(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x88a8ffff}, 0x0) [ 2627.046841] binder: 21599:21825 unknown command 0 [ 2627.051952] binder: 21599:21825 ioctl c0306201 200002c0 returned -22 14:47:03 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x100000000000000) 14:47:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000030000000000e0"], 0x0, 0x0, 0x0}) 14:47:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000020000002000000e0000001000000000000000008001200000002000000000000000000300000000000000000000000000000000000000000000000000000000000000121f7d8e7000000000000000000000000030005000020000002000000e0000001000000000000000013df862ac2b9f4550c4550e1c34b56"], 0x8f}}, 0x0) [ 2627.202104] binder: 21916:21917 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2627.240211] binder: 21924:21937 IncRefs 0 refcount change on invalid ref 196608 ret -22 [ 2627.273147] binder: 21924:21937 unknown command 0 [ 2627.289887] binder: 21924:21937 ioctl c0306201 200002c0 returned -22 [ 2627.317292] binder: 21924:22102 IncRefs 0 refcount change on invalid ref 196608 ret -22 [ 2627.339243] binder: 21924:22102 unknown command 0 [ 2627.352509] binder: 21924:22102 ioctl c0306201 200002c0 returned -22 14:47:03 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r1 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r1) close(r0) pipe(&(0x7f0000000040)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa0008000}, 0x0) 14:47:03 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x0, 0x2) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000180)={0x0, 0x2, 0x5, 0xd06, 0x11, 0xf5, 0x14600, 0xb7, {0x0, @in={{0x2, 0x4e20, @remote}}, 0xffff, 0x4, 0x4, 0x8001, 0xbb}}, &(0x7f0000000240)=0xb0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000280)={r1, @in={{0x2, 0x4e23, @rand_addr=0x20}}, [0x8, 0x1, 0x2, 0x2a, 0x80000001, 0x9, 0x2, 0x1000, 0x800, 0x7f2, 0xaa2, 0x7, 0x7, 0xfff, 0xf66]}, &(0x7f0000000380)=0x100) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f0000000140)={0x3, 0x5, 0x2, 0x2, 'syz0\x00', 0x38dd}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f00000003c0)=0x8, 0x4) r3 = dup2(r2, r2) getsockopt$inet_dccp_buf(r3, 0x21, 0xe, &(0x7f0000000000)=""/162, &(0x7f00000000c0)=0xa2) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 14:47:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000a0040000000000e0"], 0x0, 0x0, 0x0}) 14:47:03 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x100004000000000) 14:47:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x800, 0x200) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r1, 0x28, 0x6, &(0x7f0000000040), 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) [ 2627.817819] binder: 22238:22242 IncRefs 0 refcount change on invalid ref 303104 ret -22 [ 2627.866708] binder: 22238:22242 unknown command 0 [ 2627.873117] binder: 22238:22242 ioctl c0306201 200002c0 returned -22 14:47:04 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r1 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r1) close(r0) pipe(&(0x7f0000000040)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2627.909838] binder: 22238:22269 IncRefs 0 refcount change on invalid ref 303104 ret -22 [ 2627.936198] binder: 22238:22269 unknown command 0 [ 2627.960978] binder: 22238:22269 ioctl c0306201 200002c0 returned -22 [ 2627.967144] binder: 22280:22281 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:04 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x100008000000000) 14:47:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000050000000000e0"], 0x0, 0x0, 0x0}) 14:47:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa0010000}, 0x0) 14:47:04 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r1 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r1) close(r0) pipe(&(0x7f0000000040)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2628.170818] binder: 22535:22561 IncRefs 0 refcount change on invalid ref 327680 ret -22 [ 2628.196714] binder: 22535:22561 unknown command 0 [ 2628.220176] binder: 22535:22561 ioctl c0306201 200002c0 returned -22 [ 2628.256556] binder: 22535:22611 IncRefs 0 refcount change on invalid ref 327680 ret -22 [ 2628.277122] binder: 22535:22611 unknown command 0 [ 2628.288898] binder: 22535:22611 ioctl c0306201 200002c0 returned -22 14:47:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000020000002000000e0000001000000000000000008001200000002000000000000000000300000000000000000000000000000000000000000000000000000000000000121f7d8e7000000000000000000000000030005000020000002000000e0000001000000000000000013df862ac2b9f4550c4550e1c34b56"], 0x8f}}, 0x0) 14:47:04 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$getown(r1, 0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) r2 = dup2(r0, r1) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000000), 0x4) 14:47:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa0020000}, 0x0) 14:47:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000060000000000e0"], 0x0, 0x0, 0x0}) 14:47:04 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x10000c000000000) 14:47:04 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2628.574092] binder: 22777:22779 unknown command 0 [ 2628.592042] binder: 22777:22779 ioctl c0306201 200002c0 returned -22 [ 2628.634324] binder: 22777:22898 unknown command 0 [ 2628.656637] binder: 22777:22898 ioctl c0306201 200002c0 returned -22 14:47:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa0040000}, 0x0) 14:47:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) prctl$PR_CAPBSET_DROP(0x18, 0x6) 14:47:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000070000000000e0"], 0x0, 0x0, 0x0}) 14:47:04 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x101000000000000) 14:47:04 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x0, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2628.914889] binder: 23101:23141 unknown command 0 [ 2628.931303] binder: 23101:23141 ioctl c0306201 200002c0 returned -22 [ 2628.954560] binder: 23101:23272 unknown command 0 [ 2629.014710] binder: 23101:23272 ioctl c0306201 200002c0 returned -22 14:47:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000020000002000000e0000001000000000000000008001200000002000000000000000000300000000000000000000000000000000000000000000000000000000000000121f7d8e7000000000000000000000000030005000020000002000000e0000001000000000000000013df862ac2b9f4550c4550e1c34b56"], 0x8f}}, 0x0) 14:47:05 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x131, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630000000000"], 0x0, 0x0, 0x0}) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') 14:47:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa0080000}, 0x0) 14:47:05 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x200000000000000) 14:47:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000a0080000000000e0"], 0x0, 0x0, 0x0}) [ 2629.369612] binder: 23434:23438 unknown command 0 [ 2629.387425] binder: 23428:23429 unknown command 25348 [ 2629.396785] binder: 23434:23438 ioctl c0306201 200002c0 returned -22 [ 2629.400749] binder: 23428:23429 ioctl c0306201 200002c0 returned -22 14:47:05 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2629.423368] binder: 23434:23442 unknown command 0 [ 2629.450524] binder: 23434:23442 ioctl c0306201 200002c0 returned -22 14:47:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000a0000000000e0"], 0x0, 0x0, 0x0}) 14:47:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa0108000}, 0x0) 14:47:05 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, 0x0) r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0463044000a92bd7897d7b052b12ea89583df3fd"], 0x0, 0x0, 0x0}) [ 2629.664575] binder: 23705:23762 unknown command 0 14:47:05 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x400000000000000) [ 2629.693101] binder: 23705:23762 ioctl c0306201 200002c0 returned -22 [ 2629.726368] binder: 23705:23812 unknown command 0 [ 2629.754265] binder: 23705:23812 ioctl c0306201 200002c0 returned -22 14:47:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000020000002000000e0000001000000000000000008001200000002000000000000000000300000000000000000000000000000000000000000000000000000000000000121f7d8e7000000000000000000000000030005000020000002000000e0000001000000000000000013df862ac2b9f4550c4550e1c34b56"], 0x8f}}, 0x0) 14:47:06 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)) r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa0220000}, 0x0) 14:47:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x4) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2) ioctl$PPPIOCCONNECT(r1, 0x4004743a, &(0x7f00000000c0)=0x3) r2 = getpgrp(0x0) perf_event_open(0x0, r2, 0x0, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000630b0000000000e0"], 0x0, 0x0, 0x0}) 14:47:06 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x500000000000000) [ 2630.197122] binder: 24084:24085 unknown command 0 14:47:06 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)) r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2630.230544] binder: 24084:24085 ioctl c0306201 200002c0 returned -22 [ 2630.278256] binder: 24084:24167 unknown command 0 [ 2630.283299] binder: 24084:24167 ioctl c0306201 200002c0 returned -22 14:47:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xe4ffffff}, 0x0) 14:47:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000630c0000000000e0"], 0x0, 0x0, 0x0}) 