1}, 0x2, 0x2, 0x4}}, 0x80)

03:35:57 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xa002000000000]}, 0x10)

03:35:57 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055", 0x3f, 0x1c0}])

03:35:57 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x9, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000040)={0x6, 0x9})
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x218040, 0x0)

03:35:57 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:57 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0xba0d0000, 0x0, 0x0, 0x1100000})

[  421.679121] Dev loop6: unable to read RDB block 1
[  421.684225]  loop6: unable to read partition table
[  421.698637] loop6: partition table beyond EOD, truncated
[  421.704325] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
03:35:57 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x7, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:57 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xeffdffff00000000]}, 0x10)

03:35:57 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055", 0x3f, 0x1c0}])

03:35:57 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:57 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x103, 0x0)
socket$packet(0x11, 0x2, 0x300)
setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='scalable\x00', 0x9)
fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000140))
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x4002, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x9)
r4 = syz_open_dev$sndctrl(&(0x7f00000001c0)='/dev/snd/controlC#\x00', 0x4000080000004, 0x74200)
write$cgroup_int(r3, &(0x7f0000000180)=0x9, 0x12)
ioctl$KDADDIO(r2, 0x4b34, 0x2)
ioctl$SNDRV_CTL_IOCTL_PVERSION(r4, 0x80045500, &(0x7f0000000080))
ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000340)=<r5=>0x0)
fcntl$setown(r3, 0x8, r5)
ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f0000000280)=""/191)
fcntl$dupfd(r0, 0x0, r2)

[  421.857256] binder: 24237:24308 Acquire 1 refcount change on invalid ref 0 ret -22
[  421.914767] Dev loop6: unable to read RDB block 1
[  421.919892]  loop6: unable to read partition table
[  421.946494] loop6: partition table beyond EOD, truncated
[  421.948910] binder: 24321:24322 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:57 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

[  421.952184] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
[  421.968246] Unknown ioctl -2143271643
[  421.978117] Unknown ioctl -2143271643
03:35:58 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xe00, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:58 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x9, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2000000000000000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

03:35:58 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:58 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40}])

03:35:58 executing program 2:
getsockname(0xffffffffffffff9c, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, <r0=>0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000200)=0x80)
ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f0000000240))
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000340)='\x00', 0x4000000000)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)}}, 0x20)
lseek(r1, 0x0, 0x3)

03:35:58 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:58 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40}])

03:35:58 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x0, 0x0)
bind$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x800}}, 0x1e)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)

03:35:58 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x3f000000, 0x0, 0x0, 0x1100000})

03:35:58 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x10)

03:35:58 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x60, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:58 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40}])

03:35:58 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:58 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}, 0x10)

03:35:58 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0xba0d, 0x0, 0x0, 0x1100000})

03:35:58 executing program 2:
r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x800, 0x0)
readv(r0, &(0x7f0000000180)=[{&(0x7f0000000100)=""/66, 0x42}], 0x1)

[  422.745251] binder: 24321:24386 Acquire 1 refcount change on invalid ref 0 ret -22
[  422.826675] binder: 24400:24403 Acquire 1 refcount change on invalid ref 0 ret -22
[  422.905720] binder: 24400:24407 Acquire 1 refcount change on invalid ref 0 ret -22
03:35:59 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}, 0x10)

03:35:59 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x9)

03:35:59 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:59 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x300000000000000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:35:59 executing program 6 (fault-call:0 fault-nth:0):
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:35:59 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x200000000000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:59 executing program 2:
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x20000, 0x0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070")
ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000100)=<r2=>0x0)
perf_event_open(&(0x7f0000000240)={0x4, 0x70, 0x6, 0x5a3, 0x8, 0x3855, 0x0, 0xffff, 0x0, 0x2, 0xba53, 0x9, 0xff, 0x200, 0xd6, 0x7dce, 0x7fffffff, 0x6a, 0xfff, 0x1, 0x6, 0xe810, 0x7fff, 0x1, 0x0, 0x9, 0x0, 0x9, 0x8, 0x7, 0x7fffffff, 0x2, 0x400, 0x7dd, 0x4, 0x0, 0x1, 0x1ff, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0xfffffffffffff000}, 0x3020, 0x7ff, 0xffff, 0x7, 0x8000, 0xdcce}, r2, 0xf, r0, 0x9)
r3 = userfaultfd(0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000))
ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r4 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000013e95), 0x4)
ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000080)={'syz_tun\x00', &(0x7f0000000140)=@ethtool_drvinfo={0x4d, "2f64155aff444ea16a3975cff0193e4f035ebea61fd66f19878ce493846084dd", "d5ad3c1e693da3a0cbcb28f8c4a37e798fb3cb2b98cddc01ffe38abddb30b8cf", "a0b3d988ba709d7365079947eb7a100679c653b1dd0872a803d6993b2431a2ac", "fe6c9b959907acc85d2bf9ae685526c945159b90908fd4bb59fc9c23e4ef52ba", "9510e9a42adfcd610e68defca039b60c5573ab46bbd2a17e0f8d507eb29e3d09", "bde496431c9a7c7a653090cb"}})
close(r4)
close(r3)

03:35:59 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x3f00, 0x0, 0x0, 0x1100000})

[  423.190119] FAULT_INJECTION: forcing a failure.
[  423.190119] name failslab, interval 1, probability 0, space 0, times 0
[  423.201543] CPU: 1 PID: 24418 Comm: syz-executor6 Not tainted 4.18.0+ #195
[  423.208582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  423.217953] Call Trace:
[  423.220568]  dump_stack+0x1c9/0x2b4
[  423.224249]  ? dump_stack_print_info.cold.2+0x52/0x52
[  423.229477]  should_fail.cold.4+0xa/0x11
[  423.233575]  ? fault_create_debugfs_attr+0x1f0/0x1f0
03:35:59 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:59 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}, 0x10)

[  423.238716]  ? save_stack+0xa9/0xd0
[  423.242376]  ? lock_downgrade+0x8f0/0x8f0
[  423.246554]  ? proc_fail_nth_write+0x9e/0x210
[  423.251079]  ? proc_cwd_link+0x1d0/0x1d0
[  423.255211]  ? find_held_lock+0x36/0x1c0
[  423.259348]  ? check_same_owner+0x340/0x340
[  423.263713]  ? rcu_note_context_switch+0x730/0x730
[  423.268688]  __should_failslab+0x124/0x180
[  423.272960]  should_failslab+0x9/0x14
[  423.276792]  __kmalloc+0x2c8/0x760
[  423.280549]  ? strncpy_from_user+0x510/0x510
[  423.284992]  ? fput+0x130/0x1a0
[  423.288298]  ? __x64_sys_memfd_create+0x142/0x4f0
[  423.293195]  __x64_sys_memfd_create+0x142/0x4f0
[  423.297903]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  423.303471]  ? memfd_fcntl+0x1580/0x1580
[  423.306213] binder: 24419:24431 Acquire 1 refcount change on invalid ref 0 ret -22
[  423.307559]  ? ksys_ioctl+0x81/0xd0
[  423.307579]  ? do_syscall_64+0x9a/0x820
[  423.307607]  do_syscall_64+0x1b9/0x820
[  423.307631]  ? finish_task_switch+0x1d3/0x870
[  423.331347]  ? syscall_return_slowpath+0x5e0/0x5e0
[  423.336320]  ? syscall_return_slowpath+0x31d/0x5e0
[  423.341279]  ? __switch_to_asm+0x34/0x70
[  423.345892]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  423.351293]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  423.356195]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  423.361410] RIP: 0033:0x457089
[  423.364628] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
03:35:59 executing program 5:
openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz0\x00', {}, 0x27}, 0x45c)

03:35:59 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0xdba, 0x0, 0x0, 0x1100000})

03:35:59 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}, 0x10)

[  423.383560] RSP: 002b:00007f4c72971a18 EFLAGS: 00000246 ORIG_RAX: 000000000000013f
[  423.389682] binder: 24419:24436 Acquire 1 refcount change on invalid ref 0 ret -22
[  423.391293] RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 0000000000457089
[  423.391303] RDX: 0000000020000018 RSI: 0000000000000000 RDI: 00000000004c2299
[  423.391313] RBP: 0000000000000001 R08: 0000000008100000 R09: 0000000000000000
[  423.391323] R10: 0000000020000018 R11: 0000000000000246 R12: 0000000000000380
[  423.391333] R13: 00000000004d6ae8 R14: 00000000004c2299 R15: 0000000000000000
03:35:59 executing program 6 (fault-call:0 fault-nth:1):
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:35:59 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x5f0c0000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:35:59 executing program 2:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000000340)='./file0\x00', 0x0)
mount(&(0x7f000000a000)='./file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080)='configfs\x00', 0x0, &(0x7f0000000040))
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
dup2(r0, r1)

03:35:59 executing program 3:
r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)
r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x200c40, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2)

03:35:59 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0x3f00000000000000, 0x0, 0x1100000})

03:35:59 executing program 5:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00'}, 0x45c)

