[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 11.108140] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 32.834110] random: sshd: uninitialized urandom read (32 bytes read) [ 33.344594] audit: type=1400 audit(1568989453.562:6): avc: denied { map } for pid=1770 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 33.390993] random: sshd: uninitialized urandom read (32 bytes read) [ 33.984528] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.35' (ECDSA) to the list of known hosts. [ 39.563805] random: sshd: uninitialized urandom read (32 bytes read) 2019/09/20 14:24:19 fuzzer started [ 39.665360] audit: type=1400 audit(1568989459.882:7): avc: denied { map } for pid=1779 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 40.389163] random: cc1: uninitialized urandom read (8 bytes read) 2019/09/20 14:24:21 dialing manager at 10.128.0.26:44225 2019/09/20 14:24:21 syscalls: 1353 2019/09/20 14:24:21 code coverage: enabled 2019/09/20 14:24:21 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument 2019/09/20 14:24:21 extra coverage: extra coverage is not supported by the kernel 2019/09/20 14:24:21 setuid sandbox: enabled 2019/09/20 14:24:21 namespace sandbox: enabled 2019/09/20 14:24:21 Android sandbox: /sys/fs/selinux/policy does not exist 2019/09/20 14:24:21 fault injection: CONFIG_FAULT_INJECTION is not enabled 2019/09/20 14:24:21 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/09/20 14:24:21 net packet injection: enabled 2019/09/20 14:24:21 net device setup: enabled [ 43.339373] random: crng init done 14:25:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:15 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c256be74d2b81cbbeb2a49fd409b184f16d7807f6ba2972b31dd4301380dd708e3a6815ced3f7fee97e6e", 0xf1}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:25:15 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000007c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001077d60b7030000000000006a0a00fe18000000850000002b000000b70000000000000095000000000000000d7a28683a4102e4aeb54f36633e27c279341bf489903cfdb4c05e96e3046f04e77969be0634674d0942b66b249b3518598e7e290b39a6f2fc2a5e019bc6b45684f002cf57bf887e83fbb2215b8a34e6bdc4dc1af6d3c6958da4bddac602e0048bec11e874602f925b6dbd2af21b75fe26aa5e85ae281993bfa213923bb755c1f1abd196407b4c8fab18bdcab9f62b9b4601"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r0, 0x18000000000002a0, 0xe, 0x6000, &(0x7f00000006c0)="b9ff0300000d698cb89e40f02cea", 0x0, 0x102}, 0x28) 14:25:15 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) [ 94.939074] audit: type=1400 audit(1568989515.152:8): avc: denied { map } for pid=1779 comm="syz-fuzzer" path="/root/syzkaller-shm037328579" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 14:25:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f00000017c0)=[{{&(0x7f00000001c0)={0xa, 0x4e20, 0x0, @local}, 0x1c, 0x0}}, {{&(0x7f0000001600)={0xa, 0x4e24, 0x0, @mcast1, 0x7fff}, 0x1c, 0x0}}], 0x2, 0x0) 14:25:15 executing program 2: r0 = socket(0x2, 0x3, 0x100000001) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000000)={0x0, {{0x2, 0x0, @multicast2}}, 0x0, 0x2, [{{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast2}}]}, 0x190) [ 95.004036] audit: type=1400 audit(1568989515.192:9): avc: denied { map } for pid=1831 comm="syz-executor.5" path="/sys/kernel/debug/kcov" dev="debugfs" ino=5044 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 14:25:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") poll(&(0x7f0000000100)=[{}], 0x1, 0x6) 14:25:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") poll(&(0x7f0000000100)=[{}], 0x1, 0x6) 14:25:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") poll(&(0x7f0000000100)=[{}], 0x1, 0x6) 14:25:17 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) [ 99.206577] audit: type=1400 audit(1568989519.422:10): avc: denied { prog_load } for pid=2771 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 99.231931] audit: type=1400 audit(1568989519.452:11): avc: denied { prog_run } for pid=2771 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 14:25:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x80201000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)="2400000018007be11dfffd946f6105de800000031f00000000000800080011000400ff7e280000001100ffffba16a0aa1c0900589d7e80927d060e1b9ba8550e0000000000200000", 0x48}], 0x1}, 0x0) 14:25:21 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) 14:25:21 executing program 4: 14:25:21 executing program 2: 14:25:21 executing program 3: 14:25:21 executing program 1: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) ioctl$int_in(r2, 0x5421, &(0x7f0000000140)=0x1) connect$inet(r3, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x0, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r3, 0x0, 0x10003, 0x0) 14:25:21 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) 14:25:21 executing program 4: 14:25:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) 14:25:21 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) 14:25:21 executing program 4: [ 101.083212] audit: type=1400 audit(1568989521.302:12): avc: denied { set_context_mgr } for pid=2792 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 101.088106] binder: undelivered death notification, 0000000000000000 14:25:21 executing program 0: 14:25:21 executing program 4: 14:25:21 executing program 0: 14:25:21 executing program 4: 14:25:21 executing program 0: [ 101.210274] binder: undelivered death notification, 0000000000000000 14:25:22 executing program 1: 14:25:22 executing program 3: 14:25:22 executing program 4: 14:25:22 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:22 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) 14:25:22 executing program 0: 14:25:22 executing program 1: 14:25:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000005140)=[{{&(0x7f0000000480)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, 0x0}}], 0x1, 0x0, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000ac9000)="290000002000190f00003fffffffda060200000000e80001040000040d000a00ea1100000005000000", 0x29}], 0x1) 14:25:22 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_int(r3, 0x1, 0x3, &(0x7f0000000a40), &(0x7f0000000a80)=0x4) 14:25:22 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x19, 0x0, &(0x7f00000000c0)="b9ff0300000d698cb89e40f065581fffffff00004000632f77", 0x0, 0x100, 0x6000000000000000}, 0x28) 14:25:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") r1 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000100), &(0x7f0000000140)=0x4) 14:25:22 executing program 4: 14:25:22 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) 14:25:22 executing program 4: 14:25:22 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendfile(r2, r1, 0x0, 0x100045) 14:25:22 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r2, &(0x7f0000000280)={0x7}, 0xfffffffffffffe93) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000100)={0x0, r2}) creat(&(0x7f0000000240)='./file0\x00', 0x0) 14:25:22 executing program 4: bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x25dfdbfb, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x39, 0x703, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) 14:25:22 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0xfecb, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) sendmmsg$inet(r0, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="8c2fb08f70aca1f2e24e7dc4636db1607852800ad7239bfbb123065f680fcd8bd0da6e13b662424ccd67943bc81a1d56defee801abbb295542689614ad3cf075062ecc8fff703998f05b4a75cd21c51a0cdf5c1d22ec6c88b2f328c35d2284ce37375165fc7b892d9211b9f2b8d60d65de6a11b376b8379dea0e24d9d54997f9b0c35fdbb691b6a85b1dd235877eaf2c6b56cdebc12feefdd198891969cc07ec80aa29bcc95a7fa0866e97a784c0ac21edab15d06cfb51b0f47e5f4404", 0xbd}, {&(0x7f0000000340)="4520d8c1ee8e08b9ee293229", 0xc}], 0x2}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000006840)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000004c0)=""/62, 0x3e}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000a40)=""/38, 0x26}, {&(0x7f0000000a80)=""/108, 0x6c}], 0x2}}], 0x2, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) sendto$inet(r0, &(0x7f00000012c0)='\f', 0x1, 0x0, 0x0, 0x0) 14:25:22 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) 14:25:22 executing program 4: dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) mkdir(0x0, 0x0) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, 0x0) r0 = gettid() inotify_init() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) mknod$loop(0x0, 0x0, 0x1) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) tkill(r0, 0x1000000000016) 14:25:23 executing program 3: syz_emit_ethernet(0x165, &(0x7f0000000200)=ANY=[@ANYBLOB="0180c2000000ffffffffffff86dd68c6bad1012f2b03fe800000000000000000000000000025fe8000000000000000000000000000aa3c6de3470a00000000000000000000000000000000000000ad0404020160000000000000000000000000ffffac14141d00000000000000000000000000000000620a038f00000000fe8000000000000000000000000000277c6fc134e0a8979746962697985ded2ffe88000000000000000000000000000100000000000000000000000000000000ff0100000000000000000000000000013906040322402000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000013c08003900000000fe8000000000000000000000000000bb000000000000000000000000000000010000000000000000000000000000000052f87707d0f1486d2753dd7dac4d67764e224e2404119078a2dccc7d3ae0e2c723a49786b1720c"], 0x0) [ 102.735689] audit: type=1400 audit(1568989522.952:13): avc: denied { create } for pid=2871 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 14:25:23 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) 14:25:23 executing program 3: syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @random, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @empty, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 14:25:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendfile(r2, r1, 0x0, 0x100045) 14:25:23 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') close(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 102.813079] audit: type=1400 audit(1568989522.952:14): avc: denied { write } for pid=2871 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 14:25:23 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendfile(r2, r1, 0x0, 0x100045) 14:25:23 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) 14:25:23 executing program 1: clock_adjtime(0x4, &(0x7f0000000000)={0x1, 0x3, 0x0, 0xfffffffffffffffe, 0x3, 0xffffffff, 0x7fffffff, 0x100000000, 0x1, 0x7, 0x8, 0x10000, 0x1000, 0x2373a2d6, 0xffff, 0x0, 0x0, 0x7ff, 0x4, 0xc9, 0x1, 0x498b, 0xfff, 0x8, 0xb0, 0x4}) r0 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write(r0, &(0x7f0000000100), 0xffffffffffffffd1) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newlink={0x68, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x48, 0x12, @ip6gretap={{0x10, 0x1, 'ip6gretap\x00'}, {0x34, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x6, @local}, @IFLA_GRE_REMOTE={0x14, 0x7, @local}, @gre_common_policy=[@IFLA_GRE_LINK={0x8}]]}}}]}, 0x68}}, 0x0) socket(0x10, 0x803, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000003b40)={{{@in=@multicast1, @in6=@remote}}, {{}, 0x0, @in=@loopback}}, &(0x7f0000003c40)=0xe8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0), 0xffffffeb, 0x13, 0x0, 0xfffffffffffffdf0) 14:25:23 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') close(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:25:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) [ 103.594397] binder: undelivered death notification, 0000000000000000 14:25:25 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) creat(&(0x7f0000000080)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x3bb7) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280)={0x7}, 0xfffffffffffffe93) syncfs(0xffffffffffffffff) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000100)={0x0, r4}) 14:25:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendfile(r2, r1, 0x0, 0x100045) 14:25:25 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r0}], 0x1, 0x6) 14:25:25 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) 14:25:25 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') close(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:25:25 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) splice(r0, 0x0, r1, 0x0, 0x10003, 0x0) 14:25:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) [ 105.794552] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. 14:25:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:25:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) 14:25:26 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x3, 0x6) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmmsg$inet(r0, &(0x7f0000007640)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2}}}], 0x20}}, {{&(0x7f0000000400), 0x10, 0x0, 0x0, &(0x7f00000034c0)=[@ip_retopts={{0x10}}, @ip_ttl={{0x14}}], 0x28}}], 0x2, 0x0) 14:25:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) 14:25:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') socket$inet_udp(0x2, 0x2, 0x0) [ 106.057755] raw_sendmsg: syz-executor.4 forgot to set AF_INET. Fix it! 14:25:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:26 executing program 1: creat(0x0, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) ftruncate(r0, 0x208200) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8000fffffffe) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x3bb7) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r3, &(0x7f0000000280)={0x7}, 0xfffffffffffffe93) syncfs(0xffffffffffffffff) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000100)={0x0, r3}) 14:25:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') 14:25:26 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') close(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:25:26 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_int(r0, 0x29, 0x38, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x10010000000032) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 14:25:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:26 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) splice(r0, 0x0, r1, 0x0, 0x10003, 0x0) [ 106.588962] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. 14:25:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) 14:25:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file0\x00', 0x0, 0x0) 14:25:27 executing program 1: creat(0x0, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) ftruncate(r0, 0x208200) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8000fffffffe) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x3bb7) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r3, &(0x7f0000000280)={0x7}, 0xfffffffffffffe93) syncfs(0xffffffffffffffff) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000100)={0x0, r3}) 14:25:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:27 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') close(r0) 14:25:29 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x9, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000140)='syzkaller\x00', 0x1, 0x1ee, &(0x7f00000003c0)=""/251, 0x0, 0x0, [], 0x0, 0xd, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1cf}, 0x48) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={r1, r0, 0xd, 0x2}, 0xd) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000100)={r1, r0, 0x8000000000d}, 0xe) 14:25:29 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:29 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:29 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:29 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) splice(r0, 0x0, r1, 0x0, 0x10003, 0x0) 14:25:29 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:29 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000340)=0x1, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000100)=0xe, 0xfec3) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) 14:25:29 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:29 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:30 executing program 4: r0 = syz_open_dev$evdev(0x0, 0x0, 0x2) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0x10000007c) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) creat(&(0x7f0000000380)='./file0\x00', 0x91) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 14:25:30 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:30 executing program 1: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:30 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:30 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x4) syz_emit_ethernet(0x36, &(0x7f0000000100)={@link_local, @random="ae39b5e39d7f", [{}], {@arp={0x806, @generic={0x0, 0x0, 0x6, 0x0, 0x0, @dev, "", @empty, "0000000000f1dd00001600"}}}}, 0x0) 14:25:30 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:30 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:30 executing program 1: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0b") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:30 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:30 executing program 4: add_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f00000000c0), &(0x7f0000000100), 0x390, 0xfffffffffffffffb) 14:25:30 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:30 executing program 1: sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000240)="11dca50d5e0bcfe47bf070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000180)={'veth1_to_team\x00', {0x2, 0x0, @empty}}) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f0000000000)={'veth1_to_team\x00', {0x2, 0x0, @rand_addr=0xfffffffffffffff8}}) 14:25:30 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:30 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0b") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:30 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:31 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:31 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:31 executing program 4: syz_mount_image$msdos(&(0x7f0000000100)='msdos\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001900)={[{@fat=@tz_utc='tz=UTC'}]}) 14:25:31 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0b") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:31 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:31 executing program 1: socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:31 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) [ 111.333446] FAT-fs (loop4): bogus number of reserved sectors [ 111.370242] FAT-fs (loop4): Can't