14:47:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x400, 0xffffffffffffffff, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 14:47:06 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)) r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2630.417161] binder: 24383:24388 unknown command 0 14:47:06 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x600000000000000) [ 2630.467436] binder: 24383:24388 ioctl c0306201 200002c0 returned -22 [ 2630.491242] binder: 24408:24415 unknown command 0 [ 2630.514045] binder: 24383:24452 unknown command 0 [ 2630.532278] binder: 24408:24415 ioctl c0306201 200002c0 returned -22 [ 2630.538422] binder: 24383:24452 ioctl c0306201 200002c0 returned -22 14:47:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) socket$key(0xf, 0x3, 0x2) 14:47:07 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c02") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xf2300700}, 0x0) 14:47:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000630d0000000000e0"], 0x0, 0x0, 0x0}) 14:47:07 executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'rose0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={@mcast1, 0x39, r1}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:07 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x700000000000000) [ 2630.999460] binder: 24724:24734 unknown command 0 [ 2631.004373] binder: 24724:24734 ioctl c0306201 200002c0 returned -22 14:47:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0) 14:47:07 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c02") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2631.063585] binder: 24724:24757 unknown command 0 [ 2631.086708] binder: 24724:24757 ioctl c0306201 200002c0 returned -22 14:47:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000120000000000e0"], 0x0, 0x0, 0x0}) 14:47:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xf4ffffff}, 0x0) 14:47:07 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x700008000000000) 14:47:07 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c02") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2631.327600] binder: 25048:25064 unknown command 0 [ 2631.356174] binder: 25048:25064 ioctl c0306201 200002c0 returned -22 [ 2631.426267] binder: 25048:25208 unknown command 0 [ 2631.444707] binder: 25048:25208 ioctl c0306201 200002c0 returned -22 14:47:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x80000001, 0x1) connect$netrom(r1, &(0x7f0000000040)={{0x3, @bcast, 0x8}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @default]}, 0x48) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:07 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319b") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xff0f0000}, 0x0) 14:47:07 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x800000000000000) 14:47:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000200000000000e0"], 0x0, 0x0, 0x0}) [ 2631.757263] binder: 25268:25269 unknown command 0 [ 2631.776721] binder: 25268:25269 ioctl c0306201 200002c0 returned -22 14:47:07 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319b") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2631.823090] binder: 25268:25360 unknown command 0 [ 2631.852938] binder: 25268:25360 ioctl c0306201 200002c0 returned -22 14:47:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x6, 0x4000) recvfrom$x25(r1, &(0x7f0000000040)=""/70, 0x46, 0x100, &(0x7f00000000c0)={0x9, @remote={[], 0x3}}, 0x12) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000a0220000000000e0"], 0x0, 0x0, 0x0}) 14:47:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffa888}, 0x0) 14:47:08 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x800008000000000) [ 2632.018024] binder_thread_write: 25 callbacks suppressed [ 2632.018039] binder: 25589:25591 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:08 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319b") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2632.076020] binder: 25597:25598 IncRefs 0 refcount change on invalid ref 2269184 ret -22 [ 2632.097737] binder: 25597:25598 unknown command 0 [ 2632.113304] binder: 25597:25598 ioctl c0306201 200002c0 returned -22 [ 2632.137920] binder: 25597:25658 IncRefs 0 refcount change on invalid ref 2269184 ret -22 [ 2632.160306] binder: 25597:25658 unknown command 0 [ 2632.189382] binder: 25597:25658 ioctl c0306201 200002c0 returned -22 14:47:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffe4}, 0x0) 14:47:08 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd0") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000480000000000e0"], 0x0, 0x0, 0x0}) 14:47:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x200, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000080)={{{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000000180)=0xe8) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f00000001c0)={@dev={0xac, 0x14, 0x14, 0x2a}, @multicast2, r2}, 0xc) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:08 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x900000000000000) 14:47:08 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd0") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2632.552548] binder: 25928:25931 IncRefs 0 refcount change on invalid ref 4718592 ret -22 14:47:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x200000, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000040)={0x7, 0x8, 0x3, 0x81}, 0x8) [ 2632.600681] binder: 25928:25931 unknown command 0 [ 2632.666543] binder: 25928:25931 ioctl c0306201 200002c0 returned -22 [ 2632.683750] binder: 25928:26059 IncRefs 0 refcount change on invalid ref 4718592 ret -22 14:47:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xfffffff4}, 0x0) 14:47:08 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd0") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2632.727997] binder: 25928:26059 unknown command 0 [ 2632.740062] binder: 25928:26059 ioctl c0306201 200002c0 returned -22 [ 2632.757555] binder: 26099:26110 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:08 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xa00000000000000) 14:47:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000004c0000000000e0"], 0x0, 0x0, 0x0}) [ 2632.952509] binder: 26276:26328 IncRefs 0 refcount change on invalid ref 4980736 ret -22 [ 2633.016608] binder: 26276:26328 unknown command 0 [ 2633.035649] binder: 26276:26328 ioctl c0306201 200002c0 returned -22 [ 2633.047612] binder: 26276:26374 IncRefs 0 refcount change on invalid ref 4980736 ret -22 [ 2633.057540] binder: 26276:26374 unknown command 0 [ 2633.062813] binder: 26276:26374 ioctl c0306201 200002c0 returned -22 14:47:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000600)='/dev/admmidi#\x00', 0x7, 0x20000) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000640)={@hyper}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="8a1ce182c5c6989e274ee77c53346b5476aa111ad326e19acaaf4ed8da60953e25a4ddc0816c799a8994080a1188d9d75c97813fa327756cc222fbca6d791e2ef343719dce76d1964862b067f69a40ed75364ac27e5d59dff2378ed8af2db5f9452e3bd114f4fdb2297ff07e58b323363d0293ebbfb05096d05fb32388ef84fad730107147c6abd9df44cc721c19696d20532b", 0x93, 0xfffffffffffffff8) r3 = request_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0)='mime_typevboxnet1:\x00', 0xfffffffffffffffc) r4 = add_key(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000300)="bc6615e9f746c6cc46ba6f9d0a3e46d170202ae96090dbe23a119f8074193cff7900449bab3ac35206347789b1e700bdc5f3514207afddb46cb7f66ba2108cbde774", 0x42, 0xfffffffffffffffc) keyctl$dh_compute(0x17, &(0x7f0000000280)={r2, r3, r4}, &(0x7f0000000380)=""/231, 0xe7, &(0x7f00000005c0)={&(0x7f0000000480)={'tgr192\x00'}, &(0x7f00000004c0)="d19bd2c5169e1d34ecc37a16b820c4a987a3a0291e73c8bf99a79d1ad7382c4ee8bd01aa42d0beb395d5e3f3b6dce1e430acdb6a26f080d4ce1abb9b8928694b21e978adf80492d0c5355d7a60b9ae57af214eef71aa1d54b1a911094be7305769ee35e5d71ca5364b358e9f42145d0a5fc7968d16dc8031e982fbbb80a6c6ce345b803290f2a32220144cf76aa4b1be34f831e41fcd7e83412ca3cb8ed119f29005d8a10ec546324ac220c68097dc530b8d82420d1d172079672a85069405901071618e465b99e6b23e25e6fb4e013c57a52325e0", 0xd5}) 14:47:09 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x0, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x1a0ffffffff}, 0x0) 14:47:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000600000000000e0"], 0x0, 0x0, 0x0}) 14:47:09 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xb00000000000000) [ 2633.284141] binder: 26466:26474 unknown command 0 [ 2633.297044] binder: 26468:26472 IncRefs 0 refcount change on invalid ref 6291456 ret -22 [ 2633.308613] binder: 26466:26474 ioctl c0306201 200002c0 returned -22 [ 2633.316878] binder: 26468:26472 unknown command 0 [ 2633.326646] binder: 26468:26472 ioctl c0306201 200002c0 returned -22 14:47:09 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x0, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2633.346193] binder: 26468:26486 IncRefs 0 refcount change on invalid ref 6291456 ret -22 [ 2633.404053] binder: 26468:26486 unknown command 0 14:47:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x2a0ffffffff}, 0x0) 14:47:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xf8, 0x0, &(0x7f0000000380)=[@acquire_done={0x40106309, r2}, @transaction_sg={0x40486311, {{0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x10, &(0x7f0000000040)=[@fda={0x66646185, 0xa, 0x2, 