[  423.560148] FAULT_INJECTION: forcing a failure.
[  423.560148] name failslab, interval 1, probability 0, space 0, times 0
[  423.571534] CPU: 1 PID: 24457 Comm: syz-executor6 Not tainted 4.18.0+ #195
[  423.578573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  423.587943] Call Trace:
[  423.590557]  dump_stack+0x1c9/0x2b4
[  423.594236]  ? dump_stack_print_info.cold.2+0x52/0x52
[  423.599473]  should_fail.cold.4+0xa/0x11
[  423.603567]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  423.608713]  ? find_held_lock+0x36/0x1c0
[  423.612816]  ? graph_lock+0x170/0x170
[  423.616642]  ? __lock_acquire+0x7fc/0x5020
[  423.620906]  ? lock_downgrade+0x8f0/0x8f0
[  423.625089]  ? find_held_lock+0x36/0x1c0
[  423.629373]  ? check_same_owner+0x340/0x340
[  423.633733]  ? rcu_note_context_switch+0x730/0x730
[  423.638699]  ? find_held_lock+0x36/0x1c0
[  423.642792]  __should_failslab+0x124/0x180
[  423.647058]  should_failslab+0x9/0x14
[  423.650886]  kmem_cache_alloc+0x2af/0x760
[  423.655063]  ? lock_downgrade+0x8f0/0x8f0
[  423.659253]  ? shmem_destroy_callback+0xc0/0xc0
[  423.663962]  shmem_alloc_inode+0x1b/0x40
[  423.668050]  alloc_inode+0x63/0x190
[  423.671715]  new_inode_pseudo+0x71/0x1a0
[  423.675803]  ? prune_icache_sb+0x1b0/0x1b0
[  423.680066]  ? _raw_spin_unlock+0x22/0x30
[  423.684243]  new_inode+0x1c/0x40
[  423.687632]  shmem_get_inode+0xf1/0x910
[  423.691640]  ? shmem_encode_fh+0x340/0x340
[  423.695900]  ? lock_downgrade+0x8f0/0x8f0
[  423.700072]  ? lock_release+0xa30/0xa30
[  423.704068]  ? check_same_owner+0x340/0x340
[  423.708413]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[  423.713451]  ? __check_object_size+0xa3/0x5d7
[  423.717983]  __shmem_file_setup.part.45+0x83/0x2a0
[  423.722938]  shmem_file_setup+0x65/0x90
[  423.726941]  __x64_sys_memfd_create+0x2af/0x4f0
[  423.731629]  ? memfd_fcntl+0x1580/0x1580
[  423.735718]  ? ksys_ioctl+0x81/0xd0
[  423.739370]  ? do_syscall_64+0x9a/0x820
[  423.743375]  do_syscall_64+0x1b9/0x820
[  423.747285]  ? finish_task_switch+0x1d3/0x870
[  423.751865]  ? syscall_return_slowpath+0x5e0/0x5e0
[  423.756817]  ? syscall_return_slowpath+0x31d/0x5e0
[  423.761765]  ? __switch_to_asm+0x34/0x70
[  423.765846]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  423.771324]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  423.776216]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  423.781425] RIP: 0033:0x457089
[  423.784636] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  423.803564] RSP: 002b:00007f4c72971a18 EFLAGS: 00000246 ORIG_RAX: 000000000000013f
[  423.811301] RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 0000000000457089
[  423.818589] RDX: 0000000020000018 RSI: 0000000000000000 RDI: 00000000004c2299
[  423.825874] RBP: 0000000000000001 R08: 0000000008100000 R09: 0000000000000000
[  423.833245] R10: 0000000020000018 R11: 0000000000000246 R12: 0000000000000380
[  423.840538] R13: 00000000004d6ae8 R14: 00000000004c2299 R15: 0000000000000001
[  423.863597] binder: 24462:24467 Acquire 1 refcount change on invalid ref 0 ret -22
[  423.915325] binder: 24462:24474 Acquire 1 refcount change on invalid ref 0 ret -22
03:36:00 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x4010000, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:36:00 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0010000000000]}, 0x10)

03:36:00 executing program 5 (fault-call:2 fault-nth:0):
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00'}, 0x45c)

03:36:00 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0xba0d000000000000, 0x0, 0x1100000})

03:36:00 executing program 3:
socket$kcm(0x29, 0x5, 0x0)
r0 = syz_open_dev$admmidi(&(0x7f0000008240)='/dev/admmidi#\x00', 0x7, 0x940)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000008280)=0x10, 0x4)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000040))
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f0000000280)={"07d264489abe5dad6ccd2b6eb291a61b82b6fe8301f1bb53113ba5fd77de02f90f53b3a98f97467ab0a1e3868af07a592ea59e55b9a88e432b1d6e98a8b31006c92974df495a7478b460552b3d372eb8617f00cec4c025fdfa72eb25f349955262bf894b655a0aa194d193da894e5e1b7afeba8b5bf8b65ccad279db2f0d0f82cc78deaff7053c26a6b4f5a0d1a02be4be934dab00cd61848a2bcd43c479f089990d85644316675e97427e54494885e3bacac7303a031bbe963dcb1f95be98f9bd94b76f5538f7e4abe380c0667004259eabe2aad079427acec36450c04cb4b57bc0a2f12e60655b9da8634c5a02546f07b838a74ce29cb90688a13930e798f20a999ff021892fa93c28f3f69e64e507235efd650fc9871487a16a3a160826af7f548869d3fb19c144a31b632e7a91bc47d2b08fa15cb0bff3a2c2868774fd18860b6ce173e040dea64293ffc047edf6ef6d49fc98a6906a7b9527655db9145916948404b220f2ebc58a42f1c62e4918a39b8a55a28aa437d77c779bc143723d45e64dc5e72f5dec0be4e9fea657d032630bdbedd4bb303e94cd4ef421adaa748f71a49b38373590d76e91aa353433c359a0f0d2dfb246c1a20098bb8fef8212e6b2954253416d0d456ff0a16092fed842d0a6179969b998f9213087ff2ad62b132cdd7cd5e55fdc39611a2022c6a7e2090cfc71d492f47930c1500b0f56c97718c78d545edfea28a19fdf77204b8eed8e7a019b8383ff9a746bf93c791673d34be65baba1cf2810044ba876f6335f79ae89a8688e9f81e807638589e0d4f0e42dacc4590033fbace34382420f04930f2f75c66b5c83ff5589fc239bee5719f5c954b5e3bbf553fc37a704daf703d49610141886f56d7403276b88b9cfc828586c56441aece80454d8bb02018c3c9da1e3e33c066d76738809797d92b2b65d9a5bd7eb25484834e49eeaf88b2c4f660bf38f3f695b5e352f02c39384f4ca869582e3eb552ce953da9336db2109ee0afd10a13df03b0a9e37dfbe4a20ae6f15ca5020809e1dd6905f4ceec202282a0e95be61d8de4a376ae90707a4de99135041f08e713f883cf08bbcae159a5494398441dff8c757799d81656dbe7536b8444b8145ea56d47a68aa7ef52b60ac7e3b117e2d912b25e34af7d4699c69c2abe8da3a507ad6c9f4fa1e916ab0df8b3444f89d6554113c9cec0235857db32aa8f79ea8ce66e8f48b2c3b7d7cf3c2ffd45e3c53c6b9c5ad4309da9ea1e11be31db253eb987eeb810e2eb8a742ceb63461846f2b1ce6e5769da8f8f79b418976895423ac4fc5afe7ad5519cb9d793dd99fad4c07a4d483cbd8b3b07ac64f554441a87ca07893f28a4d4afaba45b459b33de329300c388ee0d0212a560ad19c657b2c50e45e66251f98f6a91cc9bcf0777fa278d52c0e545a4d14252d9ae3e3afd29f9e"})
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TIOCMGET(r1, 0x5415, &(0x7f00000000c0))
setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f00000001c0)=0x4, 0x99cf1c46d48c80c)
ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000100)={0x2, 0x2})

03:36:00 executing program 2:
getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00005f1000), &(0x7f0000aff000)=0xc)
madvise(&(0x7f0000d0e000/0x4000)=nil, 0x4000, 0x7f)
madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008)
madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008)

03:36:00 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x4c00, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:36:00 executing program 6 (fault-call:0 fault-nth:2):
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

[  424.255816] FAULT_INJECTION: forcing a failure.
[  424.255816] name failslab, interval 1, probability 0, space 0, times 0
[  424.258703] FAULT_INJECTION: forcing a failure.
[  424.258703] name failslab, interval 1, probability 0, space 0, times 0
[  424.267405] CPU: 1 PID: 24489 Comm: syz-executor6 Not tainted 4.18.0+ #195
[  424.285763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  424.295129] Call Trace:
[  424.297766]  dump_stack+0x1c9/0x2b4
[  424.301420]  ? dump_stack_print_info.cold.2+0x52/0x52
[  424.306639]  should_fail.cold.4+0xa/0x11
[  424.310730]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  424.315847]  ? trace_hardirqs_on+0x10/0x10
[  424.320098]  ? unwind_get_return_address+0x61/0xa0
[  424.325066]  ? find_held_lock+0x36/0x1c0
[  424.329189]  ? check_same_owner+0x340/0x340
[  424.333536]  ? rcu_note_context_switch+0x730/0x730
[  424.338491]  __should_failslab+0x124/0x180
[  424.342745]  should_failslab+0x9/0x14
[  424.346569]  kmem_cache_alloc+0x2af/0x760
[  424.350740]  ? mpol_shared_policy_init+0x235/0x670
[  424.355689]  ? lock_downgrade+0x8f0/0x8f0
[  424.360073]  __d_alloc+0xc8/0xd50
[  424.363542]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  424.368583]  ? shrink_dcache_for_umount+0x2b0/0x2b0
[  424.373620]  ? ktime_get_coarse_real_ts64+0x243/0x3a0
[  424.378828]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  424.384383]  ? timespec64_trunc+0xea/0x180
[  424.388632]  ? inode_init_owner+0x340/0x340
[  424.392975]  ? _raw_spin_unlock+0x22/0x30
[  424.397197]  ? current_time+0x131/0x1b0
[  424.401214]  ? timespec64_trunc+0x180/0x180
[  424.405556]  ? __lockdep_init_map+0x105/0x590
[  424.410083]  d_alloc_pseudo+0x1d/0x30
[  424.413907]  alloc_file_pseudo+0x158/0x3f0
[  424.418192]  ? alloc_file+0x430/0x430
[  424.422020]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[  424.427052]  ? __check_object_size+0xa3/0x5d7
[  424.431570]  ? kasan_check_write+0x14/0x20
[  424.435832]  __shmem_file_setup.part.45+0x110/0x2a0
[  424.440874]  shmem_file_setup+0x65/0x90
[  424.444870]  __x64_sys_memfd_create+0x2af/0x4f0
[  424.449558]  ? memfd_fcntl+0x1580/0x1580
[  424.453637]  ? ksys_ioctl+0x81/0xd0
[  424.457449]  ? do_syscall_64+0x9a/0x820
[  424.461454]  do_syscall_64+0x1b9/0x820
[  424.465458]  ? finish_task_switch+0x1d3/0x870
[  424.469977]  ? syscall_return_slowpath+0x5e0/0x5e0
[  424.474928]  ? syscall_return_slowpath+0x31d/0x5e0
[  424.479879]  ? __switch_to_asm+0x34/0x70
[  424.483960]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  424.489349]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  424.494247]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  424.499453] RIP: 0033:0x457089
[  424.502663] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  424.521585] RSP: 002b:00007f4c72971a18 EFLAGS: 00000246 ORIG_RAX: 000000000000013f
[  424.529313] RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 0000000000457089
[  424.536594] RDX: 0000000020000018 RSI: 0000000000000000 RDI: 00000000004c2299
[  424.543877] RBP: 0000000000000001 R08: 0000000008100000 R09: 0000000000000000
[  424.551185] R10: 0000000020000018 R11: 0000000000000246 R12: 0000000000000380
[  424.558473] R13: 00000000004d6ae8 R14: 00000000004c2299 R15: 0000000000000002
[  424.565788] CPU: 0 PID: 24497 Comm: syz-executor5 Not tainted 4.18.0+ #195
[  424.572922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  424.582387] Call Trace:
[  424.585011]  dump_stack+0x1c9/0x2b4
[  424.588684]  ? dump_stack_print_info.cold.2+0x52/0x52
[  424.594012]  should_fail.cold.4+0xa/0x11
[  424.598117]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  424.603335]  ? __mutex_lock+0x6d0/0x1700
[  424.607431]  ? perf_tp_event+0xc40/0xc40
[  424.611529]  ? uinput_write+0x10f/0x1120
[  424.615626]  ? graph_lock+0x170/0x170
[  424.615812] binder: 24490:24502 Acquire 1 refcount change on invalid ref 0 ret -22
[  424.619475]  ? find_held_lock+0x36/0x1c0
[  424.619509]  ? __lock_is_held+0xb5/0x140
[  424.619551]  ? check_same_owner+0x340/0x340
[  424.639739]  ? rcu_note_context_switch+0x730/0x730
[  424.644705]  __should_failslab+0x124/0x180
[  424.648974]  should_failslab+0x9/0x14
[  424.652799]  kmem_cache_alloc_trace+0x2cb/0x780
[  424.657488]  ? kasan_check_read+0x11/0x20
[  424.661657]  ? rcu_is_watching+0x8c/0x150
[  424.665831]  ? rcu_cleanup_dead_rnp+0x200/0x200
[  424.670550]  input_allocate_device+0xaf/0x370
[  424.675069]  ? input_devices_seq_start+0x110/0x110
[  424.680019]  ? __fget+0x4d5/0x740
[  424.683530]  uinput_write+0x837/0x1120
[  424.687522]  ? proc_fail_nth_write+0x9e/0x210
[  424.692074]  ? uinput_dev_erase_effect+0x200/0x200
[  424.697035]  ? kasan_check_read+0x11/0x20
[  424.701244]  __vfs_write+0x117/0x9d0
[  424.704978]  ? __fget_light+0x2f7/0x440
[  424.708979]  ? uinput_dev_erase_effect+0x200/0x200
[  424.713937]  ? kernel_read+0x120/0x120
[  424.717867]  ? wait_for_completion+0x8d0/0x8d0
[  424.722485]  ? __lock_is_held+0xb5/0x140
[  424.726584]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  424.732145]  ? security_file_permission+0x1c6/0x240
[  424.737233]  ? rw_verify_area+0x118/0x360
[  424.741411]  vfs_write+0x1f8/0x560
[  424.744988]  ksys_write+0x101/0x260
[  424.748645]  ? __ia32_sys_read+0xb0/0xb0
[  424.752749]  __x64_sys_write+0x73/0xb0
[  424.756662]  do_syscall_64+0x1b9/0x820
[  424.760570]  ? finish_task_switch+0x1d3/0x870
[  424.765095]  ? syscall_return_slowpath+0x5e0/0x5e0
[  424.770053]  ? syscall_return_slowpath+0x31d/0x5e0
[  424.775129]  ? __switch_to_asm+0x34/0x70
[  424.779241]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  424.784668]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  424.789662]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  424.795001] RIP: 0033:0x457089
[  424.798226] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  424.817144] RSP: 002b:00007f61d6b8ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  424.824909] RAX: ffffffffffffffda RBX: 00007f61d6b8f6d4 RCX: 0000000000457089
[  424.832220] RDX: 000000000000045c RSI: 0000000020000880 RDI: 0000000000000003
[  424.839512] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  424.846822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
03:36:00 executing program 2:
r0 = gettid()
setrlimit(0xb, &(0x7f0000011000))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$int_in(r1, 0x5452, &(0x7f0000b38000)=0x3c)
fcntl$setsig(r1, 0xa, 0x12)
poll(&(0x7f0000b2c000)=[{r2}], 0x1, 0xfffffffffffffff8)
r3 = dup2(r1, r2)
fcntl$setown(r2, 0x8, r0)
tkill(r0, 0x13)
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r3, 0x4)