find a valid FAT filesystem 14:25:31 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) INIT: Id "1" respawning too fast: disabled for 5 minutes 14:25:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7b") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:31 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:31 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) INIT: Id "3" respawning too fast: disabled for 5 minutes INIT: Id "2" respawning too fast: disabled for 5 minut[ 111.444387] FAT-fs (loop4): bogus number of reserved sectors es [ 111.471291] FAT-fs (loop4): Can't find a valid FAT filesystem INIT: Id "4" respawning too fast: disabled for 5 minutes INIT: Id "5" respawning too fast: disabled for 5 minutes INIT: Id "6" respawning too fast: disabled for 5 minutes 14:25:32 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:32 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) 14:25:32 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x5c831, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x800000800000001) getsockopt$inet_mreqsrc(r0, 0x0, 0x53, 0x0, &(0x7f0000000040)) 14:25:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7b") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:32 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:32 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x8}, 0x0) 14:25:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:32 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x8}, 0x0) 14:25:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7b") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x8}, 0x0) 14:25:33 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000000)='\x18\xe2\xfd\x15#S04\x00\xba ', 0x0, 0x130643) flock(r0, 0x0) 14:25:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf0") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:33 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:33 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000500)='./file0\x00', 0x0) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x8}, 0x0) 14:25:33 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0x10000007c) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGSND(r0, 0x8040451a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 14:25:33 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000500)='./file0\x00', 0x0) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf0") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x8}, 0x0) 14:25:33 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:33 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000500)='./file0\x00', 0x0) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x8}, 0x0) 14:25:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:33 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:33 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='tunl0\x00', 0xa2) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x0, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:33 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) sendfile(r1, r0, 0x0, 0x100045) 14:25:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:33 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf0") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x0, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:33 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x3c, 0x11, 0x0, 0x0, 0x0, {@in=@broadcast}, [@srcaddr={0x14, 0xd, @in6=@empty}]}, 0x3c}, 0x8}, 0x0) 14:25:33 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001540)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004020000000000"], 0x0, 0x26}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r1, &(0x7f0000000d40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000dc0)=0x80) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x2c8, &(0x7f0000000100)={&(0x7f00000001c0)={0x24, 0x23, 0x847, 0x0, 0x0, {0x2804}, [@typed={0x5, 0xb, @str='\x02\xac\x0f\x00me_type\x00'}]}, 0x269}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r3}, 0x14}}, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, r3, 0x1800, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40843}, 0x4000070) close(0xffffffffffffffff) 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x28, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}}, 0x28}, 0x8}, 0x0) 14:25:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(0x0, 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:33 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0b") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x28, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}}, 0x28}, 0x8}, 0x0) 14:25:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(0x0, 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001540)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004020000000000"], 0x0, 0x26}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r1, &(0x7f0000000d40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000dc0)=0x80) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x2c8, &(0x7f0000000100)={&(0x7f00000001c0)={0x24, 0x23, 0x847, 0x0, 0x0, {0x2804}, [@typed={0x5, 0xb, @str='\x02\xac\x0f\x00me_type\x00'}]}, 0x269}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r3}, 0x14}}, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, r3, 0x1800, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40843}, 0x4000070) close(0xffffffffffffffff) [ 113.502381] audit: type=1400 audit(1568989533.722:15): avc: denied { getattr } for pid=3329 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 113.580907] audit: type=1400 audit(1568989533.722:16): avc: denied { read } for pid=3329 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 14:25:34 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c40)=@delsa={0x28, 0x11, 0x1, 0x0, 0x0, {@in=@broadcast}}, 0x28}, 0x8}, 0x0) 14:25:34 executing program 4: r0 = socket(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'erspan0\x00', 0x2}, 0x18) ioctl(r0, 0x8916, &(0x7f0000000000)) ioctl(r0, 0x8936, &(0x7f0000000000)) 14:25:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(0x0, 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x6) 14:25:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0b") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:34 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:34 executing program 3: r0 = creat(0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 3: r0 = creat(0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0b") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) 14:25:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(0x0, 0x0, 0x6) 14:25:34 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="240000005e009331cdcda3ee51070000000000bd5a4049902dafbcfadb8a00", @ANYRES32, @ANYBLOB="7fff00"/12], 0x24}}, 0x0) 14:25:34 executing program 3: r0 = creat(0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47b") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:34 executing program 3: creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:34 executing program 1: ioctl(0xffffffffffffffff, 0x0, 0x0) seccomp(0x0, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{}]}) add_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f00000000c0), &(0x7f0000000100), 0x390, 0xfffffffffffffffb) 14:25:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47b") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:34 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(0x0, 0x0, 0x6) 14:25:34 executing program 3: creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47b") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x28, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}, @free_buffer, @release], 0x0, 0x0, 0x0}) 14:25:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47b") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:34 executing program 3: creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(0x0, 0x0, 0x6) 14:25:34 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) 14:25:34 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:34 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, 0x0, 0x0) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:34 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 14:25:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100), 0x0, 0x6) 14:25:34 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, 0x0, 0x0) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf0") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:34 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:34 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, 0x0, 0x0) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:34 executing program 1: r0 = socket(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'erspan0\x00', 0x2}, 0x18) ioctl(r0, 0x8916, &(0x7f0000000000)) 14:25:34 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:35 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) 14:25:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf0") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100), 0x0, 0x6) 14:25:35 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(0x0) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:35 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:35 executing program 1: r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000001031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) [ 115.360441] audit: type=1400 audit(1568989535.572:17): avc: denied { create } for pid=3476 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 115.361879] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. 14:25:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf0") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:35 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) [ 115.400321] audit: type=1400 audit(1568989535.582:18): avc: denied { write } for pid=3476 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 14:25:35 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x0, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:35 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") r1 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r1, 0x107, 0xe, &(0x7f00000001c0), &(0x7f0000000180)=0x3e9) 14:25:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100), 0x0, 0x6) [ 115.552166] audit: type=1400 audit(1568989535.772:19): avc: denied { syslog } for pid=3498 comm="syz-executor.0" capability=34 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 14:25:36 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) 14:25:36 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x0, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:36 executing program 1: sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="0209000002000000025e490000fd656e6d0030f1bbc6d1b2ab7bc533d5497aa1860f09edbf3ebdc35b9633fd98151ab7238281ecb9707dfb39ee9bc928a2defcd5a013f59c979d2fd32307a61d85b14b37a16d4a2f665bc970d5cb08f246a1b4074d34ef14b48c0936d75408eb9f8771b7385cc916c9903a49d1f3e841680ecfdcb648a3136e8325f06cd6e4ac0fcf3df5f7ee38496858536d3b78d8d0dd61ab02e88f79d3f0536f651585002000a54dd8a4"], 0x10}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) 14:25:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{}], 0x1, 0x6) 14:25:36 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(0x0) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x0, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:36 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:36 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:36 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0x10000007c) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 14:25:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, 0x0, 0x0) 14:25:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{}], 0x1, 0x6) 14:25:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10003, 0x0) 14:25:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, 0x0, 0x0) 14:25:37 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:37 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000180)=0x7fe, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup3(r2, r0, 0x0) 14:25:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{}], 0x1, 0x6) 14:25:37 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(0x0) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') 14:25:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, 0x0, 0x0) 14:25:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x4, 0x3}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:37 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x0) 14:25:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10003, 0x0) 14:25:37 executing program 4: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:37 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c9", 0x79}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:25:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x0) 14:25:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000054}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10003, 0x0) 14:25:37 executing program 2: pipe(0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10003, 0x0) 14:25:37 executing program 4: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7bf070") r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) poll(&(0x7f0000000100)=[{r1}], 0x1, 0x0) 14:25:37 executing program 1: r0 = socket$inet_tcp(0x2, 0x3, 0x6) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmmsg$inet(r0, &(0x7f0000007640)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2}}}], 0x20}}, {{&(0x7f0000000400), 0x10, 0x0, 0x0, &(0x7f00000034c0)=[@ip_retopts={{0x10}}, @ip_ttl={{0x14}}], 0x28}}], 0x2, 0x0) 14:25:37 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(0x0, &(0x7f0000000140)='./file0\x00') 14:25:37 executing program 2: pipe(0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10003, 0x0) 14:25:37 executing program 2: pipe(0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x10003, 0x0) 14:25:37 executing program 4: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={[{@shortname_win95='shortname=win95'}]}) 14:25:40 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfe47bf070") open(0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xe6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001a00)={'bridge_slave_1\x00', 0x0}) bind$packet(r1, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) sendmmsg(r1, &(0x7f0000008a80), 0x40002d1, 0x0) 14:25:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:40 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r0, 0x0) 14:25:40 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(0x0, &(0x7f0000000140)='./file0\x00') 14:25:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:40 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x15) sendmsg$nl_generic(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={0xe0, 0x10, 0x7, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}, [@nested={0xfffffffffffffead, 0x0, [@typed={0x0, 0x0, @pid}, @typed={0x0, 0x0, @pid}]}, @typed={0x8, 0x0, @pid}, @typed={0x8, 0x0, @u32}, @typed={0x8, 0x0, @str='\x00'}, @typed={0x0, 0x0, @u64}]}, 0xe0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x15) sendmsg$nl_generic(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={0x14, 0x0, 0x0, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}}, 0x14}}, 0x0) 14:25:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) [ 120.244505] FAT-fs (loop0): bogus number of reserved sectors [ 120.257794] FAT-fs (loop0): Can't find a valid FAT filesystem 14:25:40 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) [ 120.307850] FAT-fs (loop0): bogus number of reserved sectors [ 120.317457] audit: type=1400 audit(1568989540.532:20): avc: denied { create } for pid=3661 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 14:25:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) [ 120.353311] FAT-fs (loop0): Can't find a valid FAT filesystem 14:25:40 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398", 0xaf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:25:40 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:40 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x21, &(0x7f0000000040)="d1cfc01273a0d7a51a56ccc7944198ca73603d1a453ec0f7a1cd975a14eb6c8d", 0x20) 14:25:40 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a0010000a4}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:40 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(0x0, &(0x7f0000000140)='./file0\x00') 14:25:40 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:40 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000054}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:40 executing program 5: 14:25:40 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:43 executing program 0: 14:25:43 executing program 1: 14:25:43 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:43 executing program 5: 14:25:43 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:43 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', 0x0) 14:25:43 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="11dca50d5e0bcfe47bf070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x8, &(0x7f0000000040)=0xfffffffffffffffe, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x4e22}, 0x1c) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x456}, 0x8) close(r2) 14:25:43 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:43 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000280)='/dev/loop#\x00', 0x0, 0x0) memfd_create(0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x200, 0x2, 0x0, 0x10, "f50289bf065395cc7da45faa5b9ed02817cc8102b5c6e4f7ae9de09425bd0f514f56e9f2be7aa50c106b0989359fbf87237de0f337e0b6cf9fe4de3b0d2a98cd", "f655dbc9167a45114b81bd1d1269dd7497f39f9cab4a5521693cf249fe5364d7", [0x2, 0x1ff]}) 14:25:43 executing program 0: 14:25:43 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:43 executing program 0: 14:25:43 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:43 executing program 1: [ 123.596613] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. 14:25:43 executing program 1: 14:25:43 executing program 0: 14:25:43 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:44 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', 0x0) 14:25:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000ac9000)="290000002000190f00003fffffffda060200000500e80001040000040d000a00ea1100000005000000", 0x29}], 0x1) 14:25:44 executing program 1: 14:25:44 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='clear_refs\x00\xb0Ix\xe6\fK\xa3/\xd7\xb9IqK\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\x98\xfc\xbfX\x12\x97\xb3\x1b\xea\xea\xff\xb7gx\xa1\x96\xad\x93\xaa=-z\x06r\b\'') r2 = syz_open_procfs(0x0, &(0x7f0000000540)='loginuid\x009\xda\xd3\xc4D\xdeJ5\xf0\xfd\"=\xb6\xaa\x1e/\xddc\xc9\xf3_8\x9eFi\xe0\xafe\"\xc2%\xbb\xb6E\xae\x9e\x0fF\xc8|\xd4M\xb4\x91\x9c\x1a4\xab\x1d\x00\xbbAW\xf7\x9b#\x91.