0x18}, @fda={0x66646185, 0x8, 0x3, 0x20}, @fd={0x66642a85, 0x0, r1, 0x0, 0x4}], &(0x7f00000000c0)=[0x40, 0x38]}, 0xee0}}, @reply_sg={0x40486312, {{0x3, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x50, 0x8, &(0x7f0000000180)=[@ptr={0x70742a85, 0x0, &(0x7f0000000100), 0x1, 0x4, 0x3}, @ptr={0x70742a85, 0x1, &(0x7f0000000140), 0x1, 0x1, 0x40}], &(0x7f0000000200)=[0x20]}, 0x9}}, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x0, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x18, 0x48, &(0x7f0000000240)=[@fd={0x66642a85, 0x0, r1}], &(0x7f0000000300)=[0x28, 0x28, 0x18, 0x38, 0x30, 0x28, 0x78, 0x78, 0x38]}}], 0x69, 0x0, &(0x7f0000000480)="df963f9b3a13d885ff3dc674e869ee80871ad62d7f07e1c0cbb6842765b2a8448ab62f642750251477d9720b7107091e25870aa5ee135b505ad2aeb99bad95c203f41648010266e8315b36b0a908b618140bb2ff669569962619799be675c7ae73bf87ea3cf084d230"}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/mixer\x00', 0x40, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000001b80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001bc0)=0x14, 0x800) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000001c00)={{{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000001d00)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000001d40)={{{@in6=@mcast1, @in=@empty, 0x4e23, 0x1, 0x4e23, 0xcfd5, 0x2, 0x2dd4e9d4cab90129, 0x80, 0x29, r4, r5}, {0x0, 0x3a9, 0xfffffffffffff072, 0x5, 0xe6b7, 0x0, 0x5, 0x200}, {0x3, 0x7fff, 0xac25, 0x1}, 0x8, 0x6e6bb0, 0x301f379b03fbfc8a, 0x1, 0x2}, {{@in=@rand_addr=0x10000, 0x4d4, 0xff}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x3, 0x10001, 0x2b75, 0xc654, 0x100000000}}, 0xe8) syz_mount_image$bfs(&(0x7f0000000500)='bfs\x00', &(0x7f0000000540)='./file0\x00', 0x40, 0x7, &(0x7f0000001ac0)=[{&(0x7f0000000580)="015d461027bc1ce098fedb97c89c17c91dc466b33952d0798f3f9d5310fbcc6e038652c57e36d5579c2a96ce2dac3581b29af6309fcfe6adf8743f90aa55a44c1db37c5307d1885f0834ac76e7a3c2c40b1c7e5ecfc8359d472c7d2db51cfbde5330d589c62bbe3b0e7d4fe3ac84707b7e1b151a440f7a48f6905d2b23866a739c141cbeb5b591c56a4a2c5aab3af7d262388bc79353c2b4021e6e2b16719911b0eaac852ec11ee6add965bb40bec764967985af3bc22feff498d53596fc1e", 0xbf, 0x2}, {&(0x7f0000000640)="6de2b6fbbecb7ab9e42f0b55c54d5637e00e103e3c03c71fc61365c9c5bd1c1d6442a6970e361f23002aca22d4885373f017e7a166d48cc10942c3ef3ef682ddf4b8550870b2a7ffdd5bdd769ae6dbcb9effd8813b3da5511f59f640d37dc723bb44700dead78e82cdd3cee9944209ac8e68e4ba25ec502dcf90ed09269a", 0x7e, 0xa47}, {&(0x7f0000000740)="b03ac3f97fb93d5877e3187fe7fc96471cd46b8b5d9f4b2889f6b85910d52d944f683f88a933bd1002a2a091e8da52ae9f2e1ea32d61bee4ead6670dd4884a690f175edfaa8db8ce622b8c2ef2a93574f6131469622fd7503c5ebfbf123c4d68cc962efc26072ae3b59d1da148f7e4ed08eebf46c9ea5568333b0de202b5ccd69759b13c258ddb8df2554ba47c45e551e66436ec159004da5e46c0b882c6baf783ee648bdd3d978f28d649b0b634be29c8ee3d26722f5b022d8cc57c6369c8a2090a452ad76f51b98d9dc10b2184be5aff44f1460dc10055668574a02faffd2d3c5c497b1303e3ca80", 0xe9, 0x1}, {&(0x7f0000000840)="40860a8639906832b202a0a72455d0716f064863bf7ad503717052402e048334a9b2980a0aa675593910e1f317b099ad113998d13f97f21ba2193655ac20d0f90352ee924e276993679fcc365f1587882f51c814d3cc31a491e34aa79e7edeeeb52dcadb33b25e412d6a6038a4d94df738022f92c831f70dee838b3decc759494620c60385ed33e91fc31a6c85f57b5468860ad5610ef9cfb029cb6b0d253c364a346dcefada436d535d9f77fe287fdd23499dc1b4a9e3c68f60652fe39838540834d810100bfeb575d6b0ae6bf7f2858e", 0xd1, 0x9}, {&(0x7f0000000940)="f121249bb1fa66e6406daad3c99eeebe9c449980d79b3da3890b99b69463f8e06377c3b0a4f7cec341a2250e392f21480d2665e4f35b6221fc0ba8df0f8d04594a99a3067bb017d9b433f686594257c9bbc678c3f2d5046090862932f0e572145811911d31bd02b807077a6b4f06bbad5f1226212d3aa39dcdd13c83d557d4f8fb4b59f223af4356181c", 0x8a, 0xb7}, {&(0x7f0000000a00)="c58aa3688e2978274994710ad62446ea48353a2169cca48d8d32135a8104a6dc9b131a5ca8b186a8703743fd358bbf550347d8a31b82862937371ff2e4a518379ff4588e4c4da913185bb3a9a698df8b9121349c76f038b3fff18bfa1f254f20776b310105ea3731ff183befb3529278f9a650e4fb744ea531ad2a1625c5ff032650", 0x82, 0x3}, {&(0x7f0000000ac0)="61a42ce114e7e816c6bced2407c0f8ae47993e5727232f46775fee52b2a62d024bd0bf4a1f57d71c18b1842b1039311b0e6a8f31e50f150770445321e3fa5dcdf6abfce5667dd29a47b03003a581cd36f3f03bd899cdb1c0cc2eea3e1450838e6f33d13b7b35d062604e0ce424d85876133e8986fb9bf37e47f321b25d617f1a6983a93952d2afb1ca0dd71140c18231f009cb43e7063a02f8cee732a36576cc25242ffc9a3bfc89bce3145ffba018f798a1d665d458f6b519ce61d36c4b9afd0368c384c8f0bfd61ed246437a188447cabaf4d610f9182f6b6e2cd57920ca7b31e899e8a3b08d0c3fc57b4825b13bb6ed4c240f776dfffdee21a44c827e23073fa7f9c74f916a114c8cb41b31adc0a5a9a5117f3eb35fe73e469a116ea482ac572a5fceb88c5213dfb0b3f7868ab73e0d4a853420cf0643130b36138b77fc06c900f480530aaac701d62a948f8ece266ce46a982900fda9368553ba0f3e38619aecd19e4f5d7e56b89bf22ce13a5fbdbe917bde62e119c3bdc37008efcdb767031897d3209fa26e2e5eccd6e553e8d95dc14c6500cb96a286ce6e689869f47317631e245578246bbffa87ee3a1dd1c5d3e0d28f0fc15c29c36081e1313824ed4e6c99d2b02e4a19655c257af0c73a49a3cc4a43f34ab64a7a876070bca16219b8d591191dfb414d6a8dd8f87907aefd8e8c699e8f7f4ba0279b6d2ccece2172f9ea81afcecd7046d6923c27d3abb65a26328c9fe087315e69dbd902c445c61c58524baa5fca45811bdbbd8a4921a47338514a851ed804be45e0b59e2eb88ad079fdfed8c798c9ac93f707ab6131a8a931e026ba7f5731fb45d2d46a86395d30cb98c67e801216c36623a95b7a07ed80fad843f9c27fa4f5b5a6eda4d20f3cab8d7ddb9b3639fd317442ee814221e8c6d192497de336a612b38180b0d14321df8459a7b3e2d365dd52b7d113ea65a0e864523cb7f10739f19aa9399c3fbdac40f8a41b4dc4df24bd78d044a5b989ae382cd8f3956da3ac910c860e82db70e1a4cc4d069d16a3fb80585299a1323fd353238418782057fd391c51bf7b5eefd3d321bd8904d98c0808843bfb69cde7c5b913d0505607c58289153765a9726ea9b9c3eab654909f5d5031b01f531a488d90d64d295ca477fab1f047b036aa139dd65cd23aed35abe54383c029da506a6e771c9e0c7545c696b8ce384489298438e8512aa8754cea687e87faed051746de07d5dd170431e0f9540a013418fffdb345aa5aa7fb86159383a5699e742f894d4af513b1fc6b3c7d103dab557af93e28b2c7c6139d888dfda7e8dd150f3f9f6a8dc3eef2d0b3e07d9b62a671e05222c73ad536f18c156f5df18c8dd61ad69f7a6ad274837d2edda3e280e9d9347370f0b250c3ac13341012dbf0d95df4d6c4493e6519b20668ac45824ec7ba310b27b3eab641a86ef044c3bc34a340f9992fb5a7b3f34c99c635b6cc68061c2ca1f1d51426ada2008451dee7e53ab15670adb74d860d2daa9e46ead8d79221dcf47d62466667664757e5c5643ec8402a3d59112b62c570ca6d814c0cdff1edf7a872dd68629d4edb43b60c6c4a0b5f1835e0df5e1addca88fc7e49d25961fcb14bde63375a218876cf76621530c78b7d39a470ec97f5e0c5d48ad4d8645b07cd2cb959c748f3eb799534e811084456b6aba2e85993ed8193f4b9884379bd489c499cd03625896c73e3caa4e3be0c01ebe83fa2c212182fb30bb96512987a32a829134b08e7ad0fb9b72c0f17246f6a1b555b37c2449a418f49da22c65d718a2e38f7a3cd980ccd95d9cd8a983920daa497ab10183df2f899752a365e666d3f80b7456fad4bce411078eaf22e9cacacd5b6502901ed194210a431e3eb6ef4bd8dc65251849a8cab444d9ac6422a7133531cc7d085ca7fe0879e551fe1b6fd439e1a112c33e9ebca4a56768ad047da5bbbde6d2cf139b2f456a0c54021a4b0b4d286de99a248d0325a285ace7a8279b417fad96f3985847d2ceeca27525de1fd3691d67accbed1e31671b9ce58988d3558379b3176665469313f2becb6494dcd803be38a3a843b62ce7e5d38103d67c260e328a4a5143d8e9e53dd1faee5f32401e99c854d1dba14b5c89e3d0b7b36ee6232775e401b99aa7bf5343d4dc27ae9645a7e0efe895837c91d47810ba37380c9cea38467bc8bdd81755669ed3eaa012dc75ee5e54e2e7e0e08d21bc3eb3c88161f32af4122cf4c70ee1bcc731875e11f46a6027ac5992d7620b70cd4c4cbe993520f91b79e4c9213f1931c1509e5a23e7bcfb287c672edd0cc62125384f7f7ddcdcfb8df27368491800c42f2d76407fcacb482529edbb378a87fad265c5606257f3e2b1fb0767bd0a01233a60ca456a9945c1fd5a1eccbd511b32f661b9e0c3b8fa202dc922f9c5198bdc5ae498685ddca14049313b430ace84b9837c1a96502601b42a4184fc45f4cc72f927139190e3e465ffec69cb45e14b6f24f7670705ea659881c43fd7fe9409d77a16683031b1b8c3ea63407123fafde4546911930940642d8a1eb0aec2b83a58bfbc8ec0fc9669ed9aaf128fec04b1a3a28f94096e96d6a21f8fe7de18ac76ee5b43d1ee5b1296b3b97ef3288039cfd33f1e28391377a7d69471406287751437d6a454ffa228af5dd2ac36be26ce17c2b5636e4893aea8be8ef79bf0c63fa02c079c1c478ae223d7d04ae6847fd7b723bdf9f8339bd4dd6b56f6ce1eb57aa8b6a1b1b19e3cd77d1c2c5ac5bbbc96a67555d1740f7727164e1e95481736a2b3194e5635f3d264cbbd5ecc85d79f2c7228e0d88a441644bf6053d45070ad072286d3de8767bebe1fabd8a754aa9ecba1a42b20b265113e7ad7fe48244c8a3283c08503073a70235202647ee2714f0a20ef5102f9bdb3bb64d02a4fa9e39516b9c958f935f996c78907d5cdd4ed86a89bbb6c8628b4cf2f10a44ede880c7529e6ac91f1b1e427f85f2b83eb21233aa29047961ea2c80172987ab57319aad7e38d94bf66bcce7ebb5887bf2a04bcf45bfd24e21ddc518c9c50e5d99b5a1ec58c34b696a0037115199cf70361df8cd153516c5abb549db98e1d27f9fd3fad8351948e6535581a280644f507a0899580c0fb6602fe704ac35dc098860123f6fad5c877d5e43ba7f724223eba85c41523fcc3d8519dd5b3c0af6059bfc224deef9fe0a1565718fa1ee18cd48a419f980b24f1f4eca93ef9bfb2a0c196d01f01a4affedc04e5661cfe570078221d14e1ada5657a323ee3caf37a438fdb9768a78acae68bc3e96b579a54fbbe016592a4b219d04d45738f862f987ba3595aba1ad2532b84d28027b9a8a3851080b8a9cdedb0890b93f908c7ce8d90e0ffb3c32fc7347a0a6dfe5ee479ca3682de05e43d95d5d7e1fdd0f9c61ed2e8d2a67fd8c7752eb4ace170dec8f7f679eb94ec2b3613872fe7363ab97207ebbbac76eb4ff8295831bca03ca9bfb04031c696fd25cfd75334c39c9d6e6b81dfdcd9765803110a94f8d20a57ee226362bba334ccbf4ab502987ddb343ccf469fe2a13656768a54d418cb646dd550a5e48730949656a4b6a6c3aeab5e8ab4cefc4ce3cb58604512a3eba3b69e377bc13ccecd2c6c9bdb985b2544bd88f4ed4414a52f1d7a344b8450bea3d07822b63fbf37a24c616ef7d3fcf3c7645e3d71ac49c55f8261d63fbbd4a0b41bccdb3e443f44545aadf558e683f746b584e538f8138b8368b4f523f071811e1eab3388eb209ff55fd2250229e823cb1d67ac029fee9a50c287e989545