03:36:00 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0xba0d0000, 0x0, 0x1100000})

[  424.854133] R13: 00000000004d77c0 R14: 00000000004ca808 R15: 0000000000000000
03:36:00 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff]}, 0x10)

[  424.892344] binder: 24490:24509 Acquire 1 refcount change on invalid ref 0 ret -22
03:36:00 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
r1 = accept4$llc(0xffffffffffffff9c, 0x0, &(0x7f0000000040), 0x800)
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'bcsf0\x00', &(0x7f0000000080)=@ethtool_gstrings={0x1b, 0x8, 0x53, "0e264717d84e429760dd93010d8a02f7361c2cccaf8b2445b21bef76e61972498b3b79de508e0998839972bb2232e603de16ef386794f29476a0bd8890781ed4ea577fa1465919d8b991b8fe895ffe51716643"}})

03:36:00 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0x3f000000, 0x0, 0x1100000})

03:36:00 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x3, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

03:36:00 executing program 2:
prctl$setmm(0x23, 0x3, &(0x7f0000ffc000/0x3000)=nil)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', <r2=>0x0})
write$binfmt_elf64(r0, &(0x7f0000003b00)=ANY=[@ANYBLOB="7f454c4600030406090000000000000002000300bf0e0000c7000000000000004000000000000000d1030000000000000300000000003800010007000000030051e57464030000000010000000000000090000000000000001000000000000000600000000000000dc02000000000000f8ffffffffffffff63d4f9615760553565be0a421d0cb42311ae906e37fcd310f5ddfb1407deb5810ade32c71ebe1653ae5d79f80790ba5903c43b466dbbe05e796d82d6dcf64c4c7111c5af036d429975f2c905a453580ff1dc0db074fd8a625a1fbc7366b0f71d0ce4050e821e4faf0a6eecb7a05c860af7e96983b9c938a2043b359dc397d3f33918d4bdb20080515ac37843fd7f6e0b6725288f3d6ddeea5e93d28c1303c4c8424bd7340293407692527d48d7e045ea85b151bd4be38d992265ad7c4c8d631cf0da4c4d330f0ee851c84b7c94b33eb094d25676e57d53789e4469c56d6479f5e0af71f8da32a11432306e8ccf75925cd3169e9855f3671fd6a2a72bdbc87639c8203f3400f4fe5d442e60ef67b176889f845bfa94822950f4fa790c6b09d4d0273ab20e2ffdc257de5101dafed0ddd5ec7f86e0a27e6a207c6fbaaf6c0181ccb4cbbda190930cb18e44b2f25ba166bc24425401db371bd9c5ca8db33f234856e73b0782bcceaa938afea597153671f86009f0e60b79aef533c8ca3a63ead5f5a09bb30698ea4cedb0396bcd160818cedfde8485f9a3b7b978d3c7e4d444ee8098d809ad5a9f4c0a9393c2242926c9e722df2ab3364e07b415e1f0d2ea067b1b66103ca7712be5ac9a09920178f070978f66970ae396ae1d69911ff0de52bc814dd1141a1cfb3f94dfd18a8a8e135ee2f6e1274f129cde03bfb941a2e6d7bc61230903374e650737c08e106d64aceeca9b0276d4114ee387f173c0f12594086d9ebde6186339bba2ceb7a3044751cffaaf281c7dbdddeeedfa91af5a31233b90286852aa815c7402a6ed6957d578c6abdc00e157155bd89effdea71f10fa1eca911da4ab61316d8197cf0dabbff3465a0478a93e7e8fde9f718512ad75cbb77cd692d10fa422cc5d52adc0d1ca1d44d9badbe220c27948c65a330f48c3635589dfa58e87f23c3d2dac42d86c372d53e05da5887eaae502a62a4f0628d42143d6cc28eeacd185fd12220299912e71117204cf94f571a979eae8cfa755984be3aaaf64244a0b63e709e1e2d41c6f4c5e24a776605187fae69d28b15d9d8e52dba12dcd1529e2521270563c0219822cc2421275c74f1adcff299c6e0b5cfbc7c8dfa5e84faae4203634503cef55a463459d3ff533cc96b7b15ae7387d1168c147b0aa2121f7b05ff2211d681d7ecfc4800ea6c700a89ee87c4ba54d19441f4bb18fcc1b35e24c14b81ccc5fce0fd18782bd4eec18392e8b81617b11dc79b594c46e95b787d93b41e7bdf17360117e53a0a4fc5d73748e0e4248cd0c5c2dd24ceaf9a4777d73b4cf2ad70b0d256be9291f79cc34a669bf0e1602f839f5178f80843b1b6428454c55788ca4d0e61c5f4619a3e0bc0efa25807a31daed3cfc7c0367b10eb8d62de0bd977f23549dbe5eb11ac38834e91eedc31d60dca8c6a9615ecdf6fcb023baf1d3057931ead687c3573afe8157804b78e9072851470eed20fd4828534f1d387b008899332e6f844c6b5f58453cf23241923ea0c56f2dcda761e4936e540f4fc7d64b902b71c20b24c7a33d91d17033938e63b1db5e0b04568b25a418aafe4f0da5203ddab5ba7df00e164c9143f047302f9ba98f8c51f3a4daf4207b35057c72e92d50191f1524ca848f7396b23445b62a2ee24ea0cd9134bae3c90c4e08f4d10211e936366432a599f8c6fa86ce92ce8d6d29b6b32d356507f4b09771e0089b2d8fadd205e4b50bd5db88b4c5a3a7d52bf4ea12b77d5ce717c2f036b2ccb21cf2ddccdf9bbe0719c0dc218df1d998a62984f1b2339c6021b33bf96817bcdc5b2bf0c9a2b414fed6b43e2a9c852fcea0f3792fc93813aaa8072e06266f0452d080b69c76fb2a2aebd93d5e31704cf7e7458ee249ea7169db8408d030150fbc6a86fe96299b1f829a8c9d1a05858b09cfa6974aad747342890f505eff69d00aa6fb5386a5ffb9edde788d3018cd3819dff9192b0dcfbcace512b545b9edbb34e1eed4676763ebe67fe1f556ea773415ae019b332444158896317de512353994b8a9e5a4a84c4b4b6b1e9c56b4c989900df6a6dc4e4eb6364f7a837d5629c4e230691aa686a9398984c3febce7c5429dafaa0e931c8f0bbfaf7e9949cf43703f3b9edfe8bde8e55d72c8fcaf88bbbf4ea9265ac15f3baad93cc8915303ba81980a648d67d10090ffd79e868a402c072e0f817cea712de80397cba47f5af05a8fc4ca7c2319801effb05572f0c1ab0ec334692ad24ba7d61766e75540c6e37e04cd15254c79c90ec50699e2b9eaf49e43a68874c1b38977c84943edfbe7fc813c2c8a976b4f27a55e1810d3a899feea288bf2733c8dce5101fccb988b7840208836187419b4a703eb1c6a5e21a41233f827132f67a607295b134c89563b7de58925fec8727fb56f874aa25544894fc60a05eb3d73075a27aa566f74287b59e1338f5c044bfc8c286bf1cc6b9294a3ba07d2779a4a423039c6db7767d8b1084077a22c1df8c16ca82bd4d3491ed842da237480550a179f36862a04fdb69252c80d569df85dd24871e13d6e6e2b4bcab408679d321bd5fbb7432c0d048e7ef1c3780e171ca97a1fffeee74cd6795be3a51f336ca0a7180392d67d0c3d89b3b2e1c08fe7861caf178671d66d00161de87070de65bb4ed06b7b416267ba96f4e35cb50082e39fb27c2b2cdd481aa2391199076cfa2a8be57ff0dd71c3b8dad69f24592ddec2e938b8f83cda392acafcc53708cdc5fbbe032510de70243a8f37b3cf9d7e25aa5803c58ac3e7b0668edcc786b52fbc4876e6f3f8f9979b0055ae5a5a6c055872e273c1470522e4a08df5b472c12da887111bb9380e7da712257f4fd79bf5a7df01ae2e16b8a7d0ce5250e61def793e5f413cd7f43e5c52b95c5312d792cc5a25fd5663eba1a5c75ab27f1ce3d504fc7a47ab887fc15bc1ecc55410ace4718244b9c40e853c072acaeb54c18f73221cab393885deae6d8195a6bdcc23e0be12545d90fe60059f79bcc54573008be7e9a8e5585af1c23a68c104d09e807bd46bcd8d4f616b53e0e8f1fbc3fc126c367d6d54cc9b7fc2f781c7759394a15ed1e81e430b037fa132e4b47a85e46359c357b00e900ecf5f23307af1ad7aca041df211758711eb177753de2483d5f77526f3e75de17b8ed307d5ac4e8b5d04b33fc727989e8b52100a6a4399539882e