\x9b\x96Vn\xbf\x93\x89t\xf4\x8dB\fI\xe5\xb3\t\x00\x00\x00\x00\x00\x00\x00\x19/?G\xc7\xea\x9a+\x9c5\xbf%32\xe8\x83>\xfa\xb8L\xde\xc6<\x1fs\xe1\xdf\x14\xa2^\xd1\xd9U\xc0\x99$\x8a\'\fx\xa2\xb1\xc9/\xb4\xfdp4\xc3\"\xea\x95\xce\x10R\xa8p\xc6\xdf\xc8|x\x14\xb8\xa2\xbb\xcaG\xebL\x90\xf5P\xc5\x7f\xe2\x97\x1cr\x84\xc7\xba\x86\x96k1v\x17z{\x91+\xe5r0\x0ez4\x12E\xb2[\xb5\x94\x00\x05\x8b\x83Rl\xd1\xec\x89)Xdig\"2*^\xcd=\xdf\xda\x83%4\xe5_q A!I\xbb\x7f\x9c\x13\xff0G\xc9\x92A\xcf\x03\xaa\xc0G\xaerd\x11\xe6\x00\x00\x00\x00|;\xb1@2\xdbs\x8b4Pk\xc2Sl\xc1\x90\xd9\a2eL\xef\x8eGX\x8c\xbbA\xa6') sendfile(r1, r2, 0x0, 0x1) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f00000001c0)) 14:25:44 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, 0x0, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:44 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:44 executing program 3: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') link(&(0x7f00000000c0)='./file0\x00', 0x0) 14:25:44 executing program 1: [ 124.391185] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Dropping request. Check SNMP counters. 14:25:44 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:44 executing program 5: 14:25:44 executing program 1: 14:25:44 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, 0x0, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:44 executing program 5: 14:25:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) 14:25:44 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:44 executing program 1: r0 = creat(&(0x7f0000000500)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') close(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:25:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$netlink(0x10, 0x3, 0x4000000000000004) writev(r1, &(0x7f0000000040)=[{&(0x7f0000001880)="580000001400192340834b80040d8c5602067fffffff81000000000000dca870410cc00000cf64009400058915509da8000000006700008000f0fffeffff09000080fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) 14:25:44 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, 0x0, 0x0) 14:25:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, 0x0, 0x0) 14:25:45 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, 0x0, 0x0) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x507, 0x0, 0x0, {0x0, r2, {}, {0x0, 0x3}}, [@qdisc_kind_options=@q_htb={{0x8, 0x1, 'htb\x00'}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18}]}}]}, 0x48}}, 0x0) 14:25:45 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000000301ffff808fdb003d88c8f00010ae1b"], 0x14}}, 0x0) 14:25:45 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000100)=ANY=[@ANYBLOB="75626934f4"], &(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='ubifs\x00', 0x0, 0x0) 14:25:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, 0x0, 0x0) 14:25:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000100)=0x32, 0x4) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendfile(r2, r1, 0x0, 0x100045) 14:25:45 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x15) sendmsg$nl_generic(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={0xe0, 0x10, 0x7, 0x0, 0x0, {0x0, 0xf0ffff, 0x600}, [@nested={0xfffffffffffffead, 0x0, [@typed={0x0, 0x0, @pid}, @typed={0x0, 0x0, @pid}]}, @typed={0x8, 0x0, @pid}, @typed={0x8, 0x0, @u32}, @typed={0x8, 0x0, @str='\x00'}, @typed={0x0, 0x0, @u64}]}, 0xe0}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x15) sendmsg$nl_generic(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) 14:25:45 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180), 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:45 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo\x00') getdents(r0, &(0x7f0000000080)=""/178, 0xb2) 14:25:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:45 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:25:45 executing program 5: r0 = socket$inet_tcp(0x2, 0x3, 0x6) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmmsg$inet(r0, &(0x7f0000007640)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2}}}], 0x20}}, {{&(0x7f0000000400), 0x10, 0x0, 0x0, &(0x7f00000034c0)=[@ip_ttl={{0x14}}], 0x18}}], 0x2, 0x0) 14:25:45 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) preadv(r1, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/154, 0x9a}], 0x1, 0x0) 14:25:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:45 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180), 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:45 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x19, 0x4, 0x4, 0x4, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x3c) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x6, 0x7, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000851000000300000018100000", @ANYRES32=r1, @ANYBLOB="000000000000000095001921000000009500000000000000"], &(0x7f0000f6bffb)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) close(r2) 14:25:45 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000100)) 14:25:45 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfe47bf070") r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syncfs(r1) 14:25:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:45 executing program 5: preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1000000000000304, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x11) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 14:25:45 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:25:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="08dca50d5e0bcfe47bf070") r1 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r1, 0x107, 0x9, &(0x7f0000000100), &(0x7f0000000140)=0x4) 14:25:45 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180), 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:45 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) 14:25:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 14:25:45 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) [ 125.421888] binder: 3943:3946 Release 1 refcount change on invalid ref 1 ret -22 [ 125.442437] binder: undelivered death notification, 0000000000000000 14:25:45 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 125.521544] binder: 3956:3958 Release 1 refcount change on invalid ref 1 ret -22 [ 125.539961] binder: undelivered death notification, 0000000000000000 [ 125.570992] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 125.592408] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 125.625340] binder: 3975:3977 Release 1 refcount change on invalid ref 1 ret -22 [ 125.638174] binder: undelivered death notification, 0000000000000000 14:25:48 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:25:48 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x3, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:48 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) 14:25:48 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:48 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r2 = dup2(r1, r1) r3 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r3, 0x40044591, 0x0) r4 = dup(r3) ioctl$sock_TIOCOUTQ(r4, 0x5411, 0x0) bind(r4, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000100), 0x4) r5 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r5, 0x40044591, 0x0) r6 = dup(r5) ioctl$sock_TIOCOUTQ(r6, 0x5411, 0x0) ioctl$FIGETBSZ(r6, 0x2, &(0x7f0000000040)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x0, 0x0, 0x0, "c2cefbe3d7c33f7a2f8a5f65913bc96dc2f957e5dc70e5acb6bcb606d58efbbe786cb4b2112bfe086708142f7834bfa6a9d6d23325cbb888f62bb2cd8f1bec6ee1b2e04a25d6b7db1eeedba9abda1a3f"}, 0xd8) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) ioctl$TCXONC(r0, 0x540a, 0x0) 14:25:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:48 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x3, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:48 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x3, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 128.338935] binder: 3981:3991 Release 1 refcount change on invalid ref 1 ret -22 [ 128.377987] binder: undelivered death notification, 0000000000000000 14:25:48 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) 14:25:48 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:48 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) [ 128.460787] binder: 4003:4011 Release 1 refcount change on invalid ref 1 ret -22 [ 128.474547] binder: undelivered death notification, 0000000000000000 14:25:51 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:25:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:51 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:51 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:51 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) listen(0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) 14:25:51 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r2 = dup2(r1, r1) r3 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r3, 0x40044591, 0x0) r4 = dup(r3) ioctl$sock_TIOCOUTQ(r4, 0x5411, 0x0) bind(r4, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000100), 0x4) r5 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r5, 0x40044591, 0x0) r6 = dup(r5) ioctl$sock_TIOCOUTQ(r6, 0x5411, 0x0) ioctl$FIGETBSZ(r6, 0x2, &(0x7f0000000040)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x0, 0x0, 0x0, "c2cefbe3d7c33f7a2f8a5f65913bc96dc2f957e5dc70e5acb6bcb606d58efbbe786cb4b2112bfe086708142f7834bfa6a9d6d23325cbb888f62bb2cd8f1bec6ee1b2e04a25d6b7db1eeedba9abda1a3f"}, 0xd8) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) ioctl$TCXONC(r0, 0x540a, 0x0) 14:25:51 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) [ 131.374711] binder: 4020:4029 Release 1 refcount change on invalid ref 1 ret -22 14:25:51 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:51 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) listen(0xffffffffffffffff, 0x0) [ 131.424119] binder: undelivered death notification, 0000000000000000 14:25:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:51 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, 0x0, 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:51 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, 0x0, 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 131.522082] binder: 4047:4049 Release 1 refcount change on invalid ref 1 ret -22 [ 131.550985] binder: undelivered death notification, 0000000000000000 14:25:54 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$cont(0x7, r0, 0x0, 0x0) 14:25:54 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) 14:25:54 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:54 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, 0x0, 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:54 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r2 = dup2(r1, r1) r3 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r3, 0x40044591, 0x0) r4 = dup(r3) ioctl$sock_TIOCOUTQ(r4, 0x5411, 0x0) bind(r4, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000100), 0x4) r5 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r5, 0x40044591, 0x0) r6 = dup(r5) ioctl$sock_TIOCOUTQ(r6, 0x5411, 0x0) ioctl$FIGETBSZ(r6, 0x2, &(0x7f0000000040)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x0, 0x0, 0x0, "c2cefbe3d7c33f7a2f8a5f65913bc96dc2f957e5dc70e5acb6bcb606d58efbbe786cb4b2112bfe086708142f7834bfa6a9d6d23325cbb888f62bb2cd8f1bec6ee1b2e04a25d6b7db1eeedba9abda1a3f"}, 0xd8) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) ioctl$TCXONC(r0, 0x540a, 0x0) 14:25:54 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 134.399831] binder: 4061:4065 Release 1 refcount change on invalid ref 1 ret -22 [ 134.424603] binder: undelivered death notification, 0000000000000000 14:25:54 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:54 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) [ 134.477243] binder: 4079:4080 Release 1 refcount change on invalid ref 1 ret -22 [ 134.488530] binder: undelivered death notification, 0000000000000000 14:25:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:54 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) [ 134.579720] binder: 4087:4092 Release 1 refcount change on invalid ref 1 ret -22 [ 134.604253] binder: undelivered death notification, 0000000000000000 14:25:57 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$cont(0x7, r0, 0x0, 0x0) 14:25:57 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:25:57 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) 14:25:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:57 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:25:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r2 = dup2(r1, r1) r3 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r3, 0x40044591, 0x0) r4 = dup(r3) ioctl$sock_TIOCOUTQ(r4, 0x5411, 0x0) bind(r4, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000100), 0x4) r5 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r5, 0x40044591, 0x0) r6 = dup(r5) ioctl$sock_TIOCOUTQ(r6, 0x5411, 0x0) ioctl$FIGETBSZ(r6, 0x2, &(0x7f0000000040)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x0, 0x0, 0x0, "c2cefbe3d7c33f7a2f8a5f65913bc96dc2f957e5dc70e5acb6bcb606d58efbbe786cb4b2112bfe086708142f7834bfa6a9d6d23325cbb888f62bb2cd8f1bec6ee1b2e04a25d6b7db1eeedba9abda1a3f"}, 0xd8) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) ioctl$TCXONC(r0, 0x540a, 0x0) 14:25:57 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:25:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:57 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 137.440488] binder: 4103:4106 Release 1 refcount change on invalid ref 1 ret -22 [ 137.456304] binder: undelivered death notification, 0000000000000000 14:25:57 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) 14:25:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:25:57 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 137.500670] binder: 4118:4121 Release 1 refcount change on invalid ref 1 ret -22 [ 137.523908] binder: undelivered death notification, 0000000000000000 [ 137.593570] binder: 4131:4132 Release 1 refcount change on invalid ref 1 ret -22 14:26:00 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) 14:26:00 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r2 = dup2(r1, r1) r3 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r3, 0x40044591, 0x0) r4 = dup(r3) ioctl$sock_TIOCOUTQ(r4, 0x5411, 0x0) bind(r4, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000100), 0x4) r5 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r5, 0x40044591, 0x0) r6 = dup(r5) ioctl$sock_TIOCOUTQ(r6, 0x5411, 0x0) ioctl$FIGETBSZ(r6, 0x2, &(0x7f0000000040)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r1, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x0, 0x0, 0x0, "c2cefbe3d7c33f7a2f8a5f65913bc96dc2f957e5dc70e5acb6bcb606d58efbbe786cb4b2112bfe086708142f7834bfa6a9d6d23325cbb888f62bb2cd8f1bec6ee1b2e04a25d6b7db1eeedba9abda1a3f"}, 0xd8) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) 14:26:00 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:26:00 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:00 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:00 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:26:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 140.461483] binder: 4139:4146 Release 1 refcount change on invalid ref 1 ret -22 14:26:00 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x70) 14:26:00 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) socket$inet6_tcp(0xa, 0x1, 0x0) 14:26:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 140.534317] binder: 4157:4159 Release 1 refcount change on invalid ref 1 ret -22 14:26:00 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0}, 0x70) 14:26:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 140.606726] binder: 4164:4167 Release 1 refcount change on invalid ref 1 ret -22 [ 140.674404] binder: 4172:4175 Release 1 refcount change on invalid ref 1 ret -22 14:26:03 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0}, 0x70) 14:26:03 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) listen(r0, 0xffffffffffffff7c) 14:26:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:03 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:03 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) r4 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, 0x0) r5 = dup(r4) ioctl$sock_TIOCOUTQ(r5, 0x5411, 0x0) ioctl$FIGETBSZ(r5, 0x2, &(0x7f0000000040)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}}, 0x0, 0x0, 0x0, "c2cefbe3d7c33f7a2f8a5f65913bc96dc2f957e5dc70e5acb6bcb606d58efbbe786cb4b2112bfe086708142f7834bfa6a9d6d23325cbb888f62bb2cd8f1bec6ee1b2e04a25d6b7db1eeedba9abda1a3f"}, 0xd8) 14:26:03 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0}, 0x70) 14:26:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:03 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x3bb7) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280)={0x7}, 0xfffffffffffffe93) syncfs(r0) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000100)={0x0, r4}) [ 143.509818] binder: 4183:4191 Release 1 refcount change on invalid ref 1 ret -22 14:26:03 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) 14:26:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:03 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) r4 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, 0x0) r5 = dup(r4) ioctl$sock_TIOCOUTQ(r5, 0x5411, 0x0) ioctl$FIGETBSZ(r5, 0x2, &(0x7f0000000040)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, 0x0, 0x0) [ 143.564463] binder: 4200:4201 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 143.572614] binder: 4200:4201 Release 1 refcount change on invalid ref 1 ret -22 [ 143.581642] binder: undelivered death notification, 0000000000000000 [ 143.632158] binder: 4205:4209 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 143.643703] binder: 4205:4209 Release 1 refcount change on invalid ref 1 ret -22 [ 143.661021] binder: undelivered death notification, 0000000000000000 14:26:06 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:06 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) listen(r0, 0xffffffffffffff7c) 14:26:06 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x3bb7) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280)={0x7}, 