f9f20db33ca808d97dabea07b5d6f7000da11330a35adf8189ab8ca1ce8906ffa23b1e8e82ee17a67173f87a81e7aaab99fc7cb52f4ab2248cae739a097fda364f7e42a595bed26da679c037b05077d07c9daefe6b97abeb458854e8edb84d6f9b93f2deea551d8d386e60315d357dda6407386c8fb8edeb31c813dc433ea064b2528d3f368b2bb03e1548454ede1160e19ee9226e90ac991c554ce405386a160c30b38e920ec1166536fa4d19f583858290041a62be3659008e77471304e87c4ae4a2e7d585c63392e5fa121f9e164bdd99d6d5ab69ae0e500eb3479bfaa08e5600c3c1ba1e39ff89bada07da692d965ebb34cf27626f33ea06b9cb889afcd1073f7b478cf46679b9cabb6653caba3349cd4945ac9fa29094b34096a962fb29b95ac915ac3de518d391b6163ead650e905c7bae1bffd6f0b5806f34ac7d5af24c40db61a476e6568cba8fd2dee3dc38b46f5b5241f7ab00fbd0e0bec328a3621a4ab5bcebfa16128afed7169c4ff0bf6d0ff69d750bd4d94700dc1531dfca01f62f0a02088bbdf0089a37e53841b3d3b1ec1b6426eea8297ed57bc9765f8860ed0244680495c7d8534fa118d9b089949eeae3f75b8677bf40799b62b6be43c51239d7e2706c1d7fcd09d8ddb25f6e55b634998b9321748b01cf9a801670c955051803ba4c687c7bfb22d47c04557f52e3a1d9520f8e5f83527a927d4c93ae38819cc2b7fb8a5e63ae0fcdcfbb05dacb0e7d845f1fa6b803cfb2f0d9c94f88053f8b8a17f990e396d5da5d20eb37cb3b9e24b318693bbf1dd00a1d06697db47e1f71472ee6a9b1e0f00a7e9185cf1bdc2ffd165622ce75d0fb99e30e6a7428d62ac22298fa4ad129ace5d89595bb29b0042d7b5816ca7c9fbe179fa6a0a24f93fb8b9e788c8cb2454c407b5dfcdc8b64fd73e43a4dbab04a9f7b35406513780252f491b122f95c4ea33f0c2c1aee2f05fe9c00afffaf800d61a7378fd12620252790c8ce4c7914b02da1aaf9983499a7cd4aa6679b5d584e47e1e61c1b52c421a74374cf16bed2b3a14a14e95f28d1abf3ef3a714af90198d14807d9b46f6c8c8297306b60d0a5c5ba4cc7ab73cf1831c985b7257531e45ef22557e0d3a48125b0b06559e4e5d94be8cac41078e09a659e15603680a89f33a58821f91a8cc6213c61e56e36a33b48d8ab12f7709614133a54416e9056dd9be6a9d6062c81a0231cab45a34a89482e9ab7ff36d825a872a47407ce379dda65dced7c81f891e5e20bce432795fce24f31752edd5306b1e0ef763ab977627d67c6bc7527db57cfd7a4d9d489b134103d052f4e1423424b2c71ae46d3a8cef9581f83fdd054bd51494fb359ebaa16c20b0b38bed4dfc1e68e341d2e3dd920525cb10ab6dcd962358fd6d84daff2584e60e97ec71f5dce25750ec3a89bbebfe851891c138b48e888bfad37573f0612d154e87360e18a3e030a76668e8cf2d890e53e56af7e69b7952a6ba067279193b0b168ca02094042f9375a493cf87b5970da1a824bdb814135a07da1d0ac9efd249b567904264f99dfa9c316b3f5fc96278dc26a285e8a1fcf95affd0b3cf9eeb98babb478920c074dafa1a00b6449038c17e18b91c986602ae7fd2e8b015f1b34af3f3a0d68b9c3cc8306bfe6ad635419b35a4f7b975b0884d15237a5216329426d71444efaf6f634ffd4bb30f75726040cd6e83db9884c1876ef9446411d7af8a63ef719928c7d6d5677cb0c6fb626b68023abde5e772e54e219d296baca8b659f9d2c68b3b864c63302bb129a69a2a3eedc1ebf2c33d5d1786aa075cb941a0d8b9095482e7978ed865baee757ef871f32fc20023108aa632a9b3f34da060688be87e84f47b2025e627512070285eae1f8934fe61e5b0464a17bcf1952b74e0c11242f6baa0352ed298fb8131aa59f96f5e35e52b995bb266240f48113c6a15be1da8a159c2da351991b6622816edd4dabb102954c368d2cfd5f06faf04a224e75e2a59b09", 0x1000, 0xffffffff7fffffff}], 0x300008, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0}) [ 2633.437182] binder: 26468:26486 ioctl c0306201 200002c0 returned -22 14:47:09 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xd00000000000000) 14:47:09 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x0, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000b630000000000e0"], 0x0, 0x0, 0x0}) [ 2633.697976] binder: 26843:26848 unknown command 0 [ 2633.704587] binder: 26843:26848 ioctl c0306201 200002c0 returned -22 [ 2633.752578] binder: 26843:26925 unknown command 0 [ 2633.766261] binder: 26843:26925 ioctl c0306201 200002c0 returned -22 14:47:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x6, 0x80) ioctl$CAPI_MANUFACTURER_CMD(r1, 0xc0104320, &(0x7f0000000080)={0x3, &(0x7f0000000040)="2a55a0a5770818bbeb76f8c19a13a71f0fa12232d5f0f466380b6856f6854bd03772e9e53ae9fa617cfe75ef3760b46470a90d4a3a"}) 14:47:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x4a0ffffffff}, 0x0) 14:47:10 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(0xffffffffffffffff) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000c630000000000e0"], 0x0, 0x0, 0x0}) 14:47:10 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x1900008000000000) [ 2634.035669] binder: 27032:27034 unknown command 0 [ 2634.056516] binder: 27032:27034 ioctl c0306201 200002c0 returned -22 [ 2634.089008] binder: 27032:27111 unknown command 0 14:47:10 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(0xffffffffffffffff) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000300)={0x0, 0x3, 0x23, 0x8010001, 0x6}, &(0x7f0000000040)=0x18) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000240)=@assoc_value={r3, 0x9}, &(0x7f0000000280)=0x8) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x40, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f00000002c0)=@assoc_value={r3, 0x80}, &(0x7f0000000080)=0xfffffe01) fcntl$getown(r0, 0x9) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e21, 0x100, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x2}}, 0xfff0000000, 0x3, 0x8, 0x81, 0x2}, &(0x7f0000000180)=0x98) [ 2634.116042] binder: 27032:27111 ioctl c0306201 200002c0 returned -22 14:47:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x8a0ffffffff}, 0x0) 14:47:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000d630000000000e0"], 0x0, 0x0, 0x0}) 14:47:10 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(0xffffffffffffffff) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="06630440000400"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x2, 0x10000) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000040)=@sack_info={0x0, 0xc29, 0x81b}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000000c0)={r2, 0x3}, &(0x7f0000000100)=0x8) [ 2634.352666] binder: 27344:27363 unknown command 0 [ 2634.386660] binder: 27344:27363 ioctl c0306201 200002c0 returned -22 [ 2634.408617] binder: 27344:27369 unknown command 0 [ 2634.432372] binder: 27344:27369 ioctl c0306201 200002c0 returned -22 14:47:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:10 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r1 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r1) close(0xffffffffffffffff) pipe(&(0x7f0000000040)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:10 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x1a00008000000000) 14:47:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) setsockopt$netrom_NETROM_IDLE(r1, 0x103, 0x7, &(0x7f0000000000)=0x1, 0x4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x2c1, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00001c1af6201c"], 0x0, 0x0, 0x0}) 14:47:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000680000000000e0"], 0x0, 0x0, 0x0}) 14:47:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x22a0ffffffff}, 0x0) [ 2634.828026] binder: 27482:27485 unknown command 0 [ 2634.839148] binder: 27480:27483 unknown command 438042624 [ 2634.845362] binder: 27482:27485 ioctl c0306201 200002c0 returned -22 [ 2634.862822] binder: 27482:27495 unknown command 0 [ 2634.871042] binder: 27480:27483 ioctl c0306201 200002c0 returned -22 [ 2634.882122] binder: 27482:27495 ioctl c0306201 200002c0 returned -22 14:47:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x10000000000000}, 0x0) 14:47:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000006c0000000000e0"], 0x0, 0x0, 0x0}) 14:47:11 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x3, 0x70, 0x2, 0x5, 0x0, 0x2, 0x0, 0x3, 0x1800, 0x6, 0x3, 0x8, 0x0, 0x400, 0x9, 0x2, 0x3f, 0x1, 0x5, 0x72, 0x0, 0xb3f, 0x2, 0x9, 0x3, 0xffff, 0x3, 0x6, 0x6, 0x7, 0xd8, 0x22, 0x10001, 0xb6, 0x6, 0x7, 0x100000000, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000000000), 0x3}, 0x802, 0x62d3, 0x7, 0x8, 0xf44b, 0x80, 0x7}, 0xffffffffffffffff, 0xb, 0xffffffffffffff9c, 0x3) flistxattr(r0, &(0x7f00000000c0)=""/93, 0x5d) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f0000000180)={0x1ff}) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 14:47:11 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x1d00008000000000) [ 2635.067283] binder: 27790:27804 unknown command 0 [ 2635.072547] binder: 27789:27791 unknown command 0 [ 2635.080217] binder: 27789:27791 ioctl c0306201 200002c0 returned -22 [ 2635.088476] binder: 27790:27804 ioctl c0306201 200002c0 returned -22 [ 2635.130729] binder: 27789:27821 unknown command 0 14:47:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000740000000000e0"], 0x0, 0x0, 0x0}) [ 2635.166716] binder: 27789:27821 ioctl c0306201 200002c0 returned -22 14:47:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x40030000000000}, 0x0) [ 2635.330658] binder: 28073:28104 unknown command 0 [ 2635.354467] binder: 28073:28104 ioctl c0306201 200002c0 returned -22 [ 2635.376038] binder: 28073:28215 unknown command 0 [ 2635.388463] binder: 28073:28215 ioctl c0306201 200002c0 returned -22 14:47:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:11 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r1 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r1) close(0xffffffffffffffff) pipe(&(0x7f0000000040)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:11 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x2000000000000000) 14:47:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x18) lsetxattr$security_selinux(&(0x7f0000000440)='./file0\x00', &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:auditctl_exec_t:s0\x00', 0xfffffef2, 0x2) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) rt_sigreturn() r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000300)='/proc/capi/capi20\x00', 