65f799500b1c4c244d1bb7019cd163ca9daa2c23bb81ea45478dcc8b638b348feaf250e8509d8892a0530270acf366f43ed42b0dff7ac5e3fe0b19743ac1a1cdc7d09cd2c587e0d411119efd60b614f7231094777d3d3f4708ec75380680f187f5b0bcc86e9fdd560b36e037cf39439319f40156da5e1b1b28228a06ee897ef9861131d6cfdc6848b099c2f4e180e805629df477a2ec93b2f31a8930cce84a7e8180787a28806a59761e47770ed867520835327e773cc8a670fcefb225838b3d4ca728f36469edafcad706e672c66a5f240497460251780a6cd244797d91eeaa86ad941e2e103534d7f32e9d308e08bf8f8099299da0da76b1b2177e65f256470ae69520c188e69c3d4c3441a3977f2afc42262cdb8a9009c7dfc856cde051f096ed560c561c9fc1479b26cff690751c624597e124b939b70db6bbf03d156eb9fff36b896d3efa5f6dae107459d06872234f0ec40ed9f833026b2a7e58a7e227c1bb91b62300be27217a0edd3d040ab0e263b0c7bb5ffb67d3082c154631184b26fff8151449a1f0e043c13f380c029bcf2861174cfe8682952644eaf6afbe38552a326f203ad8b97f01d6de71d7b69186a5dc04bb10d42acc22cd0cb317cfa983d2f8c606d517bf7e9a574b8ef7c1972e71fcf1f34a7a379756a35b3da2cf28cdce92fccbb17daba0e8e2817365a9abf14386690434c563435712dacd01a4cc275655d5f355ad09eede3970a7a01833658ccad5e1097309ca8883dc9ff9cd1b6077430f3dc880924cdf8ed33e7a90a3cfc804be8d74ce1736758d7f0d5617d77b90bb7608dd966a34687b94b61d60a2a6627cf57212500b0601e7b5add20ece69bc9f09d05b0e455ec96cb74fcc727fc1eddf5d480d5605a4ee0562587183e5a3335c016533e2abbae588d908ad25571f41fdf79fda3da00c09b7fbf0e9d9ca7c5c0b369f2dd2a7a43413a5910ba6e158e9a1bf9c6f71d195f449dd5f635fac42337e4a949866df61bc6a8c4606aad9ad8529c31411e04feaf89135d4fde147a85048bcce6b832ad15a5b84ec25b831b6b23635e96f7460b62a19bf79cdd42b3c69bdaee97e8e3b719ade11a33453ad0159c4cd12cbfc2df6ce806f0422dd54ea8e802f3fdea93de0c16f06a30a48f11007bd5560b5d2ed648148fc651d25174153e622ceb2b9961a6512bdfd0615975804ca5916d344582c5bd6d1970c647b994b933e7e58be9d473a438b4d2d0d0b108fe97a947064c62517103aa791bd196d27fa3569e7dead90dbbe0c02cd8df63b4b1470ca9efaf05276e5b5ee7767154a8adb5b269a399b4e1c7e01cc695c0d197b201a109760d502cea27c5d8323789cfa9fd4c05a86a35b94d186e15a24321ff30b299a9ff049e79dc1a0bd6e41c1c995aa3e0cc602d093ac27d941d789a070197785ab54ee2841164542349a6e1d5be921567ffffffff000000007305f5ac1086e78bfcd994a6e3ea7812972ddd7800a1fca18ed693b923a8b7ab84e1a0f56c5c9fbc6d7808369ba063094842cacb9622306bfa2f48906de5173c65712bc620ec9166ac7ccfa6784260cfd2d3fdfcfa1d23cfdadeacdaec3dd233661af4fc9f854118447e1527915db06e3851a386d72638f27431512a1a5a3fa4ea538457ce161d687ba27ff15231e4abb522aa4f996e6c12d4e61092f58ce1b9bc35f2a1d87b7704d7d76a53f9d35c21be3db37b5c9a87500651eecbf9e7f75f238c002f5666c47d7e216502b81610729f8654fd7757c04605d7d3bbb2f6066da5de2b56113c79d3a184a661eda5ba828b32b91f60c7b4016a38dfc925c64bbe65ddb8bb7070d98bdc5f293bee7bc6a580ee6dca19e4f43030126ad0af6c8caed87d44c7b6ca9cd33dd828a66634983ef0d481d625c1f945eeefcd4d79af00908c26193e9c8f5e8ddf88b3f17ade0168c8a3639f5701876b668e5cf9797cb3ee314135ee386b27b0d89aae1d3f1c6c4c0b15f042a5888835152e12f433a84d1a9edce0b58653fb8efdd16028722eea06f6bca5f86d0c794a53a63ce097a35dc37c177b1fd0e513fe7f092b9357b2fafb29827cab3591af5fea62c03ec69e0c11f48e0d64835a3231980c9e501d6beaa1d93e5e9602d50a1b1bfb0c3e0f74f6d09f7766b7b1299eccf0f486d8e2205265541c5080febef12b3c451d5b42b486d74820f28ab713c8560be1462ff510ed11969715418b1a6d269184c95ff43b9335bb22328fca4a968ed9301608498c879785bd9a6161106e7da09e0531e128b12d5b686e88d8bd3954fa3dd1515edd0323da3308effd2ea5c6990117ea1a4a67badbce9910afdee81367402302dd63f5c6855e1fadeeda68e1d3805159a121bc62b967b5acaf1e91bed0b6911b3c757318b1c10d4cafb59c8cfbe3e99c8de45ab026e34d0ba5e9db1fc295070bb36aa159be9a3a4afaae91eeeabddb5ff9b47be2151e7f1c3077a9f3de008a529c770c44629714e48abc4ca662e937b8aa5c10d4f55d962cad1f3e85be9bec5f6ff41facf349c7ff261e3b73b201877c65c3da0e9a47bd28fc76c2c902a798172f9fd64414fb9b4e253e63cfa7f9ac4016ec6f109e96c76b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000097e59dd9204bd25400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000021ec65c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008d719735f02984c0ee8e2799963605daa9582478489e8aca63c9f7099445b203a58b7dc6d09e7414a4584c8936c577070d8337627322bf1bd4"], 0x1a78)
sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000003ac0)={&(0x7f0000000040), 0xc, &(0x7f0000003a80)={&(0x7f0000002dc0)=ANY=[@ANYBLOB="ab9ddbe3100147508dbfa48cd907f717aa9b680192ee785fd7ba8125c23c0666e0f0e7a94998b3f4a40f1925d110d36f6912cd44ca26d5788aada6b9fc27b78e3a5fad363b3edb6da96380ae9e030bcb3c06003fcb00a9db0e437b15afd4637b8f4d22548a82a50d2d5542ae1f8f80886659d29bf38873b6215e6a8898da1b7b650186f8066025a4a4267536feb9634576290778583e8d93a943d4221132236a639fb3adb61582d6c1801362e706eadbf6fed2e512fef427bcd483a5e528dbe97f38294fd4b3a58b1618c9977221edef0ef90a821869eb91c3604f9506ee2d", @ANYRES16=r1, @ANYBLOB="250200ffffffffffffff0f01000008000100", @ANYRES32=r2, @ANYBLOB="4400020004000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000100004006c6f616462616c616e636500"], 0x60}}, 0x0)
setsockopt(r0, 0x7, 0x0, &(0x7f0000002cc0)="baabd5ad2cc3e65fb53bb0cad3215f1fa95770fcdb4549caab008e484ffc2dc941b36bb4e7543597f66cd54daa22c7d1d285578190ec86cee951b44e49c631116a8f0620551ea242a75c73f35e519f3fe318e3ca85d208fc0705bc310016d47a92cdfd4b06ef213042fa16ab0adbd963fd8b33e84a3cda5a5ff701978ade2c88e5e7084d45bf2d09e04067ba15a5c31699a7fd5dbe80f062e8ce60e03347bbfdd881d4dd7c2c99eeaee24929f1ee9a3283f640bc82d1226de47d2ddf31baa0774d1f0332ebdaf27c3c38c7bbedaeb2104336777e75b30c30336d01436d2f8ffc50d413462d615f9f8e414589eadea6fbee1446", 0xf3)
r3 = dup2(r0, r0)
ioctl$EVIOCGSW(r3, 0x8040451b, &(0x7f0000001cc0)=""/4096)

03:36:01 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000]}, 0x10)

[  425.076411] binder: 24530:24532 Acquire 1 refcount change on invalid ref 0 ret -22
[  425.163895] binder: 24530:24544 Acquire 1 refcount change on invalid ref 0 ret -22
03:36:01 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000]}, 0x10)

03:36:01 executing program 6 (fault-call:0 fault-nth:3):
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:36:01 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0xba0d, 0x0, 0x1100000})