0xfffffffffffffe93) syncfs(r0) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000100)={0x0, r4}) 14:26:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:06 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) r4 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, 0x0) r5 = dup(r4) ioctl$sock_TIOCOUTQ(r5, 0x5411, 0x0) ioctl$FIGETBSZ(r5, 0x2, &(0x7f0000000040)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 14:26:06 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:06 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) listen(r0, 0xffffffffffffff7c) 14:26:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 146.523309] binder: 4224:4228 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 146.531647] binder: 4224:4228 Release 1 refcount change on invalid ref 1 ret -22 [ 146.542416] binder: undelivered death notification, 0000000000000000 14:26:06 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) listen(r0, 0xffffffffffffff7c) 14:26:06 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) r4 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, 0x0) r5 = dup(r4) ioctl$sock_TIOCOUTQ(r5, 0x5411, 0x0) ioctl$FIGETBSZ(r5, 0x2, &(0x7f0000000040)) 14:26:06 executing program 5: bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0xffffffffffffff7c) 14:26:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x18, 0x33, 0x119, 0x0, 0x0, {0x2}, [@generic="ff"]}, 0x18}}, 0x0) [ 146.631801] binder: 4235:4247 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 146.649744] binder: 4235:4247 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 146.669395] binder: 4235:4247 Release 1 refcount change on invalid ref 1 ret -22 14:26:09 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:09 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x30, 0x24, 0x507, 0x0, 0x0, {0x0, r2, {0x0, 0x3}, {0x0, 0x3}}, [@qdisc_kind_options=@q_htb={{0x8, 0x1, 'htb\x00'}, {0x4}}]}, 0x30}}, 0x0) 14:26:09 executing program 5: bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0xffffffffffffff7c) 14:26:09 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:09 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) r4 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, 0x0) r5 = dup(r4) ioctl$sock_TIOCOUTQ(r5, 0x5411, 0x0) 14:26:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:09 executing program 5: bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0xffffffffffffff7c) 14:26:09 executing program 5: r0 = socket$unix(0x1, 0x0, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) 14:26:09 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000200)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = inotify_init() ioctl$TIOCGPTLCK(r0, 0x80045439, 0x0) 14:26:09 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) r4 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, 0x0) dup(r4) 14:26:09 executing program 5: r0 = socket$unix(0x1, 0x0, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) [ 149.613028] binder: 4265:4285 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 149.630790] binder: 4265:4285 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 149.643748] binder: 4265:4285 Release 1 refcount change on invalid ref 1 ret -22 14:26:09 executing program 5: r0 = socket$unix(0x1, 0x0, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) 14:26:12 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:12 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') getdents(r0, &(0x7f0000000080)=""/178, 0xb2) 14:26:12 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) 14:26:12 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) r4 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r4, 0x40044591, 0x0) 14:26:12 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x0, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:12 executing program 4: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='bridge_slave_1\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x18004e20, @multicast1}, 0x10) 14:26:12 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) 14:26:12 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/sockstat\x00`\x86\xf7\x01\x13k\xe6\x9f\x10\xab\x96\xb6V\xffK\x05p\xa4\xd4\x1d\n\xd0\x81\xae\xd2\xd4\xf5n~\xa0\xe8\xf9\xf0\xfe\x025~\x8e\x86\xe4\xa4\x8e\x86\xd3\x95E\xa2\t\x17\n#\xe2W\xa5C\x00E#\xce}7\xf3@5\x1eE\x06)\xb2\x8f\xce\xed\x11\xd0\xa1u\x9d\xc5\xae\xba4\x97\xfew\xe2\xb5\x1e\x88:\xfc+\xc4\x1b}\xb57\xe8\xe4\xb4\x16\xce\x11\xc6\xc5\x98\xbeh?\n\x1e/\xe8Q\xc6;\xd3Oy\r\x9d#}\x13\x0fmE\x1dZ n\x86\xd9\x97\xf7\x95[^\x036h\xf3 V\xaes\xd8n\xfc\xc0\x00\x93\x88q\x9b\xd4\xff\x96\xd5\t') lseek(r0, 0x800004, 0x0) 14:26:12 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) 14:26:12 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, 0x0, 0x0) listen(r0, 0xffffffffffffff7c) 14:26:12 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) [ 152.624829] binder: 4310:4327 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 152.640614] binder: 4310:4327 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 152.653342] binder: 4310:4327 Release 1 refcount change on invalid ref 1 ret -22 14:26:15 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:15 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000080)=0x8000) 14:26:15 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, 0x0, 0x0) listen(r0, 0xffffffffffffff7c) 14:26:15 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = dup2(r0, r0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, 0x0) r3 = dup(r2) ioctl$sock_TIOCOUTQ(r3, 0x5411, 0x0) bind(r3, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000100), 0x4) 14:26:15 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x0, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:15 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, 0x0, 0x0) listen(r0, 0xffffffffffffff7c) 14:26:15 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) 14:26:15 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) 14:26:15 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x80201000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)="2400000020007be11dfffd946f6105de800000031f00000000000800080018000400ff7e280000001100ffffba16a0aa1c0900589d7e80927d060e1b9ba8550e000000000020000000000000", 0x4c}], 0x1}, 0x0) 14:26:15 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) bind(r2, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000002c0), 0xfd65) 14:26:15 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xffffffffffffff7c) [ 155.671306] binder: 4347:4366 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 155.702741] binder: 4347:4366 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 155.726277] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 155.739730] binder: 4347:4366 Release 1 refcount change on invalid ref 1 ret -22 14:26:18 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:26:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:18 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0xffffffffffffff7c) 14:26:18 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:18 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) bind(r2, &(0x7f0000000140)=@generic={0x9, "533f0cdd092c307a54b3ede0e0958d2add41058a18c3af0135c4058060afef0cf3db31c9a6179f82f7bdf1f90057047c163a54f954a0db007e2006875208cd85f11197870fb5d2eb6fb6cbde49b9043068afed0565dc8e683a5202bb1497b29c752fd92bc0049b13a1aae3748d107d3e7098f140951eaab17587347754e4"}, 0x80) 14:26:18 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x0, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:18 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:18 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0xffffffffffffff7c) 14:26:18 executing program 4: write$9p(0xffffffffffffffff, &(0x7f0000000140)="0600000000000000c9b9000f05000000001ff7adf576f3790f68bc2c197cbf8d63735a09ab8383afd2de1a5587fe067f00002000249e1dabddb514480a169fc72518", 0x42) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xb, 0x81, 0x7, 0x5, 0x1}, 0x3c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000200)={r0, &(0x7f0000000180)}, 0x10) 14:26:18 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) 14:26:18 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:18 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0xffffffffffffff7c) 14:26:18 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:18 executing program 4: unshare(0x24020400) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) preadv(r1, &(0x7f00000009c0)=[{0x0}, {&(0x7f00000003c0)=""/68, 0x44}, {&(0x7f00000005c0)=""/214, 0xd6}, {&(0x7f00000006c0)=""/194, 0xc2}, {&(0x7f00000007c0)=""/146, 0x92}, {&(0x7f0000000880)=""/144, 0x90}, {&(0x7f0000000480)=""/13, 0xd}, {&(0x7f0000000940)=""/71, 0x47}], 0x8, 0x0) [ 158.718370] binder: 4385:4405 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 158.739346] binder: 4385:4405 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 158.754814] binder: 4385:4405 Release 1 refcount change on invalid ref 1 ret -22 14:26:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:19 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x0) 14:26:19 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:19 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:19 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) 14:26:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, "f0f3c23db58cbd48", "4a80970c81539622b93494f5266177be2f653d878723c5509f129ac6b5d7f2a9", "43d5f174", "ef770a7deeb0ad10"}, 0x38) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="11dca50d5e0bcfe47bf070") sendto$inet6(r0, &(0x7f00000005c0), 0xfffffffffffffee0, 0x0, 0x0, 0xb6) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0xffcd) recvmmsg(r0, &(0x7f0000004ac0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000002d00)=[{0x0}], 0x1}}], 0x2, 0x40010002, 0x0) 14:26:19 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x0) 14:26:19 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x4c, 0x24, 0x507, 0x0, 0x0, {0x0, r2, {0x0, 0x3}, {0x0, 0x3}}, [@qdisc_kind_options=@q_netem={{0xc, 0x1, 'netem\x00'}, {0x1c}}]}, 0x4c}}, 0x0) 14:26:19 executing program 5: r0 = socket$unix(0x1, 0x100000000000001, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x0) 14:26:19 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x92010201}, 0xc) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@loopback, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x80000002}, {}, {}, 0x0, 0x0, 0x400000000001}, {{@in6=@empty, 0x0, 0x33}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0xfffffffffffffffc}}, 0xe8) connect$inet6(r0, &(0x7f0000000080), 0x1c) 14:26:19 executing program 4: 14:26:19 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) [ 159.531921] binder: 4436:4454 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 159.539827] binder: 4436:4454 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 159.567184] binder: 4436:4454 Release 1 refcount change on invalid ref 1 ret -22 14:26:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:20 executing program 4: [ 160.305631] binder: 4478:4479 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 160.363507] binder: 4478:4481 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 160.371351] binder: 4478:4481 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 160.378716] binder: 4478:4481 Release 1 refcount change on invalid ref 1 ret -22 14:26:22 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) 14:26:22 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:22 executing program 5: 14:26:22 executing program 4: 14:26:22 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:22 executing program 5: 14:26:22 executing program 4: 14:26:22 executing program 5: r0 = socket(0x11, 0x800000003, 0x8) setsockopt$packet_buf(r0, 0x107, 0x10000000000000f, &(0x7f0000000100)="a2e6fa9a", 0x4) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00000000920000000000000000000000000010000000000008000000000000000529000000000000000002000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000202ca0adf90599ad0400f5ff0000000000"], 0x68) 14:26:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000180)={'veth1_to_team\x00', {0x2, 0x0, @empty}}) [ 162.497726] binder: 4489:4495 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:26:22 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) 14:26:22 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) fstat(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(0x0, r1) setfsgid(r1) 14:26:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="106308400000000008000000"], 0x0, 0x0, 0x0}) [ 162.562750] binder: 4489:4507 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 162.578150] binder: 4489:4507 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 162.589018] binder: 4489:4507 Release 1 refcount change on invalid ref 1 ret -22 [ 162.663382] binder: 4517:4519 BC_DEAD_BINDER_DONE 0000000800000000 not found 14:26:25 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:25 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) 14:26:25 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:25 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:25 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCETHTOOL(r0, 0x8917, &(0x7f0000000000)={'syz_tun\x00', 0x0}) 14:26:25 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 165.498137] binder: 4526:4532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 165.516455] binder: 4528:4536 transaction failed 29189/-22, size 0-0 line 3128 [ 165.526022] binder: 4528:4536 transaction failed 29189/-22, size 0-0 line 3128 [ 165.534414] binder: undelivered TRANSACTION_ERROR: 29189 14:26:25 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:25 executing program 4: 14:26:25 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) 14:26:25 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 165.555215] binder: 4543:4544 transaction failed 29189/-22, size 0-0 line 3128 [ 165.563568] binder: 4526:4545 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 165.571500] binder: 4526:4545 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 165.579326] binder: 4526:4545 Release 1 refcount change on invalid ref 1 ret -22 [ 165.585973] binder: 4546:4547 transaction failed 29189/-22, size 0-0 line 3128 14:26:25 executing program 4: [ 165.652430] binder: 4552:4556 transaction failed 29189/-22, size 0-0 line 3128 14:26:28 executing program 4: 14:26:28 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:28 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, 0x0) r1 = dup(0xffffffffffffffff) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:28 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:28 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r1, 0x0, 0x10003, 0x0) 14:26:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:28 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1405bb000000000000000000000000030005000000000002000000e00000010000000000000000b0cb26c0814c269aaf5972e92605d01ce868d412a70a486bf332359c253d46b9e9a11dc573acd16014003949732691062868e3c3696ce69e5d183fdd32d10fba6a468d49ef36deff6535934bd9d2754ea44a05000000e1ba5e002b158eee6b7349411bcd6e6bf05ff5a5270f3a912deb94806631ad7455094542c131e8db1ef2a9b14b1039da62d5cde0a62fb01be22f4e1a77e643d863b7301032128c5b5742e1bb7ffb2e9c4846d875f5f1e11b4a9fe656a073214f18080d81de63af14a85d5b5a67c79ec34e2695b722ae966523928d166600c90e67b44e7d2b93e65457bf89b22ff618ed0accd4520c17fb0b2a32269f0a7f68ed28b0840c4e12fdfa641544d3c17306569a3a7c99e6f8f3"], 0x80}}, 0x0) 14:26:28 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:28 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:28 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, 0x0) r1 = dup(0xffffffffffffffff) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:28 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:28 executing program 4: io_setup(0x7, &(0x7f0000000040)) io_setup(0x9, &(0x7f00000000c0)=0x0) io_destroy(r0) io_submit(r0, 0x0, 0x0) [ 168.681122] binder: 4598:4600 transaction failed 29189/-22, size 0-0 line 3128 [ 168.689071] binder: 4596:4599 Acquire 1 refcount change on invalid ref 0 ret -22 [ 168.717047] binder: 4596:4599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 168.779401] binder: 4596:4606 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 168.787758] binder: 4596:4606 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 168.795737] binder: 4596:4606 Release 1 refcount change on invalid ref 1 ret -22 14:26:31 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:31 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:31 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) dup2(r0, r0) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, 0x0) r1 = dup(0xffffffffffffffff) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") socket$inet_udplite(0x2, 0x2, 0x88) memfd_create(&(0x7f0000000380)='iC;`\xb6p+\x10', 0x0) 14:26:31 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r1, 0x0, 0x10003, 0x0) 14:26:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:31 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:31 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:31 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) [ 171.586493] binder: 4615:4622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 171.598610] binder: 4615:4622 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:26:31 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:31 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 171.669591] binder: 4615:4635 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 171.688020] binder: 4615:4635 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 171.705808] binder: 4615:4635 Release 1 refcount change on invalid ref 1 ret -22 14:26:31 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:32 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) clone(0x1fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) 14:26:32 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:32 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) 14:26:32 executing program 5: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 171.812128] syz-executor.4 (4617) used greatest stack depth: 24040 bytes left 14:26:32 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r2, 0x37) sendto$inet6(r1, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB], 0x1}}, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) dup2(r2, r3) 14:26:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:32 executing program 5: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 172.431543] binder: 4667:4670 Acquire 1 