0x200, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f0000000340)=""/246) select(0x40, &(0x7f0000000180)={0xffffffffffffffff, 0x7, 0x7, 0xfffffffffffffff7, 0x2, 0x0, 0x2, 0x10001}, &(0x7f00000001c0)={0x1, 0x6, 0x6, 0xc6e0, 0x2, 0x400, 0x6aebeb3d, 0xf12}, &(0x7f0000000200)={0x6, 0x40, 0xfffffffffffffbff, 0x0, 0xe77d, 0x8, 0x8000, 0x8}, &(0x7f0000000280)={r1, r2/1000+30000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463dc40947e04"], 0x0, 0x0, 0x0}) 14:47:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x8000a0ffffffff}, 0x0) 14:47:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000007a0000000000e0"], 0x0, 0x0, 0x0}) [ 2635.684694] binder: 28227:28231 unknown command 0 14:47:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x80, 0x2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, r1, 0x0, 0xd, &(0x7f0000000100)='/dev/binder#\x00'}, 0x30) ioctl$TIOCLINUX3(r2, 0x541c, &(0x7f00000001c0)) ioctl$TIOCSPGRP(r2, 0x5410, &(0x7f0000000180)=r3) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x800, 0x0) ioctl$KVM_GET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)={0x5, 0x0, [{}, {}, {}, {}, {}]}) [ 2635.713761] binder: 28227:28231 ioctl c0306201 200002c0 returned -22 [ 2635.759975] binder: 28227:28250 unknown command 0 [ 2635.781637] binder: 28227:28250 ioctl c0306201 200002c0 returned -22 14:47:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040406300000000e0"], 0x0, 0x0, 0x0}) 14:47:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x80000, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(twofish)\x00'}, 0x58) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:12 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x5000000000000000) 14:47:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x8010a0ffffffff}, 0x0) [ 2635.953710] binder: 28443:28446 unknown command 0 [ 2635.966640] binder: 28443:28446 ioctl c0306201 200002c0 returned -22 [ 2636.000605] binder: 28443:28464 unknown command 0 14:47:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000a0008000000000e0"], 0x0, 0x0, 0x0}) [ 2636.024904] binder: 28443:28464 ioctl c0306201 200002c0 returned -22 [ 2636.177537] binder: 28712:28725 unknown command 0 [ 2636.205951] binder: 28712:28725 ioctl c0306201 200002c0 returned -22 [ 2636.235845] binder: 28712:28761 unknown command 0 [ 2636.254236] binder: 28712:28761 ioctl c0306201 200002c0 returned -22 14:47:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa0010000000000}, 0x0) 14:47:12 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r1 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r1) close(0xffffffffffffffff) pipe(&(0x7f0000000040)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) perf_event_open(0x0, r1, 0x0, 0xffffffffffffff9c, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:12 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x8000000000000000) 14:47:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000a0108000000000e0"], 0x0, 0x0, 0x0}) 14:47:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) [ 2636.581904] binder: 28870:28875 unknown command 0 [ 2636.592307] binder: 28870:28875 ioctl c0306201 200002c0 returned -22 [ 2636.617729] binder: 28870:28886 unknown command 0 [ 2636.623283] binder: 28870:28886 ioctl c0306201 200002c0 returned -22 14:47:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000040)='TRUE', 0x4, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000001000000e0"], 0x0, 0x0, 0x0}) 14:47:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) [ 2636.763544] binder: 29007:29051 unknown command 1 [ 2636.769919] binder: 29007:29051 ioctl c0306201 200002c0 returned -22 [ 2636.790107] binder: 29007:29085 unknown command 1 [ 2636.805763] binder: 29007:29085 ioctl c0306201 200002c0 returned -22 14:47:12 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xf6ffffff00000000) 14:47:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040406301000000e0"], 0x0, 0x0, 0x0}) 14:47:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04080440000002"], 0x0, 0x0, 0x0}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dlm-control\x00', 0x10000, 0x0) bind$unix(r2, &(0x7f0000000640)=@file={0x0, './file0\x00'}, 0x6e) vmsplice(r1, &(0x7f00000005c0)=[{&(0x7f0000000000)="80bd8e5d2f4ba46a025747676464104111631ff82c71023eecb628138ef6", 0x1e}, {&(0x7f0000000040)="ca0010134ca5aeb753e803ae0f1bf14192c1c9e1f54cd910023fce9ffaf410dfab5b418d88b67b1558ef55be1d8ee4f693a72300475ed639ff5672248b2b14d5327756e1cb4d4de3bb91938cc3c095a02a7a4ce65a93551599fb11a8dd1b332fb4bea65c71005c3720f03f5a2948f34f4351cedd9a73405aac865c4ed200ef3706c7112eedf1f03a2aee61292accb1b70b3fb4ac3e5ca60fd3504f1d4abc08aa3bf614c6d254874f8d44ce1108f6d066704d536f591a5dc261c5f015c033187daef79b8ccb924de3048bdc79", 0xcc}, {&(0x7f0000000140)="464403ee8f1a99420cf3c246ad093af38d9a8cd97d2594cabbc99327f194f541418531aea23006c3485f43d18f41ac653fd52acc767eb307442a81248e6dd2a3bfc5201cdfe6b93220b156c991ff731c6a5fb85ee3a476255ccd7311dfb6b327b462778c73c3f931925cca7e34f8df87ee93a0b5d37773bcdf5020e481c2444ec0bd354314e5546ad7f2f5030d4faf6b8c65623f41dd6e0fb0b3a27f9d2becb759185f3c0c7a357a3557e0cb334ed9", 0xaf}, {&(0x7f0000000300)="c28f0396ee4d9289df158940a3832b020d8ffa41fdb1819f8278e88af3adadede2c0b9793c65855e64bc0970f5411c306fa082dbd4e3a8c3fd1eb64258db702c3a8ad9ff1421e145d081e2c533fcf4cf360bde1948e35a9b1e0ae326c1507217b9c939e0684073db7cf492f32c30fd7f7042798e99e8adb754de868b6d5c451b8f29cd1f4ed77b2411d9ec4610e732f9dc0b4b988f86d4aa7573733accf5479a69ad47f07a86ae16739124e6abbac60f035f38e18b4b8c50e673220cd433e543c0a7d7182efb88d9c42fe24439f0ea0d8ccd27d6b55f720764aedaece91118c1cd498f", 0xe3}, {&(0x7f0000000200)="bdbff5a4132941f0fd4d2e44", 0xc}, {&(0x7f0000000400)="7f12ef824179913bcb63b45aedc4c3f54ad324ac9ee9c133d0b9db07c2d7616d284ce8fb03a1b45579b6a259ee5b478ee06c13330f3ca92094d72839c91a4ccf51ff80700d9925a324f6dbd7cc1283370c0499025848fe36a81fc2fa17254c3f6ece68a21e54e3b56b03bce164f8cf0a830d48fd4735b0d8785cb2cb650796867813c32a993f4ffbd66cf3933715ce15e875f18566e67c5bd4cc926efe83e77c1039401526991f5f8d962a9569d7dee6728b6087ef93", 0xb6}, {&(0x7f0000000240)="3a4b88f8c8e032877a715d209a5ed9395453e8", 0x13}, {&(0x7f00000004c0)="ac46141f77d707174e15b916f262d7dedc765bccaa53708faa79c515d9024cdadefa8af32cf21cac8fa8d639dead2f48ecb4bd138887a38645ac50b5ac12e8abb4134d850062f72cb9ef2edb41ceb0bef487a69da3e197c84821635990db3a4b1d4c786dcc7dc6e6031636ece56ed4b0b165d36217405eeb14acf93a677ba6885c7f05a1ff0d3885ddfc3d5517e44647fe6c64e56535a621246a8ce152feae1399d2f7ad7e2b5ff867e06d104cdba5f6818b2390c0e6d2285d85653f7285df44fb0cd6787f340934901706dc", 0xcc}], 0x8, 0x4) ioctl$SNDRV_CTL_IOCTL_PVERSION(r2, 0x80045500, &(0x7f00000006c0)) [ 2636.947663] binder: 29215:29236 unknown command 1 [ 2636.960314] binder: 29215:29236 ioctl c0306201 200002c0 returned -22 [ 2637.009551] binder: 29215:29306 unknown command 1 [ 2637.032386] binder: 29215:29306 ioctl c0306201 200002c0 returned -22 [ 2637.042523] binder: 29304:29330 unknown command 1074006020 [ 2637.092976] binder: 29304:29330 ioctl c0306201 200002c0 returned -22 14:47:13 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x300000000000000}, 0x0) 14:47:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000002000000e0"], 0x0, 0x0, 0x0}) 14:47:13 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xfcfdffff00000000) 14:47:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2637.443276] binder_thread_write: 29 callbacks suppressed [ 2637.443291] binder: 29523:29524 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2637.458681] binder: 29519:29526 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:13 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2637.519829] binder: 29523:29524 unknown command 2 [ 2637.526588] binder: 29523:29524 ioctl c0306201 200002c0 returned -22 14:47:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x400000000000000}, 0x0) [ 2637.571809] binder: 29523:29771 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2637.597048] binder: 29523:29771 unknown command 2 [ 2637.614050] binder: 29523:29771 ioctl c0306201 200002c0 returned -22 14:47:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="04a40000000000000000a2d74240e7259daacf9bcb30a4ad6d4f400bbb5315e4f373f6406333f8236ecb609e33ee8219e6deba7d616acc8526d1b9332eef27b8b1efaa8f54dd1ba700000000d70435752868bc6e25c9062a6aa0dc12fa287e9c095d086e6f88e2799f745141b19743dca73b92d19111844ef7daf1dd4594a3295f1b3be6bbf3b11fe0b5711d82c7ffa82234d7ed9f569ffd8ff2bd35ad9f088cd1ae96fb8d4685185aad59593adee8768efb1e42943d06d7c6f82916daa1381f113d302f438ca2cf890bf1a01aeecc200ef6591c5960a934698d8fa53f0e9dfccb4cfdaa3024062a4b83cfe47abe4940269e47c3a7fe36f097b0933fb6f90f0c07080bf703814eed132beffa1318fcdc22cb38af06d031490c28503f0c4689955ea3d59ab1a0ba0b60db0b003abde01ab4255059f8c35515490cbd3d14d04a7f4808"], 0x0, 0x0, 0x0}) 14:47:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040046302000000e0"], 0x0, 0x0, 0x0}) 14:47:13 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2637.751693] binder: 29859:29901 unknown command 41988 14:47:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x500000000000000}, 0x0) [ 2637.806622] binder: 29859:29901 ioctl c0306201 200002c0 returned -22 [ 2637.834718] binder: 29946:29949 IncRefs 0 refcount change on invalid ref 1661222912 ret -22 14:47:14 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xfdfdffff00000000) 14:47:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2637.876611] binder: 