03:36:01 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = eventfd(0x0)
ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x7, 0x2, r2})
ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x1f)

03:36:01 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xfec0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:36:01 executing program 3:
r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x1e41c14f, 0x20040)
setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000080)={{0x0, @multicast1, 0x4e21, 0x4, 'sed\x00', 0x28, 0x200, 0x66}, {@multicast2, 0x4e24, 0x10000, 0xd0, 0x9, 0x9}}, 0x44)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000))
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x9)
ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0)

03:36:01 executing program 5 (fault-call:2 fault-nth:1):
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00'}, 0x45c)

03:36:01 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x48000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  425.435769] FAULT_INJECTION: forcing a failure.
[  425.435769] name failslab, interval 1, probability 0, space 0, times 0
[  425.439537] binder: 24553:24560 Acquire 1 refcount change on invalid ref 0 ret -22
[  425.447243] CPU: 0 PID: 24564 Comm: syz-executor6 Not tainted 4.18.0+ #195
[  425.447263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  425.471443] Call Trace:
[  425.474061]  dump_stack+0x1c9/0x2b4
[  425.477722]  ? dump_stack_print_info.cold.2+0x52/0x52
[  425.482945]  should_fail.cold.4+0xa/0x11
[  425.487039]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  425.492205]  ? lock_downgrade+0x8f0/0x8f0
[  425.496384]  ? graph_lock+0x170/0x170
[  425.499331] FAULT_INJECTION: forcing a failure.
[  425.499331] name failslab, interval 1, probability 0, space 0, times 0
[  425.500301]  ? find_held_lock+0x36/0x1c0
[  425.500343]  ? check_same_owner+0x340/0x340
[  425.500370]  ? graph_lock+0x170/0x170
[  425.523823]  ? rcu_note_context_switch+0x730/0x730
[  425.528770]  ? kasan_check_read+0x11/0x20
[  425.532939]  __should_failslab+0x124/0x180
[  425.537222]  should_failslab+0x9/0x14
[  425.541041]  kmem_cache_alloc+0x2af/0x760
[  425.545222]  ? find_held_lock+0x36/0x1c0
[  425.549314]  alloc_empty_file+0x11a/0x580
[  425.553500]  ? proc_nr_files+0x60/0x60
[  425.557412]  ? kasan_check_read+0x11/0x20
[  425.561578]  ? do_raw_spin_unlock+0xa7/0x2f0
[  425.566004]  ? do_raw_spin_trylock+0x1c0/0x1c0
[  425.570606]  ? kasan_check_write+0x14/0x20
[  425.574859]  ? do_raw_spin_lock+0xc1/0x200
[  425.579116]  alloc_file+0x5c/0x430
[  425.582679]  alloc_file_pseudo+0x261/0x3f0
[  425.586939]  ? alloc_file+0x430/0x430
[  425.590762]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[  425.595797]  ? __check_object_size+0xa3/0x5d7
[  425.600312]  ? kasan_check_write+0x14/0x20
[  425.604659]  __shmem_file_setup.part.45+0x110/0x2a0
[  425.609699]  shmem_file_setup+0x65/0x90
[  425.613698]  __x64_sys_memfd_create+0x2af/0x4f0
[  425.618390]  ? memfd_fcntl+0x1580/0x1580
[  425.622471]  ? ksys_ioctl+0x81/0xd0
[  425.626119]  ? do_syscall_64+0x9a/0x820
[  425.630145]  do_syscall_64+0x1b9/0x820
[  425.634077]  ? finish_task_switch+0x1d3/0x870
[  425.638595]  ? syscall_return_slowpath+0x5e0/0x5e0
[  425.643651]  ? syscall_return_slowpath+0x31d/0x5e0
[  425.648602]  ? __switch_to_asm+0x34/0x70
[  425.652680]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  425.658071]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  425.663050]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  425.668258] RIP: 0033:0x457089
03:36:01 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0x3f00, 0x0, 0x1100000})

[  425.671470] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  425.690386] RSP: 002b:00007f4c72971a18 EFLAGS: 00000246 ORIG_RAX: 000000000000013f
[  425.698112] RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 0000000000457089
[  425.705391] RDX: 0000000020000018 RSI: 0000000000000000 RDI: 00000000004c2299
[  425.712672] RBP: 0000000000000001 R08: 0000000008100000 R09: 0000000000000000
[  425.719955] R10: 0000000020000018 R11: 0000000000000246 R12: 0000000000000380
[  425.727440] R13: 00000000004d6ae8 R14: 00000000004c2299 R15: 0000000000000003
03:36:01 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd0]}, 0x10)

[  425.734753] CPU: 1 PID: 24562 Comm: syz-executor5 Not tainted 4.18.0+ #195
[  425.741794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  425.751189] Call Trace:
[  425.753812]  dump_stack+0x1c9/0x2b4
[  425.757468]  ? dump_stack_print_info.cold.2+0x52/0x52
[  425.762685]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  425.767733]  should_fail.cold.4+0xa/0x11
[  425.771818]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  425.776956]  ? lock_downgrade+0x8f0/0x8f0
[  425.781221]  ? lock_downgrade+0x8f0/0x8f0
03:36:01 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r1 = msgget(0x1, 0x4d8)
ioctl$VT_RELDISP(r0, 0x5605)
msgctl$MSG_INFO(r1, 0xc, &(0x7f0000000040)=""/167)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)

[  425.785397]  ? graph_lock+0x170/0x170
[  425.789233]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  425.794803]  ? find_held_lock+0x36/0x1c0
[  425.798904]  ? __lock_is_held+0xb5/0x140
[  425.803005]  ? check_same_owner+0x340/0x340
[  425.807520]  ? rcu_note_context_switch+0x730/0x730
[  425.812481]  __should_failslab+0x124/0x180
[  425.816740]  should_failslab+0x9/0x14
[  425.820570]  __kmalloc_track_caller+0x2c4/0x760
[  425.825339]  ? pointer+0x990/0x990
[  425.828909]  ? async_suspend_noirq+0x110/0x110
03:36:01 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, 0x10)

[  425.833526]  ? kvasprintf_const+0x67/0x190
[  425.837789]  kvasprintf+0xb1/0x140
[  425.841355]  ? bust_spinlocks+0xe0/0xe0
[  425.845362]  kvasprintf_const+0x67/0x190
[  425.849450]  kobject_set_name_vargs+0x5b/0x150
[  425.854065]  dev_set_name+0xad/0xe0
[  425.857728]  ? device_initialize+0x5f0/0x5f0
[  425.862197]  ? input_allocate_device+0x276/0x370
[  425.866982]  input_allocate_device+0x298/0x370
[  425.871590]  ? input_devices_seq_start+0x110/0x110
[  425.876566]  uinput_write+0x837/0x1120
[  425.880487]  ? proc_fail_nth_write+0x9e/0x210
03:36:01 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000040)={0x10000, 0x9, 0x0, 0x7, 0xcd, 0x3544, 0x0, 0x0, 0x81})

[  425.885012]  ? uinput_dev_erase_effect+0x200/0x200
[  425.889961]  ? kasan_check_read+0x11/0x20
[  425.894266]  __vfs_write+0x117/0x9d0
[  425.898003]  ? __fget_light+0x2f7/0x440
[  425.902004]  ? uinput_dev_erase_effect+0x200/0x200
[  425.906960]  ? kernel_read+0x120/0x120
[  425.910874]  ? wait_for_completion+0x8d0/0x8d0
[  425.915493]  ? __lock_is_held+0xb5/0x140
[  425.919589]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  425.925181]  ? security_file_permission+0x1c6/0x240
[  425.930237]  ? rw_verify_area+0x118/0x360
[  425.934414]  vfs_write+0x1f8/0x560
03:36:01 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000]}, 0x10)

[  425.937986]  ksys_write+0x101/0x260
[  425.941809]  ? __ia32_sys_read+0xb0/0xb0
[  425.945902]  ? syscall_slow_exit_work+0x500/0x500
[  425.950774]  __x64_sys_write+0x73/0xb0
[  425.954698]  do_syscall_64+0x1b9/0x820
[  425.958608]  ? finish_task_switch+0x1d3/0x870
[  425.963130]  ? syscall_return_slowpath+0x5e0/0x5e0
[  425.968118]  ? syscall_return_slowpath+0x31d/0x5e0
[  425.973105]  ? __switch_to_asm+0x34/0x70
[  425.977219]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  425.982616]  ? trace_hardirqs_off_thunk+0x1a/0x1c
03:36:01 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x400100, 0x0)
ioctl$VHOST_RESET_OWNER(r1, 0xaf02, 0x0)
r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x10000, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$VHOST_RESET_OWNER(r2, 0xaf02, 0x0)
ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000080))

[  425.987500]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  425.992711] RIP: 0033:0x457089
[  425.996013] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  426.014937] RSP: 002b:00007f61d6b8ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  426.022682] RAX: ffffffffffffffda RBX: 00007f61d6b8f6d4 RCX: 0000000000457089
[  426.029975] RDX: 000000000000045c RSI: 0000000020000880 RDI: 0000000000000003
03:36:02 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f00000000000000]}, 0x10)

[  426.037264] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  426.044549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[  426.051837] R13: 00000000004d77c0 R14: 00000000004ca808 R15: 0000000000000001
[  426.082951] binder: 24553:24594 Acquire 1 refcount change on invalid ref 0 ret -22
03:36:02 executing program 6 (fault-call:0 fault-nth:4):
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:36:02 executing program 5 (fault-call:2 fault-nth:2):
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00'}, 0x45c)