refcount change on invalid ref 0 ret -22 [ 172.451073] binder: 4667:4670 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 172.504777] binder: 4667:4673 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 172.512515] binder: 4667:4673 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 172.519941] binder: 4667:4673 Release 1 refcount change on invalid ref 1 ret -22 14:26:34 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:34 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r1, 0x0, 0x10003, 0x0) 14:26:34 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000280)=0x100000001, 0x4) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r1, 0x40044591, 0x0) r2 = dup(r1) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) 14:26:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x80201000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)="240000001c007be11dfffd946f6105de800000031f00000000000800080011000400ff7e280000001100ffffba16a0aa1c0900589d7e80927d060e1b9ba8550e000000000020000000000000", 0x4c}], 0x1}, 0x0) 14:26:34 executing program 5: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:34 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:34 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:34 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:34 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 174.676209] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 14:26:34 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xc, 0x0, &(0x7f0000000300)=[@dead_binder_done], 0x0, 0x0, 0x0}) 14:26:34 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:34 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:35 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:35 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:35 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(0x0, 0x39) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 14:26:35 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x2719, &(0x7f0000af0fe7)=""/13, &(0x7f000033bffc)=0x7ffff000) 14:26:35 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:35 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(0x0, 0x39) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 14:26:35 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:35 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:35 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(0x0, 0x39) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 175.530705] hrtimer: interrupt took 37898 ns 14:26:35 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:35 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 175.558679] binder: 4732:4734 ioctl c0306201 0 returned -14 14:26:36 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:36 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:36 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:36 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:36 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:36 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:36 executing program 3: r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:36 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu\x00E\xab\xcbw\x83.\xf3\x8a\xf6\xb3\xac\xfe\x9ek9\xcd\"\x84\x18/~[{\xfb\xc2\t}\xaaCSM^Z\x98\x0eZ\xfca5b\xd6\x92\a\xd6*\xd8v\xd0\xb1\x00=k|\xf1P\xbf\x17\x1b\x8f\xd6LT`V\\\xaeuJ[:\xcd<\xa1L\xec\x9fU\xe9\x14_g=\xfc\x7f\xbd-\xb2\xfa\xee\xe3\a~\x90\xd4\x90\a\x83\x81\xac\x1bWE_\x05;\xefk\x1e\xed:\x90\xc1\xba\x96\xde\xfac\xf0\'&:dn`\xe8\xa6-\x1dh\xb07#T\xa6\xa3\x9c\x91_jM@\x06\x8c\xf5\xbb\x81G\xb9\xa9\x8b\xf3\x8f\xa2\xee', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='cpuset.memory_spread_page\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000080)=0x4, 0x12) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = getpid() perf_event_open(&(0x7f0000000600)={0x0, 0x70, 0xffff, 0x0, 0x8, 0x0, 0x0, 0x7, 0x2000, 0x8, 0x0, 0x0, 0x0, 0x4, 0x1, 0xfffffffffffffc00, 0x0, 0x5, 0x7f, 0x0, 0x40, 0x7, 0x0, 0x0, 0x8000000009, 0x1000, 0x9, 0x4, 0x6, 0x0, 0x0, 0x0, 0x1, 0x40, 0x4, 0xffffffff9d6b1e95, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, @perf_bp={&(0x7f0000000340)}, 0x1524, 0x9, 0x0, 0x0, 0x4}, r2, 0x0, 0xffffffffffffffff, 0x1) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$cgroup_int(r1, &(0x7f00000000c0), 0x12) 14:26:36 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:36 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 176.394272] binder: 4770:4774 ioctl c0306201 0 returned -14 [ 176.397685] binder: 4773:4776 Acquire 1 refcount change on invalid ref 0 ret -22 [ 176.412105] binder: 4773:4776 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:26:36 executing program 4: syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='umask=0']) 14:26:36 executing program 0: r0 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) [ 176.470301] binder: 4773:4788 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 176.490814] binder: 4773:4788 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 176.502208] binder: 4773:4788 Release 1 refcount change on invalid ref 1 ret -22 [ 176.506738] FAT-fs (loop4): bogus number of reserved sectors 14:26:36 executing program 0: r0 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:36 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 176.519490] FAT-fs (loop4): Can't find a valid FAT filesystem [ 176.587697] FAT-fs (loop4): bogus number of reserved sectors [ 176.594052] FAT-fs (loop4): Can't find a valid FAT filesystem 14:26:37 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x10003, 0x0) 14:26:37 executing program 0: r0 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:37 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:37 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:37 executing program 4: r0 = socket$inet6(0xa, 0x801, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @random, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @empty, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 14:26:37 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) [ 177.194335] binder: 4818:4819 ioctl c0306201 0 returned -14 [ 177.221524] TCP: request_sock_TCPv6: Possible SYN flooding on port 20000. Dropping request. Check SNMP counters. [ 177.233846] binder: 4826:4829 Acquire 1 refcount change on invalid ref 0 ret -22 14:26:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 14:26:37 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:37 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) [ 177.242481] binder: 4826:4829 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 177.274617] binder: undelivered death notification, 0000000000000000 14:26:37 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:37 executing program 4: memfd_create(0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'bridge0\x00h\x00\x01\xd8\x00H\x00'}) [ 177.297489] binder: 4826:4841 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 177.307084] binder: 4826:4841 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 177.323628] binder: 4826:4841 Release 1 refcount change on invalid ref 1 ret -22 14:26:38 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:38 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10003, 0x0) 14:26:38 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:38 executing program 4: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x2719, &(0x7f0000af0fe7)=""/13, &(0x7f000033bffc)=0x7ffff000) r1 = socket(0x15, 0x80005, 0x0) getsockopt(r1, 0x114, 0x2719, &(0x7f0000af0fe7)=""/13, &(0x7f000033bffc)=0x7ffff000) 14:26:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:38 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, 0x0) r1 = dup(r0) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:38 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:38 executing program 4: 14:26:38 executing program 4: 14:26:38 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(0xffffffffffffffff) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) 14:26:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 178.056881] binder: 4877:4880 Acquire 1 refcount change on invalid ref 0 ret -22 [ 178.069899] binder: 4877:4880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:26:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:38 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(0xffffffffffffffff) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) [ 178.123348] binder: 4877:4892 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 178.131323] binder: 4877:4892 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 178.145182] binder: 4877:4892 Release 1 refcount change on invalid ref 1 ret -22 14:26:39 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10003, 0x0) 14:26:39 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:39 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) r1 = dup(0xffffffffffffffff) ioctl$sock_TIOCOUTQ(r1, 0x5411, 0x0) [ 178.870929] binder: 4912:4915 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 178.924356] binder: 4912:4917 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 178.932587] binder: 4912:4917 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 178.939911] binder: 4912:4917 Release 1 refcount change on invalid ref 1 ret -22 14:26:41 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) dup(r0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) 14:26:41 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:41 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10003, 0x0) 14:26:41 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:41 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) dup(r0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) [ 181.052090] binder: 4925:4928 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:26:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:41 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0) dup(r0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) [ 181.117284] binder: 4925:4943 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 181.135665] binder: 4925:4943 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 181.149481] binder: 4925:4943 Release 1 refcount change on invalid ref 1 ret -22 14:26:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:44 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:44 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCETHTOOL(r0, 0x8947, &(0x7f0000000000)={'syz_tun\x00', 0x0}) 14:26:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:44 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) 14:26:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:44 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:44 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 184.100717] binder: 4965:4972 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:26:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:44 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0x10000007c) ioctl$EVIOCGSND(r0, 0x8040451a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 14:26:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 184.159268] binder: 4965:4987 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 184.167294] binder: 4965:4987 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 184.179701] binder: 4965:4987 Release 1 refcount change on invalid ref 1 ret -22 14:26:44 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:44 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:45 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) 14:26:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:45 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:45 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5, 0x3, 0xa}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) [ 184.946338] binder: 5016:5020 ioctl c0306201 0 returned -14 [ 184.980452] binder: 5016:5020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 185.039614] binder: 5016:5024 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 185.047755] binder: 5016:5024 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 185.055391] binder: 5016:5024 Release 1 refcount change on invalid ref 1 ret -22 14:26:47 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:47 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:47 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:47 executing program 0: 14:26:47 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) 14:26:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:47 executing program 0: 14:26:47 executing program 0: 14:26:47 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:47 executing program 0: [ 187.167812] binder: 5031:5036 ioctl c0306201 0 returned -14 [ 187.175979] binder: 5031:5036 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:26:47 executing program 0: 14:26:47 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 187.256031] binder: 5031:5051 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 187.273282] binder: 5031:5051 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 187.281395] binder: 5031:5051 Release 1 refcount change on invalid ref 1 ret -22 14:26:50 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:50 executing program 0: 14:26:50 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:50 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 14:26:50 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:50 executing program 0: unshare(0x28020400) r0 = socket(0x2, 0x3, 0x100000001) fchown(r0, 0x0, 0x0) 14:26:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 190.179246] binder: 5061:5067 ioctl c0306201 0 returned -14 [ 190.194524] binder: 5061:5067 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:26:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:50 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:50 executing program 0: perf_event_open(&(0x7f0000000340)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f00000000c0)='ppp1-posix_acl_access+\x00') [ 190.268869] binder: 5061:5085 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 190.284164] binder: 5061:5085 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 190.295405] binder: 5061:5085 Release 1 refcount change on invalid ref 1 ret -22 14:26:53 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10) 14:26:53 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 14:26:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:53 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:26:53 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) sendfile(r1, r0, 0x0, 0x100045) 14:26:53 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:53 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 193.199924] binder: 5099:5101 transaction failed 29189/-22, size 0-0 line 3128 [ 193.202141] binder: 5104:5107 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 193.212279] binder: undelivered TRANSACTION_ERROR: 29189 14:26:53 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(r0, 0x800004, 0x0) [ 193.265754] binder: 5118:5120 transaction failed 29189/-22, size 0-0 line 3128 [ 193.284160] binder: undelivered TRANSACTION_ERROR: 29189 [ 193.296192] binder: 5104:5124 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 193.308992] binder: 5104:5124 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:26:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:53 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 193.319641] binder: 5104:5124 Release 1 refcount change on invalid ref 1 ret -22 [ 193.353874] binder: 5131:5133 transaction failed 29189/-22, size 0-0 line 3128 [ 193.363583] binder: undelivered TRANSACTION_ERROR: 29189 14:26:56 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(r0, 0x800004, 0x0) 14:26:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:56 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 14:26:56 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:56 executing program 2: pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0xdf1, 0x21fc}, 0x14) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 14:26:56 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(r0, 0x800004, 0x0) 14:26:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:56 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 196.232208] binder: 5142:5145 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 196.242239] binder: 5139:5147 transaction failed 29189/-22, size 0-0 line 3128 [ 196.255545] binder: 5139:5147 ioctl c0306201 0 returned -14 [ 196.266616] binder: undelivered TRANSACTION_ERROR: 29189 14:26:56 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(r0, 0x800004, 0x0) 14:26:56 executing program 0: lseek(0xffffffffffffffff, 0x800004, 0x0) 14:26:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:56 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 196.307774] binder: 5142:5161 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 196.319593] binder: 5142:5161 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 196.327280] binder: 5159:5162 transaction failed 29189/-22, size 0-0 line 3128 [ 196.331756] binder: 5142:5161 Release 1 refcount change on invalid ref 1 ret -22 [ 196.343068] binder: 5159:5162 ioctl c0306201 0 returned -14 [ 196.351155] binder: undelivered TRANSACTION_ERROR: 29189 [ 196.399469] binder: 5173:5175 transaction failed 29189/-22, size 0-0 line 3128 [ 196.408082] binder: 5173:5175 ioctl c0306201 0 returned -14 [ 196.419486] binder: undelivered TRANSACTION_ERROR: 29189 14:26:59 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:26:59 executing program 0: lseek(0xffffffffffffffff, 0x800004, 0x0) 14:26:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:59 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) 14:26:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:26:59 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x4}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:26:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:26:59 executing program 0: lseek(0xffffffffffffffff, 0x800004, 0x0) 14:26:59 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) pipe(0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x2af) sendto$inet(r1, 0x0, 0x0, 0x20000000, &(0x7f0000000340)={0x2, 0x4e20}, 0x10) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) socket(0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0xfffffffffffffe14) bpf$PROG_LOAD(0x5, 0x0, 0xffffffffffffff49) syz_genetlink_get_family_id$tipc(0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, 0x0, 0x0) getuid() setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getsockname$netlink(0xffffffffffffffff, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000100), 