29946:29949 unknown command 2 [ 2637.893289] binder: 29946:29949 ioctl c0306201 200002c0 returned -22 [ 2637.928640] binder: 29946:30001 IncRefs 0 refcount change on invalid ref 1661222912 ret -22 [ 2637.955204] binder: 29946:30001 unknown command 2 [ 2637.961345] binder: 29946:30001 ioctl c0306201 200002c0 returned -22 14:47:14 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440ead9a5"], 0x0, 0x0, 0x0}) 14:47:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) 14:47:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000003000000e0"], 0x0, 0x0, 0x0}) 14:47:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x600000000000000}, 0x0) 14:47:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2638.121800] binder: 30198:30249 IncRefs 0 refcount change on invalid ref 10869226 ret -22 [ 2638.169282] binder: 30248:30272 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:14 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffefffffff7f0000) [ 2638.210073] binder: 30248:30272 unknown command 3 [ 2638.249969] binder: 30248:30272 ioctl c0306201 200002c0 returned -22 14:47:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, 0x0, 0x0, 0x0) 14:47:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) [ 2638.295776] binder: 30248:30435 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2638.315148] binder: 30248:30435 unknown command 3 [ 2638.321233] binder: 30248:30435 ioctl c0306201 200002c0 returned -22 14:47:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040086303000000e0"], 0x0, 0x0, 0x0}) 14:47:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xa00000000000000}, 0x0) [ 2638.396704] binder: 30485:30501 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, 0x0, 0x0, 0x0) [ 2638.577914] binder: 30665:30689 IncRefs 0 refcount change on invalid ref 1661485056 ret -22 [ 2638.603000] binder: 30665:30689 unknown command 3 [ 2638.621627] binder: 30665:30689 ioctl c0306201 200002c0 returned -22 [ 2638.647225] binder: 30665:30747 unknown command 3 [ 2638.652243] binder: 30665:30747 ioctl c0306201 200002c0 returned -22 14:47:14 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:14 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffffffff00000000) 14:47:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, 0x0, 0x0, 0x0) 14:47:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x40, 0x80) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000004000000e0"], 0x0, 0x0, 0x0}) 14:47:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xc00000000000000}, 0x0) 14:47:14 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) [ 2638.824695] binder: 30813:30870 unknown command 4 14:47:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x7eb, 0x200000) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000040)=0xfffffffffffffff9, 0x4) ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f00000000c0)={0xa, 0x9, 0x5, 0x8, 0xab}) ioctl$RTC_AIE_OFF(r1, 0x7002) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000140)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r2, 0x200, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x14}}, 0x2000c001) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000240), &(0x7f0000000280)=0x4) [ 2638.870300] binder: 30813:30870 ioctl c0306201 200002c0 returned -22 14:47:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) 14:47:15 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffffffffa0008000) [ 2638.998165] binder: 30813:31132 unknown command 4 [ 2639.015865] binder: 30813:31132 ioctl c0306201 200002c0 returned -22 14:47:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) 14:47:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xe00000000000000}, 0x0) 14:47:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) 14:47:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040046304000000e0"], 0x0, 0x0, 0x0}) 14:47:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000040)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) r3 = msgget$private(0x0, 0x200) msgctl$IPC_RMID(r3, 0x0) r4 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x5, 0x58240) bind$xdp(r1, &(0x7f00000001c0)={0x2c, 0x6, r2, 0x2e, r4}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) 14:47:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x1000000000000000}, 0x0) 14:47:15 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffffffffa0010000) 14:47:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) [ 2639.398172] binder: 31469:31476 unknown command 4 [ 2639.403172] binder: 31469:31476 ioctl c0306201 200002c0 returned -22 14:47:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000005c0)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f00000006c0)=0xe8) syz_mount_image$erofs(&(0x7f0000000100)='erofs\x00', &(0x7f0000000140)='./file0\x00', 0x800, 0x5, &(0x7f0000000540)=[{&(0x7f0000000180)="0b481a4466877b83618823852470822145f25fa90a6cbf1ab9944b68871eb0f41bf9831d2a53e771895be021d0185872a398e98f589e3609c090453b4442522cbeef78b0aab88cd1b59fb2a0162e5a52ce98b5c62d6131", 0x57, 0x2}, {&(0x7f0000000200)="34161ed2f36646ebe22041d7bb11fb67680482881aab55783cce954a5eaf94edce178520acbcbdf8050f276a62306179cee9384fbd3337d121b0b855903d61a784d37fcb53595ea49b71598fc46dc40192b1ebf07e3f1a55f9e27c73900d0f59ab4b976e965094138106edb9d87c5e3b231b47c1736578da7fd65146685460af6ae70928686ca2035e0ea4a8026db2fd2f25553d1c37ed17227b1592ed8619f19f54f2cb3424456ff69510e535f744da2f57a080a1fb3e33dda9935f0e67a9ad7fc3a2ec21bdc2e09284337ff4955a4be728684d59039863b43cde0807c8e26af3289947", 0xe4, 0x7ff}, {&(0x7f0000000300)="a1fabc6624b80837bd97ef133d2d42990c47953a2da03a71f343bb77f5d1f978d4502c330c8a45a32af458cb0996", 0x2e, 0x20}, {&(0x7f0000000340)="e30eb13932a2c84ebebd8802627d699784a1a19077b32917ed51d3b9385a96f6712660c52016f3468b7b5d5fc97aa41ad98f35adb42920413aecc981fa856df2705ccb483039e150fc7ca069feb2432fdb355de0e6d61f115c14367729f48f7205d1f398a89fe20dd8d7843ad667e6acd4a64a00407351631c594eb49cf3dcee1c0ae911233f17b3b76d8c0c248ece4ef9550baf9977ff5751550320269b932f899d05971b6fbe5f4f45cbadeb0022a75951c3fdeb8f37ea9af3dcdb016dd58a1fc210e6", 0xc4, 0x3}, {&(0x7f0000000440)="ffb1277fb2caf250efc1bcb226d29657f313726dd24d9d44127374c651c7be7dc9b6801f00e37b5f03d6318a1c6200f200214e060e63ce7edbca556476f6e84782d1119c0c533bace843f2330e8903ffda2f216ce2472e592d612d53dbb7037f2d0b07f24cbd9e8791d4bdf74900b15f9275e74d9780207a17cdf601dc53365331857d0d879ec6d50717c68340ff906a6f8184d3efec992d62ef0d418241bd8e056061444ca53ca2154960f4734b3a7e090d56323905324be6719a0315d1e05be16587e45b2e3660e2", 0xc9, 0x200}], 0x2000, &(0x7f0000000740)={[{@user_xattr='user_xattr'}, {@noacl='noacl'}, {@fault_injection={'fault_injection', 0x3d, 0x2}}, {@noacl='noacl'}, {@nouser_xattr='nouser_xattr'}, {@acl='acl'}], [{@seclabel='seclabel'}, {@smackfshat={'smackfshat', 0x3d, '\xb4GPLtrusted,@cpusetuser$wlan0+proc%$\xa2'}}, {@fowner_eq={'fowner', 0x3d, r1}}]}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x4, 0x0) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f0000000800)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast}) mq_timedsend(r2, &(0x7f0000000040)="6d2f053b", 0x4, 0x8, &(0x7f0000000080)={0x0, 0x1c9c380}) 14:47:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x1700000000000000}, 0x0) [ 2639.541073] binder: 31469:31598 unknown command 4 14:47:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2639.564985] binder: 31469:31598 ioctl c0306201 200002c0 returned -22 14:47:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) 14:47:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xffffffffffffff3d, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0xffffffffffffff68, 0x0, 0x0}) syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0xffc, 0x100) 14:47:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000005000000e0"], 0x0, 0x0, 0x0}) 14:47:15 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffffffffa0020000) 14:47:15 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)}], 0x1, 0x0) 14:47:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2639.787719] binder: 31699:31739 ioctl c0306201 200002c0 returned -14 [ 2639.809213] binder: 31726:31752 unknown command 5 [ 2639.841536] binder: 31726:31752 ioctl c0306201 200002c0 returned -22 [ 2639.868951] binder: 31726:31829 unknown command 5 [ 2639.883088] binder: 31726:31829 ioctl c0306201 200002c0 returned -22 14:47:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x2000000000000000}, 0x0) 14:47:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000006000000e0"], 0x0, 0x0, 0x0}) 14:47:16 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)}], 0x1, 0x0) [ 2639.984003] binder: 31949:32014 unknown command 6 14:47:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xf58, 0x100) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000140)={0x7585f77f7fab7db5, 0xf0, &(0x7f0000000040)="af246230c5ea9bebd799fc6e4f63d4988dec0a27ba1ccce062d8889a1f24507b8ffd39ebcb9d7aa1fd315ffd95945df45493a6028dffde44c6fcaa1efc727814f5e8e9f550f722f3ec09e1befbbd8329f43d21389722dfe37cacd323ec927a66231a841e57fdb001c59280a34882bef34b718e984c46fe14bc2122e27ddda57f2ca609d80461291d23ffa635649cb35537f80678d3d86dbb7740e3f191e231e038ab64c9503a7aac24df9f04303012c319700f51fee0a50e90bf4150439b85dac10251ff67d1d1b3952b433843f9ddee9f45fd62c3ee58cc6385e9bb8bd369f5dc32534382ce52421554fb98d6802386"}) readlink(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=""/173, 0xad) 14:47:16 