03:36:02 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0xa000000, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  426.258969] FAULT_INJECTION: forcing a failure.
[  426.258969] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  426.271392] CPU: 1 PID: 24614 Comm: syz-executor6 Not tainted 4.18.0+ #195
[  426.278435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  426.287807] Call Trace:
[  426.290427]  dump_stack+0x1c9/0x2b4
[  426.294096]  ? dump_stack_print_info.cold.2+0x52/0x52
[  426.299326]  should_fail.cold.4+0xa/0x11
[  426.303422]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  426.308553]  ? print_usage_bug+0xc0/0xc0
[  426.312644]  ? graph_lock+0x170/0x170
[  426.316488]  ? find_held_lock+0x36/0x1c0
[  426.320579]  ? graph_lock+0x170/0x170
[  426.324415]  ? find_held_lock+0x36/0x1c0
[  426.328510]  ? __lock_is_held+0xb5/0x140
[  426.332611]  ? check_same_owner+0x340/0x340
[  426.336953]  ? find_get_entry+0x2e4/0xc90
[  426.341121]  ? rcu_note_context_switch+0x730/0x730
[  426.346105]  __alloc_pages_nodemask+0x36e/0xdb0
[  426.350802]  ? __alloc_pages_slowpath+0x2d60/0x2d60
[  426.355884]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[  426.360923]  ? percpu_counter_add_batch+0xf2/0x150
[  426.365883]  ? mpol_shared_policy_lookup+0xf7/0x150
[  426.370928]  ? __sanitizer_cov_trace_const_cmp2+0x18/0x20
[  426.376489]  alloc_pages_vma+0xdd/0x540
[  426.380499]  shmem_alloc_page+0xa8/0x190
[  426.384584]  ? shmem_swapin+0x230/0x230
[  426.388619]  shmem_alloc_and_acct_page+0x1f1/0x820
[  426.393576]  ? shmem_alloc_hugepage+0x4e0/0x4e0
[  426.398267]  ? print_usage_bug+0xc0/0xc0
[  426.402360]  shmem_getpage_gfp+0x6ea/0x41e0
[  426.406727]  ? shmem_writepage+0x1380/0x1380
[  426.411176]  ? print_usage_bug+0xc0/0xc0
[  426.415261]  ? print_usage_bug+0xc0/0xc0
[  426.419341]  ? print_usage_bug+0xc0/0xc0
[  426.423425]  ? __lock_acquire+0x7fc/0x5020
[  426.427688]  ? print_usage_bug+0xc0/0xc0
[  426.431769]  ? print_usage_bug+0xc0/0xc0
[  426.435937]  ? check_noncircular+0x20/0x20
[  426.440211]  ? print_usage_bug+0xc0/0xc0
[  426.444294]  ? print_usage_bug+0xc0/0xc0
[  426.448374]  ? trace_hardirqs_on+0x10/0x10
[  426.452638]  ? check_noncircular+0x20/0x20
[  426.456897]  ? __lock_acquire+0x7fc/0x5020
[  426.461328]  ? __lock_acquire+0x7fc/0x5020
[  426.465596]  ? trace_hardirqs_on+0x10/0x10
[  426.469845]  ? print_usage_bug+0xc0/0xc0
[  426.473927]  ? graph_lock+0x170/0x170
[  426.477743]  ? print_usage_bug+0xc0/0xc0
[  426.482080]  ? print_usage_bug+0xc0/0xc0
[  426.486185]  ? __lock_acquire+0x7fc/0x5020
[  426.490445]  ? __lock_acquire+0x7fc/0x5020
[  426.494707]  ? __lock_acquire+0x7fc/0x5020
[  426.498960]  ? graph_lock+0x170/0x170
[  426.502846]  ? find_held_lock+0x36/0x1c0
[  426.506934]  ? print_usage_bug+0xc0/0xc0
[  426.511023]  ? lock_downgrade+0x8f0/0x8f0
[  426.515207]  ? kasan_check_read+0x11/0x20
[  426.519372]  ? lock_release+0xa30/0xa30
[  426.523367]  ? mark_held_locks+0xc9/0x160
[  426.527536]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  426.533094]  ? iov_iter_fault_in_readable+0x23d/0x460
[  426.538304]  ? copy_page_from_iter+0x890/0x890
[  426.543085]  ? write_comp_data+0x32/0x70
[  426.547194]  ? ktime_get_coarse_real_ts64+0x243/0x3a0
[  426.552406]  shmem_write_begin+0x110/0x1e0
[  426.556678]  generic_perform_write+0x3ae/0x6c0
[  426.561300]  ? add_page_wait_queue+0x2c0/0x2c0
[  426.565897]  ? file_update_time+0xe4/0x640
[  426.570147]  ? current_time+0x1b0/0x1b0
[  426.574202]  ? down_write+0x8f/0x130
[  426.578069]  __generic_file_write_iter+0x26e/0x630
[  426.583023]  generic_file_write_iter+0x438/0x870
[  426.587801]  ? __generic_file_write_iter+0x630/0x630
[  426.592924]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  426.598479]  ? iov_iter_init+0xc9/0x1f0
[  426.602538]  __vfs_write+0x6af/0x9d0
[  426.606278]  ? kernel_read+0x120/0x120
[  426.610215]  ? __lock_is_held+0xb5/0x140
[  426.614313]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  426.619865]  ? __sb_start_write+0x17f/0x300
[  426.624226]  vfs_write+0x1f8/0x560
[  426.627794]  ksys_pwrite64+0x181/0x1b0
[  426.631708]  ? __ia32_sys_pread64+0xf0/0xf0
[  426.636047]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  426.641601]  ? fput+0x130/0x1a0
[  426.644900]  ? do_sys_ftruncate+0x44e/0x560
[  426.649248]  __x64_sys_pwrite64+0x97/0xf0
[  426.653417]  do_syscall_64+0x1b9/0x820
[  426.657337]  ? finish_task_switch+0x1d3/0x870
[  426.661849]  ? syscall_return_slowpath+0x5e0/0x5e0
[  426.666801]  ? syscall_return_slowpath+0x31d/0x5e0
[  426.671749]  ? __switch_to_asm+0x34/0x70
[  426.675825]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  426.681223]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  426.686093]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  426.691297] RIP: 0033:0x410e27
03:36:02 executing program 2:
r0 = socket(0x10000000000010, 0x3, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
write$FUSE_POLL(r1, &(0x7f0000000040)={0x18, 0x0, 0x3, {0x8}}, 0x18)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write(r0, &(0x7f0000f56fdc)="240000002e001f811f101a00000000002300f9ffffffffffffffffff08ffffff04010061", 0x24)

[  426.694507] Code: 12 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 51 17 00 00 c3 48 83 ec 08 e8 27 fa ff ff 48 89 04 24 49 89 ca b8 12 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 6d fa ff ff 48 89 d0 48 83 c4 08 48 3d 01
[  426.713419] RSP: 002b:00007f4c72971a10 EFLAGS: 00000293 ORIG_RAX: 0000000000000012
[  426.721148] RAX: ffffffffffffffda RBX: 0000000020000010 RCX: 0000000000410e27
[  426.728453] RDX: 0000000000000040 RSI: 0000000020000040 RDI: 0000000000000004
[  426.735944] RBP: 0000000000000001 R08: 0000000008100000 R09: 0000000000000000
[  426.743233] R10: 00000000000001c0 R11: 0000000000000293 R12: 00007f4c729726d4
[  426.750517] R13: 0000000000000004 R14: 0000000000000004 R15: 0000000000000000
[  426.793991] Dev loop6: unable to read RDB block 1
[  426.799064]  loop6: unable to read partition table
[  426.808544] FAULT_INJECTION: forcing a failure.
[  426.808544] name failslab, interval 1, probability 0, space 0, times 0
[  426.819853] CPU: 1 PID: 24623 Comm: syz-executor5 Not tainted 4.18.0+ #195
[  426.826893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  426.830066] binder: 24613:24627 Acquire 1 refcount change on invalid ref 0 ret -22
[  426.836267] Call Trace:
[  426.836295]  dump_stack+0x1c9/0x2b4
[  426.836321]  ? dump_stack_print_info.cold.2+0x52/0x52
[  426.836354]  should_fail.cold.4+0xa/0x11
[  426.847409] loop6: partition table beyond EOD, 
[  426.850416]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  426.850434]  ? graph_lock+0x170/0x170
[  426.850456]  ? pointer+0x990/0x990
[  426.850478]  ? graph_lock+0x170/0x170
[  426.850497]  ? __lock_is_held+0xb5/0x140
[  426.850518]  ? find_held_lock+0x36/0x1c0
[  426.850540]  ? __lock_is_held+0xb5/0x140
[  426.855861] truncated
[  426.859919]  ? check_same_owner+0x340/0x340
[  426.859939]  ? rcu_note_context_switch+0x730/0x730
[  426.859961]  __should_failslab+0x124/0x180
[  426.864666] loop_reread_partitions: partition scan of loop6 () failed (rc=-5)
[  426.869736]  should_failslab+0x9/0x14
[  426.869755]  __kmalloc_track_caller+0x2c4/0x760
[  426.869780]  ? uinput_write+0x1e0/0x1120
[  426.928866]  memdup_user+0x2c/0xa0
[  426.932490]  uinput_write+0x1e0/0x1120
[  426.936492]  ? proc_fail_nth_write+0x9e/0x210
[  426.941009]  ? uinput_dev_erase_effect+0x200/0x200
[  426.945955]  ? kasan_check_read+0x11/0x20
[  426.950142]  __vfs_write+0x117/0x9d0
[  426.953893]  ? __fget_light+0x2f7/0x440
[  426.957891]  ? uinput_dev_erase_effect+0x200/0x200
[  426.962836]  ? kernel_read+0x120/0x120
[  426.966739]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  426.971775]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  426.976553]  ? retint_kernel+0x10/0x10
[  426.980468]  vfs_write+0x1f8/0x560
[  426.984032]  ksys_write+0x101/0x260
[  426.987686]  ? __ia32_sys_read+0xb0/0xb0
[  426.991765]  ? syscall_slow_exit_work+0x500/0x500
[  426.996628]  __x64_sys_write+0x73/0xb0
[  427.000533]  do_syscall_64+0x1b9/0x820
[  427.004435]  ? finish_task_switch+0x1d3/0x870
[  427.008952]  ? syscall_return_slowpath+0x5e0/0x5e0
[  427.013898]  ? syscall_return_slowpath+0x31d/0x5e0
[  427.018845]  ? __switch_to_asm+0x34/0x70
[  427.022924]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  427.028311]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  427.033197]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  427.038400] RIP: 0033:0x457089
[  427.041613] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  427.060527] RSP: 002b:00007f61d6b8ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  427.068311] RAX: ffffffffffffffda RBX: 00007f61d6b8f6d4 RCX: 0000000000457089
[  427.075595] RDX: 000000000000045c RSI: 0000000020000880 RDI: 0000000000000003
[  427.082876] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  427.090229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[  427.097514] R13: 00000000004d77c0 R14: 00000000004ca808 R15: 0000000000000002
[  427.118928] binder: 24613:24629 Acquire 1 refcount change on invalid ref 0 ret -22
03:36:03 executing program 7:
r0 = socket$kcm(0x2, 0x5, 0x0)
sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@generic={0x2, "3767b4818fa51940a75a64ff601bed813ca4a744c0b30776cbb54beba33938bf9ccf422347bed9adea3ea7b2af4dc38251de34ee1983e9f78ee47cdbc9f40f1c533e017a6210f8b1ae7433ba79ea888efd4d2ca875816bb74e7216bf0a3da8b1dbb6bd851d93d102318daaf0f7c44c2c16d06122e97f68275e698782a0a1"}, 0x80, &(0x7f0000000400), 0x2d6, &(0x7f0000000100)=ANY=[]}, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmsg(r0, &(0x7f0000001480)={&(0x7f00000000c0)=@xdp, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000001400)=""/127, 0x7f}, 0x0)
setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0x4)
sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0xf00, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001bc0)="01", 0x1}], 0x1, &(0x7f0000001c80)}, 0x0)