0x1063, 0x4008000, 0x0, 0xb4) close(r1) [ 199.265685] binder: 5183:5186 transaction failed 29189/-22, size 0-0 line 3128 [ 199.277864] binder: 5184:5192 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 199.299958] binder: undelivered TRANSACTION_ERROR: 29189 14:26:59 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) [ 199.331066] binder: 5184:5192 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 199.348757] binder: 5184:5192 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 199.370960] binder: 5184:5192 Release 1 refcount change on invalid ref 1 ret -22 14:26:59 executing program 0: r0 = syz_open_procfs(0x0, 0x0) lseek(r0, 0x800004, 0x0) 14:26:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 199.385744] binder: 5207:5209 transaction failed 29189/-22, size 0-0 line 3128 [ 199.421507] binder: undelivered TRANSACTION_ERROR: 29189 14:27:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:27:02 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:02 executing program 0: r0 = syz_open_procfs(0x0, 0x0) lseek(r0, 0x800004, 0x0) 14:27:02 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0xe, 0x0, &(0x7f0000000180)) 14:27:02 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) 14:27:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:02 executing program 0: r0 = syz_open_procfs(0x0, 0x0) lseek(r0, 0x800004, 0x0) 14:27:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 202.290956] audit: type=1400 audit(1568989622.502:21): avc: denied { call } for pid=5230 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 202.290980] binder_alloc: 5233: binder_alloc_buf, no vma [ 202.315649] binder: 5233:5235 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 202.329128] binder: 5230:5237 transaction failed 29189/-3, size 0-0 line 3274 14:27:02 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:27:02 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) 14:27:02 executing program 0: syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(0xffffffffffffffff, 0x800004, 0x0) [ 202.361930] binder: undelivered TRANSACTION_ERROR: 29189 [ 202.378201] binder: 5233:5248 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:27:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:27:02 executing program 0: syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(0xffffffffffffffff, 0x800004, 0x0) [ 202.424225] binder: 5233:5235 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 202.434934] binder: 5233:5235 Release 1 refcount change on invalid ref 1 ret -22 [ 202.455664] binder: 5257:5261 transaction failed 29189/-22, size 0-0 line 3128 14:27:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 14:27:02 executing program 0: syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(0xffffffffffffffff, 0x800004, 0x0) 14:27:02 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) [ 202.478336] binder: undelivered TRANSACTION_ERROR: 29189 14:27:02 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(r0, 0x0, 0x0) 14:27:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) [ 202.552865] binder: 5276:5279 transaction failed 29189/-22, size 0-0 line 3128 [ 202.579715] binder: 5275:5280 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 202.607065] binder: undelivered TRANSACTION_ERROR: 29189 [ 202.648042] binder: 5275:5292 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 202.656174] binder: 5275:5292 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 202.664967] binder: 5275:5292 Release 1 refcount change on invalid ref 1 ret -22 14:27:05 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(r0, 0x0, 0x0) 14:27:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:05 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCVHANGUP(r0, 0x5437, 0x300000000000000) 14:27:05 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:05 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) 14:27:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000200), 0x0) 14:27:05 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountstats\x00') lseek(r0, 0x0, 0x0) 14:27:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000200), 0x0) [ 205.406073] binder: 5296:5303 transaction failed 29189/-22, size 0-0 line 3128 [ 205.415666] binder: 5294:5302 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 205.424215] binder: undelivered TRANSACTION_ERROR: 29189 14:27:05 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x\x11k4\xd3\x1b\x05\xaf\xf0\x1eyRN\xc9\xc6V\x00\x02\x00\x00\x00\x00\x00\x00\x00', 0x275a, 0x0) lseek(r0, 0xfffffffffffffffe, 0x3) 14:27:05 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) 14:27:05 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5, 0x3, 0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:27:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000200), 0x0) [ 205.501885] binder: 5294:5322 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 205.519232] binder: 5320:5325 transaction failed 29189/-22, size 0-0 line 3128 [ 205.539666] binder: undelivered TRANSACTION_ERROR: 29189 [ 205.553673] binder: 5294:5322 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 205.579803] binder: 5294:5322 Release 1 refcount change on invalid ref 1 ret -22 14:27:08 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:08 executing program 2: 14:27:08 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) 14:27:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140), &(0x7f0000000200), 0x0) 14:27:08 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5, 0x3, 0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:27:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:08 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000400)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) 14:27:08 executing program 2: 14:27:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140), &(0x7f0000000200), 0x0) [ 208.426100] binder: 5336:5344 transaction failed 29189/-22, size 0-0 line 3128 [ 208.442830] binder: undelivered TRANSACTION_ERROR: 29189 14:27:08 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5, 0x3, 0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:27:08 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000030}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) [ 208.489838] binder: 5340:5355 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 208.511771] binder: 5340:5355 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:27:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140), &(0x7f0000000200), 0x0) [ 208.537043] binder_alloc: 5340: binder_alloc_buf, no vma [ 208.555121] binder: 5340:5355 Release 1 refcount change on invalid ref 1 ret -22 [ 208.565846] binder: 5354:5359 transaction failed 29189/-3, size 0-0 line 3274 [ 208.578763] binder: undelivered TRANSACTION_ERROR: 29189 14:27:11 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x3, 0x19) getsockopt$inet_int(r1, 0x0, 0x18, 0x0, &(0x7f0000000040)) 14:27:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x13, &(0x7f0000000240)={@multicast1, @local}, 0xc) 14:27:11 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) 14:27:11 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000030}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:27:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:11 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000024}, [@ldst={0x5}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:27:11 executing program 5: 14:27:11 executing program 2: 14:27:11 executing program 5: 14:27:11 executing program 2: 14:27:11 executing program 0: [ 211.505572] binder: 5378:5397 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 211.553000] binder: 5378:5397 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 211.569310] binder: 5378:5397 Release 1 refcount change on invalid ref 1 ret -22 14:27:14 executing program 2: 14:27:14 executing program 5: 14:27:14 executing program 0: 14:27:14 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) 14:27:14 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:14 executing program 2: 14:27:14 executing program 5: 14:27:14 executing program 0: 14:27:14 executing program 5: 14:27:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) 14:27:14 executing program 5: socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r4 = add_key$keyring(&(0x7f0000001000)='keyring\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, r3) r5 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000001000)='keyring\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, r5) keyctl$unlink(0x9, r4, r5) 14:27:14 executing program 0: clone(0x6203300, 0x0, &(0x7f0000002b40), 0x0, &(0x7f0000002bc0)="ce") [ 214.566910] binder: 5408:5426 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 214.592293] binder: 5408:5426 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:27:14 executing program 0: clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c256be74d2b81cbbeb2a49fd409b184f16d7807f6ba2972b31dd430", 0xe2}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 214.617006] binder: 5408:5426 Release 1 refcount change on invalid ref 1 ret -22 14:27:17 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[]}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002021f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) 14:27:17 executing program 0: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)="2400000018007be11dfffd946f6105de800000031f00000000000800080011000400ff7e", 0x24}], 0x1}, 0x0) 14:27:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) 14:27:17 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x2) socket$inet_udplite(0x2, 0x2, 0x88) pipe(&(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) 14:27:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) [ 217.541828] binder: 5451:5457 Acquire 1 refcount change on invalid ref 0 ret -22 [ 217.552145] binder: 5451:5457 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 217.567340] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 217.577809] binder: 5463:5464 Acquire 1 refcount change on invalid ref 0 ret -22 14:27:17 executing program 5: socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) keyctl$read(0xb, 0x0, 0x0, 0x0) 14:27:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") seccomp(0x0, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x100}]}) add_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f00000000c0), &(0x7f0000000100), 0xfffff, 0xfffffffffffffffb) 14:27:17 executing program 5: unshare(0x24020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$int_in(r0, 0x5421, &(0x7f0000000040)) [ 217.588146] binder: 5450:5465 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 217.599024] binder: 5450:5465 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 217.607470] binder: 5463:5464 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 217.608080] binder: 5451:5470 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 217.621836] binder: 5450:5465 Release 1 refcount change on invalid ref 1 ret -22 [ 217.670542] binder: 5463:5478 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:27:17 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x11) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 14:27:17 executing program 5: bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={0xffffffffffffffff, 0xe, 0x0, 0x0, 0x0}, 0x20) 14:27:20 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[]}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/fib_triestat\x00') lseek(r0, 0x800004, 0x0) 14:27:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:20 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010005fba000000816402deb83996176b", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) 14:27:20 executing program 4: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfe47bf070") ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) 14:27:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) 14:27:20 executing program 5: syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @random, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff88, 0x0, @empty, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 14:27:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x14, 0x23, 0x847, 0x0, 0x0, {0x2804}}, 0x14}}, 0x0) 14:27:20 executing program 2: unshare(0x28020400) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000500)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[&\xe5\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ}\xb7\xf3\xfe\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4', 0x2761, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000680), 0x24, 0x0) [ 220.567936] binder: 5499:5503 Acquire 1 refcount change on invalid ref 0 ret -22 [ 220.591624] binder: 5499:5503 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:27:20 executing program 4: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) unlink(&(0x7f0000000180)='./file0\x00') r1 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f00000001c0)={{0x0, @loopback, 0x0, 0x0, 'none\x00', 0x24, 0x4}, {@local, 0x0, 0x0, 0x2, 0x5}}, 0x44) lsetxattr$security_smack_transmute(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='security.SMACK64TRANSMUTE\x00', 0x0, 0x0, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='./file0\x00') close(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:27:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(r0, &(0x7f0000000000)='syz0\x00', 0x1ff) [ 220.629845] binder: 5495:5514 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 220.656809] binder: 5495:5514 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 220.665033] binder: 5495:5514 Release 1 refcount change on invalid ref 1 ret -22 14:27:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(r0, &(0x7f0000000000)='syz0\x00', 0x1ff) [ 220.677462] binder: 5499:5523 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:27:23 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000280)='cgroup.procs\x00\xcd\"\xb1\b\xc3\x94\xbaE~\x1b\x17\x9e\xd3\xcen-\x99U\a\x02w[\xa4=\x97\xd9W\xb3_\xa36|M\x9a.\xa9W\xd3\x97\x16\xe1Bg\a5k\xe0<\n\x857\x99\xdc(d\xd0\xac\x17\xce\x83\xf5\xady\x8b\xedc\xcd\xcd\xfd\xa5\x06\xf2', 0x2, 0x0) sendfile(r1, r1, &(0x7f0000000040)=0xffd, 0x10a000002) 14:27:23 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(r0, &(0x7f0000000000)='syz0\x00', 0x1ff) 14:27:23 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(r0, 0x800004, 0x0) 14:27:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) 14:27:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:23 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[]}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:23 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(r0, &(0x7f0000000000)='syz0\x00', 0x1ff) 14:27:23 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(r0, 0x800004, 0x0) 14:27:23 executing program 2: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000300)='./file0\x00', 0x200008, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$binfmt_elf64(r0, 0x0, 0x0) open(0x0, 0x0, 0x0) [ 223.598636] binder: 5544:5547 Acquire 1 refcount change on invalid ref 0 ret -22 [ 223.627802] binder: 5544:5547 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:27:23 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(r0, 0x800004, 0x0) 14:27:23 executing program 5: mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) [ 223.668466] binder: 5540:5561 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 223.687750] binder: 5544:5568 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 223.691836] binder: 5540:5561 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:27:23 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(r0, 0x800004, 0x0) 14:27:23 executing program 5: mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) 14:27:23 executing program 4: lseek(0xffffffffffffffff, 0x800004, 0x0) [ 223.725938] binder: 5540:5561 Release 1 refcount change on invalid ref 1 ret -22 14:27:26 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB]}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:26 executing program 5: mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) 14:27:26 executing program 4: lseek(0xffffffffffffffff, 0x800004, 0x0) 14:27:26 executing program 2: socketpair(0x1, 0x100000005, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000300)=0x14) socketpair(0x1, 0x100000005, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f0000000040)='lo:&\xb7`Q\xb1Y\xa9\xc8J,`\xd2\x98\x00\x00\x00 ') 14:27:26 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffffffffffffff}]}) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) faccessat(r0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) 14:27:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:26 executing program 4: lseek(0xffffffffffffffff, 0x800004, 0x0) 14:27:26 executing program 4: r0 = syz_open_procfs(0x0, 0x0) lseek(r0, 0x800004, 0x0) [ 226.641180] binder: 5592:5595 ioctl c0306201 0 returned -14 14:27:26 executing program 2: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000004c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KDGKBSENT(r0, 0x4b48, 0x0) 14:27:26 executing program 5: r0 = syz_open_procfs(0x0, 0x0) mkdirat$cgroup(r0, &(0x7f0000000000)='syz0\x00', 0x1ff) [ 226.674641] audit: type=1326 audit(1568989646.892:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=5597 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 [ 226.713678] binder: 5592:5611 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:27:26 executing program 4: r0 = syz_open_procfs(0x0, 0x0) lseek(r0, 0x800004, 0x0) 14:27:26 executing program 5: r0 = syz_open_procfs(0x0, 0x0) mkdirat$cgroup(r0, &(0x7f0000000000)='syz0\x00', 0x1ff) [ 226.747113] binder: 5592:5611 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 226.780213] binder: 5592:5611 Release 1 refcount change on invalid ref 1 ret -22 [ 227.468747] audit: type=1326 audit(1568989647.682:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=5597 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 14:27:29 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB]}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:29 executing program 4: r0 = syz_open_procfs(0x0, 0x0) lseek(r0, 0x800004, 0x0) 14:27:29 executing program 5: r0 = syz_open_procfs(0x0, 0x0) mkdirat$cgroup(r0, &(0x7f0000000000)='syz0\x00', 0x1ff) 14:27:29 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1a001000014}, [@ldst={0x5, 0x5, 0xa, 0x0, 0x1801}]}, &(0x7f0000000080)='GPL\x00', 0x4, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) 14:27:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:29 