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffffffffa0040000) [ 2640.020086] binder: 31949:32014 ioctl c0306201 200002c0 returned -22 [ 2640.115282] binder: 31949:32060 unknown command 6 [ 2640.128930] binder: 31949:32060 ioctl c0306201 200002c0 returned -22 14:47:16 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd070") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)}], 0x1, 0x0) 14:47:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x4000000000000000}, 0x0) 14:47:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x800) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$TCSETXW(r1, 0x5435, &(0x7f0000000040)={0x401, 0xfffffffffffffe01, [0xcbfc, 0xed, 0x6, 0x3]}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04730440000000"], 0x0, 0x0, 0x0}) 14:47:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000007000000e0"], 0x0, 0x0, 0x0}) 14:47:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$smack_current(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000a0220000000000000000000040"], 0x0, 0x0, 0x0}) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) 14:47:16 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffffffffa0080000) [ 2640.322276] binder: 32311:32312 unknown command 1074033412 [ 2640.348911] binder: 32311:32312 ioctl c0306201 200002c0 returned -22 [ 2640.418796] binder: 32346:32378 unknown command 7 14:47:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) [ 2640.443062] binder: 32365:32455 transaction failed 29189/-22, size 18014398509481984-0 line 2855 [ 2640.459212] binder: 32346:32378 ioctl c0306201 200002c0 returned -22 14:47:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x6000000000000000}, 0x0) [ 2640.492244] binder: 32346:32555 unknown command 7 14:47:16 executing program 3: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x18000, 0x0) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x1a7) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x22a, 0x0, 0x0}) [ 2640.521479] binder: 32346:32555 ioctl c0306201 200002c0 returned -22 14:47:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040046307000000e0"], 0x0, 0x0, 0x0}) 14:47:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f319bd070") mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f000007c000/0x4000)=nil, 0x4000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) 14:47:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2640.651889] binder: undelivered TRANSACTION_ERROR: 29189 [ 2640.669037] binder: 32710:32730 ioctl c0306201 200002c0 returned -14 14:47:16 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffffffffa0108000) [ 2640.725255] binder: 32755:32758 unknown command 7 [ 2640.772767] binder: 32755:32758 ioctl c0306201 200002c0 returned -22 [ 2640.807478] binder: 32755:537 unknown command 7 14:47:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x6558000000000000}, 0x0) 14:47:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x7, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000"], 0x0, 0x0, 0x0}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x82800, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='%@-!}\x00', r1}, 0x10) [ 2640.825503] binder: 32755:537 ioctl c0306201 200002c0 returned -22 14:47:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1800008912, &(0x7f0000000000)="1098ce66000000007be070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000040)=0x2000000000000001, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0xfdf6) bind$inet(r1, &(0x7f0000738ff0)={0x2, 0x4e21, @dev}, 0x10) connect$inet(r1, &(0x7f0000000100)={0x2, 0x10004e21}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[@mss, @mss, @mss, @mss, @timestamp, @sack_perm], 0x154) sendto$packet(r1, &(0x7f0000000280)="098c", 0x2, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000000)={0x0, 0x40000007ffe, 0x80000000}, 0x14) shutdown(r1, 0x1) 14:47:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040106308000000e0"], 0x0, 0x0, 0x0}) 14:47:17 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0xffffffffa0220000) 14:47:17 executing program 3: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = creat(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x84003ff) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000080)={0x0, 0x8, 0xffffffff, 0xfffffffffffffffd, 0x0, 0x5}) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getgroups(0x0, &(0x7f0000000340)) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000200)=ANY=[], 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000340)='./file0\x00', 0x7) setsockopt$sock_linger(r1, 0x1, 0xd, 0x0, 0xc9dcadb7) fallocate(r2, 0x0, 0x0, 0x8200003) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x1, 0x7}, 0xf) [ 2641.082399] binder: 835:868 unknown command 8 [ 2641.124978] binder: 835:868 ioctl c0306201 200002c0 returned -22 14:47:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x8000000000000000}, 0x0) 14:47:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") request_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000140)={'syz'}, 0x0, 0xffffffffffffffff) [ 2641.178760] binder: 835:1047 unknown command 8 [ 2641.195571] binder: 835:1047 ioctl c0306201 200002c0 returned -22 14:47:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040106309000000e0"], 0x0, 0x0, 0x0}) [ 2641.343150] binder: 1051:1098 unknown command 9 [ 2641.358494] binder: 1051:1098 ioctl c0306201 200002c0 returned -22 [ 2641.389425] binder: 1051:1282 unknown command 9 [ 2641.399370] binder: 1051:1282 ioctl c0306201 200002c0 returned -22 14:47:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000000a000000e0"], 0x0, 0x0, 0x0}) [ 2641.540382] binder: 1455:1456 unknown command 10 [ 2641.554182] binder: 1455:1456 ioctl c0306201 200002c0 returned -22 [ 2641.593377] binder: 1455:1493 unknown command 10 [ 2641.606094] binder: 1455:1493 ioctl c0306201 200002c0 returned -22 14:47:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x8100000000000000}, 0x0) 14:47:17 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x1fffc, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x7}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000140)={0x4, 0x8, 0xfa00, {r2, 0x9}}, 0x10) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r3 = socket$alg(0x26, 0x5, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) close(r3) sendto$unix(r1, &(0x7f0000000180)="20f23951f591bab85c29b84b1033d6f4cc47861900a966a6610a9b300a2d5be5a6ccae17a50a0f960a6f58dbad68b8f2c5a9a267b9413c315c2618d726df5f41bc71e277c0cde9cefd07cbac74dd91", 0x4f, 0x0, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e24}, 0x6e) fanotify_init(0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000040)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x10, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)=ANY=[@ANYBLOB="020700470200000000000000000000000000000097994931eb81d2e2e1ae54d6e8ce19b8fb1973e5b792b9031ec0172aaf6992057d4e81009916e3d98ef3142fd2eb6391508a5b73837723cff5efe33e43b7567abbf1122b5cc461b550b07c0fe912b9e2333148526ec937fd82de9b1c83f5cc6deaac06251d1f0100ff7f00000000380d6ffbffffff82cf920a000000000000c60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000595d2a6ff97da99aaf82ebba9f1e933c71a5066912410415452a2b6e180068fd5d432de90a309ef829a4497e7fc1242a172a4e7e72608fd017c970fe35e571ce1d2efacbbe9c79bba4d830583f8ff5a81c7c350e9202065d3669fad088a06f"], 0x122}}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x5, @local, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000380)={{{@in6, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0x0, 0x33}, 0x0, @in6=@local, 0x0, 0x0, 0x0, 0x6}}, 0xe8) r2 = getpid() sched_setattr(r2, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r3 = socket$bt_hidp(0x1f, 0x3, 0x6) preadv(r3, &(0x7f0000000ac0)=[{&(0x7f00000005c0)=""/206, 0xce}, {&(0x7f00000004c0)=""/51, 0x33}, {&(0x7f00000009c0)=""/248, 0xf8}], 0x3, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000880)='/dev/null\x00', 0x20000, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, 0x0) r5 = socket(0x80000000a, 0x3, 0x5) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x89a2, &(0x7f0000000000)={'bridge0\x00\x00\x01\x00', 0x6}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/loop-control\x00', 0x1, 0x0) ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) r7 = ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, r7) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000040)=[@timestamp, @sack_perm, @window={0x3, 0x9}], 0x3) getpid() setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000280)='y\x00', 0x2, 0xfffffffdffffffff) getsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, 0x0, &(0x7f0000000240)) keyctl$restrict_keyring(0x1d, 0x0, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000580), 0x4) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, 0x0) 14:47:17 executing program 3: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = creat(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x84003ff) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000080)={0x0, 0x8, 0xffffffff, 0xfffffffffffffffd, 0x0, 0x5}) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getgroups(0x0, &(0x7f0000000340)) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000200)=ANY=[], 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000340)='./file0\x00', 0x7) setsockopt$sock_linger(r1, 0x1, 0xd, 0x0, 0xc9dcadb7) fallocate(r2, 0x0, 0x0, 0x8200003) syz_mount_image$vfat(0x0, 0x0, 0x800000000e004, 