03:36:03 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0xdba, 0x0, 0x1100000})

03:36:03 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb0fd3f00]}, 0x10)

03:36:03 executing program 3:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x9)
clock_gettime(0x0, &(0x7f0000000080)={<r1=>0x0, <r2=>0x0})
clock_nanosleep(0x7, 0x1, &(0x7f00000000c0)={r1, r2+10000000}, &(0x7f0000000100))
ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000040)=0x7ff)

03:36:03 executing program 2:
r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0)
capset(&(0x7f00002d0ff8)={0x19980330}, &(0x7f0000cc0000))
ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0)
creat(&(0x7f0000000140)='./file0\x00', 0x7ffffffffffffff9)
getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x238)
r1 = fcntl$getown(r0, 0x9)
capset(&(0x7f0000000000)={0x399f1736, r1}, &(0x7f0000000040)={0x4, 0x0, 0x82e, 0x101, 0x102000004, 0x3})

03:36:03 executing program 5 (fault-call:2 fault-nth:3):
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00'}, 0x45c)

03:36:03 executing program 6:
syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

03:36:03 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0xfc7c, 0x500, &(0x7f0000002000)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xf3, 0x0, &(0x7f0000000080)="f32008a79bd00aa547ea671ca7c26bd3bce9ddf3bc3f05bc6e8377694970348a85f9c8150ce1718c3d9afedcffb5f0ca6206d2257c4e04cf36ef778d1b05b297d3c16260c0e209ec9d47e0b5e41eeb099e59b67ae16bf3d53d044c2c4178fc438cb7bb01e65601792b7b76270d0f4aed7862e30a51f4e72ac9dcec2cb70cb608103c00830f2e80be98058681c74f12322c1cb4c1beb581b131bb28f859e068867d9ce1d6b7aaddb6118bfe834a19b9af540ce6e4b46c12a4c356747d54f83e5cd89046cc9d880bc2e097d2467a5ac2f9c63a6ab0af8e50292e0b42c5a840db8ef88795be263cf38812ab1c5bca830227eed16d"})

[  427.244561] FAULT_INJECTION: forcing a failure.
[  427.244561] name failslab, interval 1, probability 0, space 0, times 0
[  427.256032] CPU: 1 PID: 24645 Comm: syz-executor5 Not tainted 4.18.0+ #195
[  427.263071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  427.272447] Call Trace:
[  427.275069]  dump_stack+0x1c9/0x2b4
[  427.278734]  ? dump_stack_print_info.cold.2+0x52/0x52
[  427.284181]  ? __kernel_text_address+0xd/0x40
[  427.288718]  should_fail.cold.4+0xa/0x11
[  427.292813]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  427.297955]  ? save_stack+0x43/0xd0
[  427.301625]  ? kasan_kmalloc+0xc4/0xe0
[  427.305556]  ? __kmalloc_track_caller+0x14a/0x760
[  427.310462]  ? memdup_user+0x2c/0xa0
[  427.314232]  ? uinput_write+0x1e0/0x1120
[  427.318332]  ? graph_lock+0x170/0x170
[  427.322188]  ? do_syscall_64+0x1b9/0x820
[  427.326287]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  427.331703]  ? find_held_lock+0x36/0x1c0
[  427.335810]  ? __lock_is_held+0xb5/0x140
[  427.340033]  ? check_same_owner+0x340/0x340
03:36:03 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:36:03 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00100]}, 0x10)

[  427.344931]  ? rcu_note_context_switch+0x730/0x730
[  427.349898]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[  427.354947]  __should_failslab+0x124/0x180
[  427.359228]  should_failslab+0x9/0x14
[  427.363057]  __kmalloc_track_caller+0x2c4/0x760
[  427.367762]  ? uinput_write+0x2fb/0x1120
[  427.371863]  kstrndup+0x5f/0xe0
[  427.374770] binder: 24653:24654 Acquire 1 refcount change on invalid ref 0 ret -22
[  427.375211]  uinput_write+0x2fb/0x1120
[  427.386825]  ? proc_fail_nth_write+0x9e/0x210
03:36:03 executing program 2:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = dup(r0)
getsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000000400), &(0x7f0000000280))
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x78)
setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4)
r2 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x408100)
ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000000300)=""/245)
write$P9_RREADLINK(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="10000300000000000000000000000000"], 0x10)
r3 = getpgid(0x0)
ptrace$setopts(0x4200, r3, 0x1000, 0x20)
connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10)
r4 = semget(0x3, 0x7c368db6b327f27, 0x20)
semctl$SEM_STAT(r4, 0x0, 0x12, &(0x7f0000000080)=""/236)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x10)
sendto$inet(r0, &(0x7f0000000880)="94f0e86d4aef701ca8117bbae9aafca1d224f7ab5093df5fd04008b443ccff3cf45a46e1dfa12980bb68565dc76203515500a449b2533c89fb9f600c986c43bfb9122605aa60f3565cec73825b6b2e45301173a019da52250e0bc84f2c4101cc1e75573a42bc5b0a6ea5bc2e1a0e55b0bf7e4871be9b73f03d65ad0a7a49dbc13696143e9927b353986f49bf1fd9cb5afe06fa581af2688b6feda1917a205989ccb71a2e7d96d8d2dcd95232e9b859bde902846171829ae23034064be129aa269ac1884e14c89eff915e058bdae2f9f5d008780e65d9fd2ff51429c587eb013180b59564369fa907b9144f56c8dddc0fb57dbfdeb9416aa4c782490dd25843528eb227be578128a303d5134e7da62ab2a3c0f76a8b219ac133b9ec8686e50f9fa047a65e483b044cbdd84728958d76c91c9d9cdc85070cc8fd902b06b5da4895b0cc628031fa45f7c4afad9071178d0a5051fcd7482bec952bfc83682aa0ee74568cd4b22e914e1c155dc26354b74f0248e99b5d2603cf07eceff9733703fa9d99ddd31d628238d19a4be09b78ff056c4a6961076187d037fc73c86705854c16407be66b0ba67f52b02e9ff02e8a05f16cb1d1b1cca004be9433863f0b43c8b77432f92c9b0ef914725e62cfbf2c62178895e5c26725dc1ee896a1151b4893d0ae73a824293056954f2fd8ed00af4687305bca868c0e9f66eece35b90b062ba61390e6de29da3d1bb6bb7e95c3d8a890c9fdc6c144f9b0265cccdddaebe5aacd1cdf4eeec929cdd6810416ce1b098446f31cf36e0f2f2c7ca0496cf9ba1297e0d3a32cc5c1ae3b9c307ad5992b1720abce9d8dc16c2e1d23ecb7a9c6c7db4122fb38be47c6b94895a6a7b66d122742c0984e3825460ef11e5d1e11053054f4445d8ecb7bff50848b70424dc0d53a54509e3d2685719e0b3471fa577808bcbebe7f716f0b6855de2d2370f523d233cb7c27b31cff455dcc8e5d787dcb312f572366c4ec146e28aa73635061a14d60f48735bda3b7c70efe367a1f69dc199bed98ad9dd47eea1a78758d3255c0eee7a292d7a8cbc31792bbc582f0c0520e5a39123f4b89471c65e07c3f41001e7164c314a898f15760c3bd6e4fbc0760be6eff4352514cdb89e3f941846258b7bce5da7bd595eeb4c7c759c2ebabca9db91d3b04fc8981290db936e691efa035d796224c5e9381e5062b52021e7a88a8f16e69ae5ef65be54295d221f9ff05276df28de4e3f2a34a68607a7b4e932e3c5221c6e2083fac80614a5aaef7a546a793a61d10e2f96b50830b19811c9c49029a1ed0041c01bd577fb695d0e31e8ac99096c70f0f7b48b73654ea0a29a7d820c3c1a72208fc664b90937ae2eb1fdcd18381329f0d022113173d2f96625cc498a448fe8d6409db0539ffe099825abbe2dc1e0737020ea53506bb5174e856995b453afde30ebd14d76a96e46cf322e1efdd144ba5c411fd56e8202374afc5800c61391b3846a1c48c655ad72fccb28cc78c218587d93713b3006602e2d82577730050b589ee7eba17e51d5da9f1c499cb4cffa56b5fc60f0e37ad1f25b4c6a8ab3b023c36dd4471abc0444708be9d0f4b819afe33ac25b8a0def3bb2feed6daf10c17bfaac431e16d743537fc8064614a46d768bafffbadbcaf8dc7faf8639f01b92a87f1b40ebf2dffbea84afcf1357519baca9ea2a9c22a869dda82878ce552a5d1b8c248cec20f707fea91b1e014ea47068140704122ac5982b2d700fd250c2577c58f2ed97e21649bc99fd9af1d99d3f8989ccb8b8e4ca445345193dad3c39e9bdc86a9721a0d8be5e875e4de796b8e11b625962abc5935362541e570ee131f3537b26ab1256b7f939386c51066ce6c56c051f6ea598b9b6491524f368fa56279ba3325adb6fdce78db8f142ee5655aa3e38c32ba41d1aaa1e3e099b216a7258512e4b7e90e2c7418295f66b5e4190fff16e5cece9bd26e7eb397c5c5fdceb980dd5184f8004284d8343f91468e97d6e7929540b2e6a934", 0x595, 0x0, 0x0, 0x0)
sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000010, &(0x7f00004daff0)={0x2, 0x0, @loopback}, 0x10)

[  427.391348]  ? uinput_dev_erase_effect+0x200/0x200
[  427.396304]  ? kasan_check_read+0x11/0x20
[  427.400487]  __vfs_write+0x117/0x9d0
[  427.404227]  ? __fget_light+0x2f7/0x440
[  427.408273]  ? uinput_dev_erase_effect+0x200/0x200
[  427.413233]  ? kernel_read+0x120/0x120
[  427.417149]  ? wait_for_completion+0x8d0/0x8d0
[  427.421790]  ? __lock_is_held+0xb5/0x140
[  427.425882]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  427.431446]  ? security_file_permission+0x1c6/0x240
[  427.436490]  ? rw_verify_area+0x118/0x360
[  427.440673]  vfs_write+0x1f8/0x560
03:36:03 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}, 0x10)