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000180)=0x7fe, 0x4) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000cd2ff0)={0x2, 0x4e21}, 0x10) recvmmsg(r0, &(0x7f0000003cc0), 0x400000000000355, 0x12001, 0x0) 14:27:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) 14:27:29 executing program 4: syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(0xffffffffffffffff, 0x800004, 0x0) 14:27:29 executing program 5: syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) 14:27:29 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'bridge_slave_0\x00'}) [ 229.677022] binder: 5639:5643 ioctl c0306201 0 returned -14 14:27:30 executing program 4: syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(0xffffffffffffffff, 0x800004, 0x0) 14:27:30 executing program 5: syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) [ 229.746009] binder: 5639:5658 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 229.804939] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 229.816201] binder: 5639:5658 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 229.830423] binder: 5639:5658 Release 1 refcount change on invalid ref 1 ret -22 14:27:32 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB]}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:32 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x8}, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.stat\x00', 0x0, 0x0) 14:27:32 executing program 5: syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) 14:27:32 executing program 0: 14:27:32 executing program 4: syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(0xffffffffffffffff, 0x800004, 0x0) 14:27:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:32 executing program 0: 14:27:32 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(r0, 0x0, 0x1ff) 14:27:32 executing program 0: 14:27:32 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(r0, 0x0, 0x0) 14:27:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(r0, 0x0, 0x1ff) [ 232.733596] binder: 5681:5686 ioctl c0306201 0 returned -14 14:27:33 executing program 0: [ 232.796191] binder: 5681:5701 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 232.818094] binder: 5681:5701 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 232.837140] binder: 5681:5701 Release 1 refcount change on invalid ref 1 ret -22 14:27:35 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f1"], 0x6}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:35 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x8}, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.stat\x00', 0x0, 0x0) 14:27:35 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(r0, 0x0, 0x0) 14:27:35 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr\x00') mkdirat$cgroup(r0, 0x0, 0x1ff) 14:27:35 executing program 0: 14:27:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:35 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udplite6\x00') lseek(r0, 0x0, 0x0) 14:27:35 executing program 0: 14:27:36 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f1"], 0x6}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:36 executing program 5: 14:27:36 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x8}, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.stat\x00', 0x0, 0x0) 14:27:36 executing program 5: [ 235.798493] binder: 5715:5729 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:27:36 executing program 4: 14:27:36 executing program 0: 14:27:36 executing program 5: 14:27:36 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x8}, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.stat\x00', 0x0, 0x0) [ 235.842815] binder: 5715:5729 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 235.879626] binder: 5715:5729 Release 1 refcount change on invalid ref 1 ret -22 14:27:36 executing program 4: 14:27:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:36 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x8}, 0x10) 14:27:36 executing program 5: [ 236.608557] binder: 5755:5761 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 236.618666] binder: 5755:5761 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 236.626495] binder: 5755:5761 Release 1 refcount change on invalid ref 1 ret -22 14:27:39 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f1"], 0x6}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:39 executing program 0: 14:27:39 executing program 4: 14:27:39 executing program 5: 14:27:39 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) 14:27:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:39 executing program 0: 14:27:39 executing program 5: 14:27:39 executing program 4: 14:27:39 executing program 4: 14:27:39 executing program 5: 14:27:39 executing program 0: [ 238.900227] binder: 5767:5784 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 238.942741] binder: 5767:5784 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 238.963286] binder: 5767:5784 Release 1 refcount change on invalid ref 1 ret -22 14:27:42 executing program 4: 14:27:42 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) 14:27:42 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400"], 0x9}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:42 executing program 5: 14:27:42 executing program 0: 14:27:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:42 executing program 0: 14:27:42 executing program 5: 14:27:42 executing program 4: 14:27:42 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) 14:27:42 executing program 0: 14:27:42 executing program 5: 14:27:42 executing program 4: 14:27:42 executing program 0: [ 241.906988] binder: 5796:5809 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 241.946446] binder: 5796:5809 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 241.991549] binder: 5796:5809 Release 1 refcount change on invalid ref 1 ret -22 14:27:45 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400"], 0x9}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:45 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) 14:27:45 executing program 4: 14:27:45 executing program 5: 14:27:45 executing program 0: 14:27:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:45 executing program 0: 14:27:45 executing program 5: 14:27:45 executing program 4: 14:27:45 executing program 0: 14:27:45 executing program 4: 14:27:45 executing program 5: [ 244.943819] binder: 5827:5842 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 244.961874] binder: 5827:5842 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 244.983879] binder: 5827:5842 Release 1 refcount change on invalid ref 1 ret -22 14:27:48 executing program 0: 14:27:48 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400"], 0x9}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:48 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) 14:27:48 executing program 4: 14:27:48 executing program 5: 14:27:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:48 executing program 5: 14:27:48 executing program 4: 14:27:48 executing program 0: 14:27:48 executing program 5: 14:27:48 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) 14:27:48 executing program 4: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de23d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYPTR, @ANYBLOB="634fdcca909a531ddb6e7eadea7b30159d1d8c968f2eee0bcc6cd14c332e9298f98d0065d6ef7a7ca51acbabe4549317fa04eaaadc99836d94eb94f971118b6be3903c05c1ff5d9b1e095d26b2c4d2b83763ded90094ae7dcaac311b96597afd2631ef195a0d73a8b1fc14044fe77443b3af125fa6fd4269cdb4fa5de2093ef1f3e0250d14ded0f3674d227e71188da43346", @ANYPTR, @ANYRESHEX], 0x0, 0x178}, 0x20) tkill(r0, 0x39) socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 247.961530] binder: 5857:5870 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 247.999311] binder: 5857:5870 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 248.028356] binder: 5857:5870 Release 1 refcount change on invalid ref 1 ret -22 14:27:51 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd80"], 0xb}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:51 executing program 5: r0 = socket$inet(0x2, 0x4000020000000001, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @dev}, 0x10) pipe(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, 0x0) mkdir(&(0x7f0000000440)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000040)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f00000003c0)='./file0\x00') r3 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) write$UHID_INPUT(r3, &(0x7f0000000c80)={0x8, "5f5539ae7383df635d7eb9f00cde999ef4e1d4fbae589edcbcd64ae9781d89f20a7c347bd734db9d80a3e9ee0d0f04fe5305dacf9e656dc623d0d8abb05b81ebf7fa83533ebfe364612ee7d5571be6e3af5eccf0e26370ff66a26e95f4b7b1206b9d9a70fe612b356ec5074716b0e71eb9f60ac1c5e653c9a7de0de9a5f8c8047f77ece27201fc36e2ca04338864356e123b3b96be97afa5d6698e6f08a657f7ad07b42df05dfca83247581434b575e2d4419e52f1103e9e3ddc440a98f9caeace71f8affb3cfc62e4b428403787ff063d2923a50c0410f191c7923b77c51fea54cc7f2b8adcd2a5e1f53495c168736a160f28435b70f6e40df8523c2deaef8b70f13bc408d1d6eb05dbcae35f0c12cb00b8d589c0dda912acf9315852e1cbb85857f9421cd623fc5046448db22eec3c07358c4778c73a2495bf3452b18d8e904ed88ae250a99edb20b78fc923ccc841847a4f6d514320309afe2f0a075e50096c7a8cd4da2d88791d01a10cea10a97d32e8bb05a5e2bf52be5fffa3fb26953a0fadac598644cf0297d01d5c1ed9f2123ba789fa650b0d140a478903cc23a5b5c2a2a52f19bdd40039ac0291f648f1f991e272c52669f7843e73b3be22103fe0a88d5d405b9ecea5d602be0b5466d18d8a971b69a8e80e48621103a6bc6ee3a7b70b199005241779f22fa2cc159988eaf2d53c858ec06ab56acc232b587ffee3a5cb29f5641b2189fb1617d1a652e42511fe2e447a2636f18ceabc261126200193eb9f309f80aa204a93883bf6fb247ade866685f300295f8735e18d1d81365dbd2bddfa1779c59effed803bbe0a68302b1ab0f0d00892138ad24d52d653d92897bd28c2f031a77eae54ef3ce9a1fc44ea41763b2d780a454f68ea1a297302b4fa6664923a818040f5a74e0db3ff24e940e97d4abff40af2d36f7bceb8a0c5e90dbefbc8ba496f6e42f11ce11fb20655138f9387938abc3aa3a742f749a8695d972c537127519f654945bac96f0a2ef9d6b24f2226ae677684e3eb63041d6b5105777a8e6aa41ff11366448c0af1ddf5e3f2a1d828b4c9ede3809eab736c9035f2a7032ce38b699dfdc3e158e1ce62d325441e1b05a3ba5f663f20b0cb703cb2960aad298177881aa6b52bf4ae112c5d2bb691ac34b0723be7ddcfff0015e578475db1f062c5a50b54bbcba2f591eb4d6de66f386b0d5dd3975229ad25ae95d82266dfb9c1a6f497ef54b6ac5ee81edae16c47e89f9a435377dfac411db459559ce483921251745b8b94f69d4815b009ea86aedc5a75a516ff2afaff9a418f73c2cacbcdf45dd02ba962399f9b81e149635c2b4c0bda790a6d72fc243f6fbc73d0a0636db51c03d93b44b42c07f2269b465231f953e6a45dc549e9b5ef05443da7820cd667f5b0ff47a13f0a3df630a6f98f72e09978b829389d6a11afb0a7a0988822bb95fcb50399e51295f464662118646d2996da0fa710b082036820ae0a60828479bad4489061244b74179cfec74ab273551190c0eb2ca95be86391b8e469454796d04b29646b8aaae49889ffd84e83e33fb0cd7b10d778e72422f474911897dbd4548d9658e9af23cfff0ad4a7d750ab59e0f8988082ab7ac8d27eeab1c5809de6694aba8ee6ff1ba23d422f38dc026a77933cb0fc916d22131f7f736e35c881c5551f13a5037f65b9090372bb8e73bb9cd686715afef6b40ff275a978078c1e1c7db358285e5caee5c53cb4a7b446db91e5c0615342265edd9f09a72002aae56c7ad4269a0513569db514ee852724cdcccb72e8836fc270f7aa03e03e65f4572c2909e6fb1b557e89c3b505ba2f2b10b545513758abdbdc5b3e5ec1fe4d6bd5947b354058eccb79f10e971a85bdafa5aa27224acc734d884f9282ed033fc540defa3181d451713565d940879cd70a1d704b9a390de509351d5129bff18051b0c7ca196a78d3b8d0c8f384c79ad637b2e1770fecfc980960ef403cbc6bb284792cd169133f35aea028d9ffdc1668572dd197db86a26cb6fe1bb822bb76968ef2cd3c384704b75d0f17a50bcce054a400edd3b2f2abf72d2d8a679fdc94216d2d7d43ca1e60aeb5a313f8104f8ae54e75beb6c106cf080b9ecc9a1f91508b37d9ede25a1bede738c3a7f3501391a7b1863fe120ea26c4ff13f1de4588b150f3f2c12a9b9d92e6a8610c788c4d449a91416307a313536e1779bef88028d65a9398c5d1492b729d5f08e34e64fa07507f64297a1f9305a2d68169f653d5c107c9860ca0d822916eb357c646c229e792b1a5da56b35ab971bb82e41581e11f24f9c6b26c019dd2f2f89f2a82b74bd856ed7b46a2d9c07b2856bc39e9a28f271c5bb06db5bfa04d21e37e778b3e03071d25da8bbc91543fe8909603ba92e3455cb0edfe1dc040f12c169a97a5b8fb09f97acda29ab8491e7c9f81320b1a9de5773078557a6a0bdc5a1bfd2d953c47b3e5ccc70d76dc4ba10c297d7591e2c2150b8235de09714fedcf23aedb0ec9586e52f6af6c299256ad5a0a4ce22666be48592977dc5ff5c5eea529b81df4510016240b8fc8489bf59c899bb75481220554d0b9aebf1660cb72b01dfc3ffaac27dc1d36247e86339c6d99fc3ca8edf585fdb236ecdffda1b99819f873367ee5d8fde5d596517f895c9154deab01ca26008edbeadecfe33cae750ff044469a1b3b104b35af0c04a35a48aecf54dd8844b598432b81f67ce232ad46a247cad103274cd7c206d890008b149aaa3310f9794243cc5e04d4bd3e66a5b01ef67044412eba507a20399856cd26fb6233ebc064aa7b5ba94198bc05301dd74d6875b6d3b4731c2a11f0656767a3e6ba0a3d6951a7f9385ff99876891b8150ac5257756ef92a6c3854ccba8f13bca3cd3e66fdc93feefc44c3eba570970e0a6921f1eef24713ed5a174b8e52a0bc1bd3b420bdd0e521835289d29267fca4512caeaf64d1adeba2457864801d30d37e4eea965f8cfdb314f62307d8a12084a65da330f800862cae3876cdffe8c77d982ce9527b069628f0d796c0ec1c1b423ab6eb248e176a9b201d4de572f7901d8d88ae3dc6c3f196a4e3fb81552f16f7a7b7b3a242824b0618a855fc150fe8d484c80b3e1ea6c42f165dcfa7b0b292f9c7f27179d32260d4f472385a8818f7d76133030cf1256153b4162c8c3a3629c01e9b8cb5a30b3d0068d7f0e3727d8159739386511746fad1cfcc98c7af05b489876432957c6d59c51f12ebb62acac90311e6b00cea58b355db5a36718dfb8140d23e64e41ef9d33969cae75ea3ef8f14ad8c9b2d0c8bd7bf4366b091b5992ffbd71800495c0484cbee4b5fffaede0808cdcfa2409227e6b96dd82481d6d00bfff72c29f860b7fa4fa9c3634d9a2e4f7a8ef240c997b749e0562514d5c2c5d66da75149dea37b1cbb347fa0df5be2b9a5ddf20a6d47936b3b55cedc64453e69413a89c8a9eaeda00fccc96281b4f29db0f3e45fa098c77ffe3c0488529ecfa801cdf7fe8a23f6a3aa04acaf4e300c44e6d873f43b9fd4b13cbed2411c97378e07c7a6799d272d36ac8964233130947ed88f727915fa58a4812ceacd6cc6a52bc7fcba5e57543e93d293d5a428c73b194f33ba752b0ebeb0262423e7a8f490707a220857f44e191304cffb93cfc75b217ca306292549c8742fe3aa62a464d40c666115015201c0fef3e9555615f91c3d15b6e1556a9b04febc2ae7e3d689ca5f58b51f2717ae8c5153f2c2a4df11ea8cafcc369327c2a0a6f7946daf09be323d59e4b0e42ebcdeca373a6d70a3286382f1405b7107af899da00dbd52324657870bd18ca26f3ef47e0e81cd335c827512e88f24202836e7a1b505f0d03a23d577430d971458a11ff42e36b2d2883b664d402eb7497a90ba1f94829b6d9c6b4c4f7e9dc49882520a6fd2590cb8b41328541b9076e43f6019c3da9084e57960478c268f4215bb98455fbd2981e7e37caf7aaf9008f87cfe196da930637c55da5a34e142a433494e6f92a5985d7e6fc0ec68d2ad25144919af6dc81afc88cd05f01b401730bccc3086c9dd06d38ed522e52e7ffae7671898fb91cec0821c061aaea6c47ae877d2d7f5ca1ecf159e0ea152ce713f652c116f62e12cad293331db922a5fed311ab22096d90fc17ccc53f84d46eae680def0b9949e0d9debff263d575e590941a5ce0b33548beb6dbc01104f6054da73cc349625adece6a54e092d8d740915b91d81df30374a78693d6b69724f05354d61ac0febff4a544b88954d11d3f4927895edf6ad755313227ac87f24f12d70a831df16bd45c4a03570fdf27d698fa5581fce2d002890a3f2059a6bfdf77f0aeee3ad8318449bc1b2d486b225b148a78e921c73a2c37256dfb1ad611e410d5436e0d31d00ab5177da7915a74ef3307927c23c764f5cf62c3e2db86284c9abb39045b625d507f5c8d440557b4dad2a39593fbb572cce25a364aae44134fdd97ef0148690881bee42b6bd929f12cdf07996597a2a8366b12841f8fb8dfc0ece651756637b95c6bdb92320302805b4a700e7d3dfb0b8878862f400f8437a6c153b5fab40d30af07e73cf4345cb6fa81574018a7bc0e8789fae8b8560f4b93d413fa8e0e0218527ccb82873fc9da6cc34b6197c1d8bd9223ab7c4efb1f8cf021450037f4576934d83116655c120062fc3b912176fd395ccc792d492f2730465f8b4c68155b6ceb52e80742d2970e24004171f4685cd78467a4e943a0fecff66dffff10922d69236460dc37c1df9b19dded1ecb932dd8dd2045d2f8e8d3dfb6a83a65d6623553a2aed7a12b78effeeaa58eec84cdefc84923177afb7bd04f6fc3d3332d63ed5c5d6fe8820b9853e7615407eb23962f5232db44bc0267e7f07e47b158de0732a974b80aeb00ffeeca83d26fe21e487ea4472cd9048f942155784af8f68006cdb4286480a7ffa1ba6e93fe7fdb33283359d28bf9311dee59899e0e77aa113fadda21526c8e2bd60f21e182b735a5b0177fb95e948857c6c4ae391b2b4950a35b129e7bf25b7eb2c0857290c55f5d28b78ca1f39f0cd676610805b0a378647ae958182b26de1ddbf80e80d7ab1d2476086ed192e98bee0969bc0e8765278cb5570ccc29ac6d7298821bff4f85895deffcf4ce54a69878cfb41eade0d8703cbcff02352733ace2d800ba68b0fdcc52b94247ecacddf80ad228cf76eb547d276d0f6402054e34c3569e2b53ea3cbc54e49e099372cde3acd1ba47f836a765f855763a175a58ec4d6cecc72375da2d8c956c2868e77bfdb697182b554f0b743d7095cf13a3ba1d19e7590c281bd09ce235898a9682aacb5633b4fa4c3bdd71139c20c518b6a7651a47df7658a5a7ed41b3e7e43543d68c1dd4a5d01ec7e42cabdd6963db84f0d69b5a471ff8b929a8774baee39b14ab325af2ea7756c656c0135a59568499208341333d6b896cf0cc10108970e20313df241d179bd2a4d2392b269e6aeb9d2570bba7e3c67f49e90cf95562f93077a5fb588225724d444fcd8da55921dcff7b0be49ac0171ae98209e729f65bcebe447ccc0a185719f3fd55d1ae263daac4a420da91d05cdfc85d48e5743483dbb6fe81e5c216948953d95d5e725db17df44f05a57c6cc425e55572f9163e536a6d2d51d5213c937f6ddba08fc1f90ec73088a766a685f2c0d43b80422d48eef23b2ea588ea26b8dffb4f0df0cf91d6ea8f14a663ba2b165e4427010742fe63905d62b9dcf2385dce09fe75e4746d5c9c402ee77bfc9f39a28eb9f2751a81b090a499706accafbf5ae1afa9af350fd7481bb", 0x1000}, 0x1006) getpid() sendfile(r3, r3, &(0x7f0000000240), 0x2008000fffffffe) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x2000) ioctl$PERF_EVENT_IOC_RESET(r4, 0x2403, 0x3) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) socketpair(0x1, 0x0, 0x0, 0x0) fcntl$setflags(r3, 0x2, 0x1) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, 0x0, &(0x7f0000000080)) setresuid(0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x13, 0x0, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$ASHMEM_GET_PROT_MASK(r2, 0x7706, &(0x7f00000000c0)) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000000280)={'filter\x00'}, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000140)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10000, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20000801, &(0x7f0000000240)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='ip6_vti0\x00', 0x1000001d0) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 14:27:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) 14:27:51 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) 14:27:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:51 executing program 2: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 14:27:51 executing program 2: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 14:27:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 250.954128] binder: 5891:5895 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 250.961732] binder: 5891:5895 Release 1 refcount change on invalid ref 1 ret -22 [ 250.970973] binder: undelivered death notification, 0000000000000000 14:27:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1) ioctl$KDADDIO(r0, 0x89f2, 0x0) 14:27:51 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x10000000000004}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x32, 0x0, 0x0) 14:27:51 executing program 2: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) [ 251.059706] binder: 5907:5909 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 251.088642] binder: 5907:5909 Release 1 refcount change on invalid ref 1 ret -22 14:27:51 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) [ 251.122899] binder: undelivered death notification, 0000000000000000 14:27:54 executing program 0: 14:27:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:54 executing program 2: 14:27:54 executing program 4: 14:27:54 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd80"], 0xb}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:54 executing program 5: 14:27:54 executing program 5: 14:27:54 executing program 2: 14:27:54 executing program 0: 14:27:54 executing program 4: [ 254.012625] binder: 5937:5942 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:27:54 executing program 5: 14:27:54 executing program 0: 14:27:54 executing program 4: [ 254.057355] binder: 5937:5942 Release 1 refcount change on invalid ref 1 ret -22 14:27:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:54 executing program 0: 14:27:54 executing program 2: [ 254.112139] binder: undelivered death notification, 0000000000000000 [ 254.177873] binder: 5962:5966 ioctl c0306201 0 returned -14 [ 254.188654] binder: 5962:5966 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 254.196748] binder: 5962:5966 Release 1 refcount change on invalid ref 1 ret -22 [ 254.212456] binder: undelivered death notification, 0000000000000000 14:27:57 executing program 4: 14:27:57 executing program 5: 14:27:57 executing program 2: 14:27:57 executing program 0: 14:27:57 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd80"], 0xb}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:27:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:57 executing program 4: 14:27:57 executing program 0: unshare(0x24020400) getdents(0xffffffffffffffff, 0x0, 0x0) 14:27:57 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x4) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@loopback, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x80000002}, {}, {}, 0x0, 0x0, 0x400000000001}, {{@in6=@empty, 0x0, 0x33}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0xfffffffffffffffc}}, 0xe8) connect$inet6(r0, &(0x7f0000000080), 0x1c) 14:27:57 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 257.015170] binder: 5972:5977 ioctl c0306201 0 returned -14 [ 257.034784] binder: 5972:5977 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 257.052537] binder: 5972:5977 Release 1 refcount change on invalid ref 1 ret -22 14:27:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:27:57 executing program 4: unshare(0x24020400) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000340)=""/199, 0x20000407) 14:27:57 executing program 5: unshare(0x24020400) fstatfs(0xffffffffffffffff, 0x0) [ 257.100358] binder: undelivered death notification, 0000000000000000 14:27:57 executing program 0: open(&(0x7f0000000040)='./file0\x00', 0x200, 0x0) preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000001640)=""/247, 0xffffffcc}], 0x1, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x611, 0x0) fcntl$setstatus(r0, 0x4, 0x80) pwritev(r0, &(0x7f00000003c0), 0x273, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) 14:27:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 257.145553] binder: 5996:6002 ioctl c0306201 0 returned -14 [ 257.155548] binder: 5996:6002 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 257.164014] binder: 5996:6002 Release 1 refcount change on invalid ref 1 ret -22 [ 257.178854] binder: undelivered death notification, 0000000000000000 14:27:57 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x4) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@loopback, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x80000002}, {}, {}, 0x0, 0x0, 0x400000000001}, {{@in6=@empty, 0x0, 0x33}, 0x0, @in=@multicast2}}, 0xe8) connect$inet6(r0, &(0x7f0000000080), 0x1c) [ 257.215622] binder: 6011:6013 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 257.223514] binder: 6011:6013 Release 1 refcount change on invalid ref 1 ret -22 [ 257.233369] binder: undelivered death notification, 0000000000000000 14:28:00 executing program 4: mkdir(0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4014820}, 0xc, &(0x7f00000001c0)={0x0}}, 0x0) 14:28:00 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x92010201}, 0xc) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@loopback, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x80000002}, {}, {}, 0x0, 0x0, 0x400000000001}, {{@in6=@empty, 0x0, 0x33}, 0x0, @in=@multicast2}}, 0xe8) connect$inet6(r0, &(0x7f0000000080), 0x1c) 14:28:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:00 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:00 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x98aa30ce413b9bd1, 0x2000031, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_flash={0x33, 0x0, "4d72d184b89b201a1598ebd7406aed3a4b80a03a83f06aac89368d3d3d5589ea93ed3f9cadf9db4e17d407e039b09de7733fbd79cde104fe6872b283e23e82b5db4536e7a9769b614d9d5a35b9dea07dedc23bfceaa48f8cf32a4cb8adaf39968e051eb0eaba8cc635ebea9ba67e35c316483b1ea1a92159657fde4558000fd0"}}) [ 260.027922] binder: 6025:6029 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 260.038860] binder: 6025:6029 Release 1 refcount change on invalid ref 1 ret -22 14:28:00 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:28:00 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:00 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x92010201}, 0xc) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@loopback, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x80000002}, {}, {}, 0x0, 0x0, 0x400000000001}, {{@in6=@empty, 0x0, 0x33}, 0x0, @in=@multicast2}}, 0xe8) connect$inet6(r0, &(0x7f0000000080), 0x1c) 14:28:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x80201000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)="2400000020007be11dfffd946f6105de800000031f00000000000800080018000400ff7e280000001100ffffba16a0aa1c0900589d7e80927d060e1b9ba8550e0000000000200000000000", 0x4b}], 0x1}, 0x0) 14:28:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 260.070243] binder: undelivered death notification, 0000000000000000 14:28:00 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:00 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x9}, 0x43) 14:28:00 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:00 executing program 5: unshare(0x24020400) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x33) [ 260.113209] binder: 6045:6047 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 260.145214] binder: 6045:6047 Release 1 refcount change on invalid ref 1 ret -22 14:28:00 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:00 executing program 4: unshare(0x24020400) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x0) [ 260.182720] binder: undelivered death notification, 0000000000000000 [ 260.279564] binder: 6075:6079 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 260.288315] binder: 6075:6079 Release 1 refcount change on invalid ref 1 ret -22 [ 260.297970] binder: undelivered death notification, 0000000000000000 14:28:03 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:28:03 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:03 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:03 executing program 5: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x68}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfe47bf070") r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xe6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001a00)={'bridge_slave_1\x00', 0x0}) bind$packet(r1, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) sendmmsg(r1, &(0x7f0000008a80), 0x40002d1, 0x0) 14:28:03 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX, @ANYBLOB="e6c55c5d9eb82ee4510100010029a741efca44f937d0492482ba837296d961244e2e0c734057548c402cc43b3897cc275fd87f333c"], 0x0, 0x122}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:03 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:03 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) [ 263.122461] binder: 6088:6094 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 263.141589] binder: 6088:6094 Release 1 refcount change on invalid ref 1 ret -22 14:28:03 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 263.170357] binder: undelivered death notification, 0000000000000000 14:28:03 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) [ 263.206337] binder: 6119:6122 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 263.215151] binder: 6119:6122 Release 1 refcount change on invalid ref 1 ret -22 [ 263.237760] binder: undelivered death notification, 0000000000000000 14:28:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:28:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:06 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:06 executing program 4: 14:28:06 executing program 5: 14:28:06 executing program 4: 14:28:06 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:06 executing program 5: 14:28:06 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) [ 266.142639] binder: 6132:6139 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 266.166397] binder: 6132:6139 Release 1 refcount change on invalid ref 1 ret -22 14:28:06 executing program 4: 14:28:06 executing program 5: 14:28:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 266.212092] binder: undelivered death notification, 0000000000000000 [ 266.302692] binder: 6159:6162 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 266.311394] binder: 6159:6162 Release 1 refcount change on invalid ref 1 ret -22 [ 266.319778] binder: undelivered death notification, 0000000000000000 14:28:09 executing program 4: 14:28:09 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:28:09 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:09 executing program 5: 14:28:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:09 executing program 4: 14:28:09 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:09 executing program 5: 14:28:09 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 269.156673] binder: 6168:6171 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 269.174429] binder: 6168:6171 Release 1 refcount change on invalid ref 1 ret -22 [ 269.183836] binder: undelivered death notification, 0000000000000000 14:28:09 executing program 4: 14:28:09 executing program 5: 14:28:09 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:09 executing program 4: [ 269.259697] binder: 6187:6188 Release 1 refcount change on invalid ref 1 ret -22 14:28:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:12 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:28:12 executing program 5: 14:28:12 executing program 4: 14:28:12 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:12 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:12 executing program 5: 14:28:12 executing program 4: 14:28:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 272.185069] binder: 6203:6206 Release 1 refcount change on invalid ref 1 ret -22 14:28:12 executing program 4: 14:28:12 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:12 executing program 5: 14:28:12 executing program 4: [ 272.268112] binder: 6218:6221 Release 1 refcount change on invalid ref 1 ret -22 14:28:15 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:28:15 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000100)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:15 executing program 5: 14:28:15 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:15 executing program 4: 14:28:15 executing program 5: 14:28:15 executing program 0: prctl$PR_MCE_KILL(0x21, 0x1, 0x7) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:15 executing program 4: 14:28:15 executing program 5: 14:28:15 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 275.255357] binder: 6244:6251 Release 1 refcount change on invalid ref 1 ret -22 [ 275.346703] binder: 6261:6262 Release 1 refcount change on invalid ref 1 ret -22 14:28:18 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:28:18 executing program 5: 14:28:18 executing program 4: 14:28:18 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:18 executing program 0: socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:18 executing program 4: 14:28:18 executing program 5: 14:28:18 executing program 4: 14:28:18 executing program 0: socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) 14:28:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) pipe(&(0x7f00000011c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r0, 0x0, 0x420000a77, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f0000000000)) write$binfmt_elf64(r2, &(0x7f0000000000)=ANY=[], 0xfffffd88) write$cgroup_pid(r2, &(0x7f0000000180), 0x12) r3 = gettid() timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000013) io_setup(0xfffffffffffffffe, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) 14:28:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 278.284791] binder: 6279:6284 Release 1 refcount change on invalid ref 1 ret -22 [ 278.347638] binder: 6292:6296 ioctl c0306201 0 returned -14 [ 278.359006] binder: 6292:6296 Release 1 refcount change on invalid ref 1 ret -22 14:28:21 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000400)="11dca5055e0bcfe47bf070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x74) sendto$inet(r1, 0x0, 0x198, 0x20000804, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, &(0x7f0000000480), 0xfffffffffffffdce, 0x0, 0x0, 0x150) shutdown(r1, 0x1) 14:28:21 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x2000000002800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="a47712f728db4b2b2f2f3ff7ad273b1e89e46f905080af4c90cc74b763e3062d037dca291318d0a17270bbce74b47888318b04aeb0747555ba16ea10e6ddb915ceb6397e514f3482ca3c22e31ebc6da732ee3d854a1d3b9b3c0887a22cf550250fc7204eaa3d026ef9d3f316f9fb6e05b4eb24d9694ae311c93e10ff449100000000000000da0f1e8e7653c37bc1c6fa5d5911748eb02489f6e0cccca4c194e779a13107623153b03575fef6c65398f60861abd498f4263ec33f566f3aa456e5992ea16130ed1c25", 0xc8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 14:28:21 executing program 0: socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=@newlink={0x44, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x18, 0x2, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}]}, 0x44}}, 0x0) [ 281.221232] kasan: CONFIG_KASAN_INLINE enabled [ 281.231503] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 281.244783] general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 281.251892] Modules linked in: [ 281.255096] CPU: 1 PID: 6305 Comm: syz-executor.4 Not tainted 4.14.145+ #0 [ 281.262415] task: 0000000001064d1c task.stack: 0000000019c9a71f [ 281.268616] RIP: 0010:tcp_sendmsg_locked+0x509/0x2f50 [ 281.274026] RSP: 0018:ffff888199897ae8 EFLAGS: 00010206 [ 281.279392] RAX: 0000000000000011 RBX: ffff8881ca444f00 RCX: 000000000000009a [ 281.286784] RDX: ffffffff8252ea80 RSI: ffffc90002993000 RDI: 0000000000000088 [ 281.294065] RBP: ffff8881d20bb492 R08: 0000000000000001 R09: ffffed103a4176d8 [ 281.301325] R10: ffffed103a4176d7 R11: 0000000000000000 R12: ffff888199897d90 [ 281.308799] R13: 0000000000000000 R14: ffff8881d20bb480 R15: dffffc0000000000 [ 281.316178] FS: 00007f7430830700(0000) GS:ffff8881dbb00000(0000) knlGS:0000000000000000 [ 281.324753] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 281.330720] CR2: 00007fff2017ffec CR3: 00000001d661c003 CR4: 00000000001606a0 [ 281.339119] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 281.346726] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 281.353985] Call Trace: [ 281.356598] ? tcp_sendpage+0x60/0x60 [ 281.360396] ? __local_bh_enable_ip+0x65/0xc0 [ 281.364967] tcp_sendmsg+0x2b/0x40 [ 281.368785] inet_sendmsg+0x15b/0x520 [ 281.372590] ? inet_recvmsg+0x550/0x550 [ 281.376587] sock_sendmsg+0xb7/0x100 [ 281.380391] SyS_sendto+0x1de/0x2f0 [ 281.384024] ? SyS_getpeername+0x250/0x250 [ 281.388259] ? put_timespec64+0xbe/0x110 [ 281.392309] ? nsecs_to_jiffies+0x30/0x30 [ 281.396486] ? SyS_clock_gettime+0x7d/0xe0 [ 281.400708] ? do_clock_gettime+0xd0/0xd0 [ 281.404948] ? do_syscall_64+0x43/0x520 [ 281.408920] ? SyS_getpeername+0x250/0x250 [ 281.413494] do_syscall_64+0x19b/0x520 [ 281.417380] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 281.422564] RIP: 0033:0x459a09 [ 281.425826] RSP: 002b:00007f743082fc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 281.433713] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459a09 [ 281.441326] RDX: fffffffffffffdce RSI: 0000000020000480 RDI: 0000000000000004 [ 281.448678] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000150 [ 281.456038] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f74308306d4 [ 281.463297] R13: 00000000004c79ac R14: 00000000004dd400 R15: 00000000ffffffff 14:28:21 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=ANY=[@ANYBLOB="d3d2b93c38f19c0400cd8034"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="eabe9f303b222957eecbc624877c825255f910c28f5e87a64820546a1ebed56adb3b91e7f1ffd7e4ab569f8e39808e0b61a0bf7a301ffe8dac0773d9e5411f2b25f3fbc7cf9482c1f0d81a590ed76f2c4af37bd3d331de42d61ca62ef8d48f42ffd113acf060c105020d4882fc399eaab8787f0db6510490b0f420326bcc4e2b65e7c68bacee7877a6274d908e5a5d512b87ed3eb24d40d331edbedf8a03a722ffa87cc2dfec4758b087c23cc9c5e726fea942494855d4bd3388", @ANYRES16=0x0, @ANYPTR64, @ANYRESOCT, @ANYRESHEX], 0x0, 0xed}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:28:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="11dca5055e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000200)=[@dead_binder_done, @release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 14:28:21 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 14:28:21 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x0, @mcast2}, 0x1c) syz_emit_ethernet(0x12, &(0x7f0000000400)={@link_local, @local, [{[], {0x8100, 0x4}}]}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x810) [ 281.470562] Code: ee 2b de fe 48 85 db 0f 84 12 08 00 00 e8 e0 2b de fe 8b 84 24 08 01 00 00 49 8d bd 88 00 00 00 89 44 24 08 48 89 f8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 74 06 0f 8e 07 24 00 00 41 f6 85 88 00 00 [ 281.490163] RIP: tcp_sendmsg_locked+0x509/0x2f50 RSP: ffff888199897ae8 [ 281.506608] ---[ end trace e5e1849fb55c893c ]--- [ 281.521802] Kernel panic - not syncing: Fatal exception [ 281.528694] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 281.539769] Rebooting in 86400 seconds..