[  427.444243]  ksys_write+0x101/0x260
[  427.447894]  ? __ia32_sys_read+0xb0/0xb0
[  427.451990]  __x64_sys_write+0x73/0xb0
[  427.455906]  do_syscall_64+0x1b9/0x820
[  427.459823]  ? finish_task_switch+0x1d3/0x870
[  427.464350]  ? syscall_return_slowpath+0x5e0/0x5e0
[  427.469309]  ? syscall_return_slowpath+0x31d/0x5e0
[  427.474359]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  427.479756]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  427.484629]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  427.489964] RIP: 0033:0x457089
03:36:03 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
bind$inet(r1, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendto$inet(r1, &(0x7f0000000a00), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x10)

[  427.493259] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  427.512203] RSP: 002b:00007f61d6b8ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  427.520019] RAX: ffffffffffffffda RBX: 00007f61d6b8f6d4 RCX: 0000000000457089
[  427.527305] RDX: 000000000000045c RSI: 0000000020000880 RDI: 0000000000000003
[  427.534593] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  427.541884] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[  427.549201] R13: 00000000004d77c0 R14: 00000000004ca808 R15: 0000000000000003
[  427.564347]  loop6: p1
[  427.566942] loop6: partition table partially beyond EOD, truncated
[  427.567799] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based  firewall rule not found. Use the iptables CT target to attach helpers instead.
03:36:03 executing program 1:
r0 = socket$inet6(0xa, 0x80806, 0x0)
ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000080)={@local, @mcast1, @mcast1, 0x0, 0xdba, 0x0, 0x0, 0x0, 0x1100000})

03:36:03 executing program 5 (fault-call:2 fault-nth:4):
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00'}, 0x45c)

[  427.601956] loop6: p1 start 1 is beyond EOD, truncated
03:36:03 executing program 6:
syz_read_part_table(0xfffffff6, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="0200a9ffffff01000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}])

[  427.673592] FAULT_INJECTION: forcing a failure.
[  427.673592] name failslab, interval 1, probability 0, space 0, times 0
[  427.684949] CPU: 1 PID: 24682 Comm: syz-executor5 Not tainted 4.18.0+ #195
[  427.691990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  427.701365] Call Trace:
[  427.703986]  dump_stack+0x1c9/0x2b4
[  427.707700]  ? dump_stack_print_info.cold.2+0x52/0x52
[  427.712951]  ? __kernel_text_address+0xd/0x40
[  427.717478]  ? unwind_get_return_address+0x61/0xa0
[  427.722448]  should_fail.cold.4+0xa/0x11
[  427.726546]  ? fault_create_debugfs_attr+0x1f0/0x1f0
[  427.731691]  ? save_stack+0xa9/0xd0
[  427.735350]  ? kasan_kmalloc+0xc4/0xe0
[  427.739272]  ? __kmalloc_track_caller+0x14a/0x760
[  427.744212]  ? kstrndup+0x5f/0xe0
[  427.747704]  ? uinput_write+0x2fb/0x1120
[  427.751794]  ? __vfs_write+0x117/0x9d0
[  427.755710]  ? vfs_write+0x1f8/0x560
[  427.759449]  ? ksys_write+0x101/0x260
[  427.763280]  ? graph_lock+0x170/0x170
[  427.767119]  ? find_held_lock+0x36/0x1c0
[  427.771228]  ? __lock_is_held+0xb5/0x140
[  427.775332]  ? check_same_owner+0x340/0x340
[  427.779688]  ? __lock_is_held+0xb5/0x140
[  427.783771]  ? rcu_note_context_switch+0x730/0x730
[  427.788731]  __should_failslab+0x124/0x180
[  427.792989]  should_failslab+0x9/0x14
[  427.796811]  kmem_cache_alloc_trace+0x2cb/0x780
[  427.801508]  input_alloc_absinfo+0x86/0xf0
[  427.805787]  uinput_write+0x549/0x1120
[  427.809711]  ? uinput_dev_erase_effect+0x200/0x200
[  427.814663]  ? kasan_check_read+0x11/0x20
[  427.818851]  __vfs_write+0x117/0x9d0
[  427.822579]  ? __fget_light+0x2f7/0x440
[  427.826579]  ? uinput_dev_erase_effect+0x200/0x200
[  427.831529]  ? kernel_read+0x120/0x120
[  427.835428]  ? wait_for_completion+0x8d0/0x8d0
[  427.840019]  ? __lock_is_held+0xb5/0x140
[  427.844095]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  427.849657]  ? security_file_permission+0x1c6/0x240
[  427.854697]  ? rw_verify_area+0x118/0x360
[  427.858851]  vfs_write+0x1f8/0x560
[  427.862393]  ksys_write+0x101/0x260
[  427.866023]  ? __ia32_sys_read+0xb0/0xb0
[  427.870102]  ? syscall_slow_exit_work+0x500/0x500
[  427.874955]  __x64_sys_write+0x73/0xb0
[  427.878856]  do_syscall_64+0x1b9/0x820
[  427.882754]  ? finish_task_switch+0x1d3/0x870
[  427.887260]  ? syscall_return_slowpath+0x5e0/0x5e0
[  427.892200]  ? syscall_return_slowpath+0x31d/0x5e0
[  427.897146]  ? __switch_to_asm+0x34/0x70
[  427.901232]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  427.906590]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  427.911439]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  427.916632] RIP: 0033:0x457089
[  427.919827] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  427.938748] RSP: 002b:00007f61d6b8ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  427.946474] RAX: ffffffffffffffda RBX: 00007f61d6b8f6d4 RCX: 0000000000457089
[  427.953748] RDX: 000000000000045c RSI: 0000000020000880 RDI: 0000000000000003
[  427.961014] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  427.968292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[  427.975571] R13: 00000000004d77c0 R14: 00000000004ca808 R15: 0000000000000004
[  427.983012] ------------[ cut here ]------------
[  427.987827] input_alloc_absinfo(): kcalloc() failed?
[  427.993310] WARNING: CPU: 1 PID: 24682 at drivers/input/input.c:487 input_alloc_absinfo+0xc1/0xf0
[  428.002330] Kernel panic - not syncing: panic_on_warn set ...
[  428.002330] 
[  428.009692] CPU: 1 PID: 24682 Comm: syz-executor5 Not tainted 4.18.0+ #195
[  428.016711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  428.026073] Call Trace:
[  428.028688]  dump_stack+0x1c9/0x2b4
[  428.032336]  ? dump_stack_print_info.cold.2+0x52/0x52
[  428.037539]  panic+0x238/0x4e7
[  428.040745]  ? add_taint.cold.5+0x16/0x16
[  428.044910]  ? __warn.cold.8+0x148/0x1ba
[  428.048983]  ? input_alloc_absinfo+0xc1/0xf0
[  428.053418]  __warn.cold.8+0x163/0x1ba
[  428.057327]  ? input_alloc_absinfo+0xc1/0xf0
[  428.061754]  report_bug+0x252/0x2d0
[  428.065394]  do_error_trap+0x1fc/0x4d0
[  428.069299]  ? math_error+0x3e0/0x3e0
[  428.073109]  ? vprintk_default+0x28/0x30
[  428.077215]  ? vprintk_func+0x81/0x117
[  428.081130]  ? printk+0xa7/0xcf
[  428.084464]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  428.089326]  do_invalid_op+0x1b/0x20
[  428.093048]  invalid_op+0x14/0x20
[  428.096515] RIP: 0010:input_alloc_absinfo+0xc1/0xf0
[  428.101544] Code: 80 3c 11 00 75 38 48 89 83 60 01 00 00 48 85 c0 75 96 e8 c2 86 10 fd 48 c7 c6 c0 c2 5c 87 48 c7 c7 c0 bc 5c 87 e8 5f 17 db fc <0f> 0b e9 77 ff ff ff 4c 89 e7 e8 50 7d 4f fd e9 60 ff ff ff 4c 89
[  428.120636] RSP: 0018:ffff880192ae7a68 EFLAGS: 00010286
[  428.126024] RAX: 0000000000000000 RBX: ffff88019b1fb540 RCX: ffffc90005427000
[  428.133486] RDX: 0000000000040000 RSI: ffffffff8163ac51 RDI: ffff880192ae7758
[  428.140767] RBP: ffff880192ae7a80 R08: ffff8801972ae2c0 R09: 0000000000000006
[  428.148207] R10: ffff8801972ae2c0 R11: 0000000000000000 R12: ffff88019b1fb6a0
[  428.155493] R13: ffff88019b1fb540 R14: 0000000000000000 R15: 0000000000000000
[  428.162796]  ? vprintk_func+0x81/0x117
[  428.166801]  ? input_alloc_absinfo+0xc1/0xf0
[  428.171231]  uinput_write+0x549/0x1120
[  428.175146]  ? uinput_dev_erase_effect+0x200/0x200
[  428.180297]  ? kasan_check_read+0x11/0x20
[  428.184470]  __vfs_write+0x117/0x9d0
[  428.188221]  ? __fget_light+0x2f7/0x440
[  428.192279]  ? uinput_dev_erase_effect+0x200/0x200
[  428.197232]  ? kernel_read+0x120/0x120
[  428.201140]  ? wait_for_completion+0x8d0/0x8d0
[  428.205773]  ? __lock_is_held+0xb5/0x140
[  428.209857]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  428.215637]  ? security_file_permission+0x1c6/0x240
[  428.220686]  ? rw_verify_area+0x118/0x360
[  428.224857]  vfs_write+0x1f8/0x560
[  428.228421]  ksys_write+0x101/0x260
[  428.232071]  ? __ia32_sys_read+0xb0/0xb0
[  428.236151]  ? syscall_slow_exit_work+0x500/0x500
[  428.241044]  __x64_sys_write+0x73/0xb0
[  428.244952]  do_syscall_64+0x1b9/0x820
[  428.248855]  ? finish_task_switch+0x1d3/0x870
[  428.253455]  ? syscall_return_slowpath+0x5e0/0x5e0
[  428.258405]  ? syscall_return_slowpath+0x31d/0x5e0
[  428.263613]  ? __switch_to_asm+0x34/0x70
[  428.267693]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[  428.273078]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  428.277944]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  428.283147] RIP: 0033:0x457089
[  428.286387] Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  428.305547] RSP: 002b:00007f61d6b8ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  428.313272] RAX: ffffffffffffffda RBX: 00007f61d6b8f6d4 RCX: 0000000000457089
[  428.320557] RDX: 000000000000045c RSI: 0000000020000880 RDI: 0000000000000003
[  428.327839] RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000
[  428.335123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
[  428.342430] R13: 00000000004d77c0 R14: 00000000004ca808 R15: 0000000000000004
[  428.350342] Dumping ftrace buffer:
[  428.354188]    (ftrace buffer empty)
[  428.357900] Kernel Offset: disabled
[  428.361527] Rebooting in 86400 seconds..