0x0, &(0x7f0000000140), 0x0, 0x0) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x1f, 0x1, 0x7}, 0xf) 14:47:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440004008630a000000e0"], 0x0, 0x0, 0x0}) [ 2641.801294] binder: 1500:1502 unknown command 10 14:47:17 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0x2, &(0x7f0000000040)=0x15, 0x4) ioctl$KVM_INTERRUPT(r0, 0x4004ae86, &(0x7f00000000c0)=0x4c8) close(r0) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2641.829317] FAT-fs (loop2): invalid media value (0x00) [ 2641.847660] binder: 1500:1502 ioctl c0306201 200002c0 returned -22 [ 2641.888170] binder: 1500:1584 unknown command 10 [ 2641.901021] FAT-fs (loop2): Can't find a valid FAT filesystem [ 2641.915386] binder: 1500:1584 ioctl c0306201 200002c0 returned -22 14:47:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000630b000000e0"], 0x0, 0x0, 0x0}) 14:47:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x88a8ffff00000000}, 0x0) 14:47:18 executing program 2: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x1e) [ 2642.172156] binder: 1867:1895 unknown command 11 14:47:18 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x50082, 0x0) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) accept4(r0, 0x0, &(0x7f0000000000), 0x800) 14:47:18 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="fbdb1f123c023f319bd0") r2 = socket$unix(0x1, 0x1000000000000001, 0x0) close(r2) close(r0) pipe(&(0x7f0000000040)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=',', 0x1}], 0x1, 0x0) [ 2642.222740] binder: 1867:1895 ioctl c0306201 200002c0 returned -22 [ 2642.324849] binder: 1867:1946 unknown command 11 [ 2642.344869] binder: 1867:1946 ioctl c0306201 200002c0 returned -22 14:47:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:18 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000000)='{.nodev*.\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)=r1, 0x4) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$SIOCX25GFACILITIES(r2, 0x89e2, &(0x7f0000000180)) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) 14:47:18 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) socket$key(0xf, 0x3, 0x2) 14:47:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xe4ffffff00000000}, 0x0) 14:47:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000280)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="116348400000000010000000e0ffffffffffffff0000000001"], 0x0, 0x0, 0x0}) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000000c0)) 14:47:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000630c000000e0"], 0x0, 0x0, 0x0}) [ 2642.700998] binder_thread_write: 27 callbacks suppressed [ 2642.701014] binder: 2152:2156 IncRefs 0 refcount change on invalid ref 1660944384 ret -22 [ 2642.740451] binder: 2152:2156 unknown command 12 14:47:18 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3, 0x2000) ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x1) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) mincore(&(0x7f000000d000/0x1000)=nil, 0x1000, &(0x7f00000000c0)=""/222) [ 2642.748037] binder: 2158:2160 transaction failed 29189/-22, size 0-0 line 2855 [ 2642.772871] binder: 2152:2156 ioctl c0306201 200002c0 returned -22 [ 2642.811232] binder: 2152:2315 IncRefs 0 refcount change on invalid ref 1660944384 ret -22 14:47:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xf230070000000000}, 0x0) [ 2642.824317] binder: undelivered TRANSACTION_ERROR: 29189 [ 2642.838795] binder: 2152:2315 unknown command 12 [ 2642.852721] binder: 2152:2315 ioctl c0306201 200002c0 returned -22 14:47:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000280)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="116348400000000010000000e0ffffffffffffff0000000001"], 0x0, 0x0, 0x0}) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000000c0)) 14:47:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000630d000000e0"], 0x0, 0x0, 0x0}) [ 2643.015847] binder: 2433:2478 transaction failed 29189/-22, size 0-0 line 2855 14:47:19 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$usbmon(&(0x7f0000000980)='/dev/usbmon#\x00', 0xe080, 0x3fff) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f00000001c0)={"4d9a0ae162b494b5d038e5601f121dbd67b9e1a1f7f05e694dc1394c775615bca250f036e70b5be45b2bd6834973308bf3a1e62070dd79313d1bacdf453ec36df8eb92a5a23ae778ba8b015b937957d5ca711a91986d41bdc5838ba92425ddfac7790f8345d6a364c8658a12a63a55308aa3d02eed3cd6230f4530a9045089236573b179becdc9b3430cc971264032b4099fabe894ebda0dbbb91ee365968fe9eed31f2e29a4d3a1b5173af328c818f6645d3d8deda5bb2cdce3f696ff349d166737539c2c756d76df356fb8851f5429ea0d6659f9fb494da9cf26dad7445b23eb78e1914822e0699a0d275b10ddf7ba689cba2631da990a3bf7f68f44d9139151e66b2e9c863643e9333518fafc35f2ca4f6480397fed1d9433bc0db384b0cf291102a6cdbe042b620ca2eef8a21363cccf434de45a2ce59e3f01cc1fb0d12dd74cbc62730381214875095e42744b3ca76990d5653727368ab44d6e61855e7b346226a19507bc3e320421c9b032006a75df48566e95bcaabe59ca5b3670011b5505fcd051ce78809de03546780196122378fc7f7ac8a176af507e508faa151114e2dbee7206a029c26f12fc3b465d5f92cbb7ea375c620bd0e317a89b42adb1b8fd400b0b350798a493219d7dbbe0ce8baf99fb4d08929ae00fa03e08c36826eb05a44a685a4125d9adc9cb7f90d80c6bcff8adca93e9374e5cce4e76e77c882e9b611c1c7e615eea573bb9755f10b66dedd134a9b10e1e73acab9a77bc5129ba5d8ba03815eba1a4ac9bc132a29d8a9f7eadef16572d2fcba65d648185cc4ffbb12168d417265c47f4be2acf2b2dd8a86cf893c945a546efc79691558d3d98d7b14bf38afaedf86e6f146d817e42c53515031d91f3710a006c519820c5eea2bb66152f62c97a18d594dc13cf67fcf5bc3c256caecbffb59c49bf7b853c6e8efdb61e9fba61405b02b1ab11c9e680df822e73735bb4c365ad4e193722184025d9a24efdc1dac12a715af6bde3f0723754892c2d47e15917ded53d26ed07df45423c2957c816bbd5a6a980c67e3a7772c596ee38364367fcdff8912f620f7ac6e08bfe21519e359e4e8950f7178edee1e56c284ec1d8ab3d41e1ee3aee127677edc189fea91628ee54e36430b9cbe63c3721b7859b82629570cb8773068ec688028110f612f7c1c83cf2016d42783f34ebb5d753426d2261533d840303e2bd7fbf149b941a00898e7925e0918e8b7f08e83b3184727717812b2b7dc8f1314e6bd638bcd0dc951fd317a25a493b3429bb72feb4fa898eaf1857d761fcc3a195d341799e99702fec482aa5a801efd07915f78e8c83d7e197cb0f4f1f0d962761b441a8d0097a18f2f66ace17c9692283b60421f9bc937d857f833bb52d2ee50cc83c515a7efcbf62f6f7131cb627831903be3fbca31f698c6b2525f90f71934b8b"}) readahead(r0, 0xfffffffffffff249, 0x3f) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) r3 = add_key(&(0x7f0000000740)='id_resolver\x00', &(0x7f0000000780)={'syz', 0x1}, &(0x7f00000007c0), 0x0, 0x0) add_key(&(0x7f00000007c0)='blacklist\x00', &(0x7f0000000600)={'syz', 0x0}, &(0x7f0000000640)="39c43f97df26773484c97050d1637e6cf5cee1012786bcd6063bb008fdf4216cf421f1d242dc6c1fe0dca73c423a970703de9a3157fb2edb8afb2e0f250b417855bf006ed04dd1f4d2a4cb0cb98ff7f96314992a6d91484446281efd3b24bf574edfb53a6574dc6a995e19bc2ec6edaf6b8fbbeeea8428d32809c5eb797406dbcf0883246c94678811afeaf70d16013028f1793e403a0d68de1675dc10c137fd8e2c6950c64381167ec4da063a24bca18cd9ed97ca45c662fdec23f262bb66388f58c53e1c1a515b860d965b13604f85952adac90462be0949fc75fe3fb78ea1f3961217b9dcde760560c5", 0xeb, r3) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x80040, 0x0) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r7, 0xc0845658, &(0x7f00000000c0)={0x1, @bt={0x101, 0x7, 0x0, 0x3, 0x2, 0x8000, 0x90bd, 0x200, 0x7f, 0x8, 0xffffffffffffff00, 0x2, 0x5, 0x1000, 0x5, 0x1a}}) syz_kvm_setup_cpu$x86(r2, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x1d7) syz_mount_image$minix(&(0x7f00000005c0)='minix\x00', &(0x7f0000000800)='./file0\x00', 0xfffffffffffffe00, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000840)="b17ebba0a66c93b7683014a26248d88634d469f9167ea47abd561c8079bf9a7d987502580633a1e6dbf89c93cc7ee10deea8c9e50cd98c86ebf78ff25b6e1772e09f557823341cec5b1cf977ecfbf38a88b53af33d3117", 0x57, 0xfffffffffffffffe}], 0x1000, 0x0) setsockopt$TIPC_GROUP_LEAVE(r7, 0x10f, 0x88) mmap(&(0x7f0000015000/0x1000)=nil, 0x1000, 0x2, 0x53, r5, 0x0) [ 2643.078431] binder: 2498:2520 IncRefs 0 refcount change on invalid ref 1660944384 ret -22 [ 2643.091509] binder: 2498:2520 unknown command 13 [ 2643.113714] binder: 2498:2520 ioctl c0306201 200002c0 returned -22 14:47:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xf4ffffff00000000}, 0x0) [ 2643.172340] binder: 2498:2703 IncRefs 0 refcount change on invalid ref 1660944384 ret -22 [ 2643.236086] binder: 2498:2703 unknown command 13 [ 2643.269298] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.295942] binder: 2498:2703 ioctl c0306201 200002c0 returned -22 14:47:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000400c630e000000e0"], 0x0, 0x0, 0x0}) 14:47:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000280)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="116348400000000010000000e0ffffffffffffff0000000001"], 0x0, 0x0, 0x0}) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000000c0)) 14:47:19 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/fib_triestat\x00') ioctl$KDGKBSENT(r4, 0x4b48, &(0x7f0000000100)={0x3, 0x4, 0x1}) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) signalfd4(r1, &(0x7f0000000000)={0x6}, 0x8, 0x80800) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) connect$bt_sco(r5, &(0x7f0000000140)={0x1f, {0x6, 0x40, 0xc1b, 0x9, 0x0, 0x9}}, 0x8) 14:47:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xff0f000000000000}, 0x0) 14:47:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x15, 0x2, 0x24000000000, "0e40937721712262718a5f36da7a30cd"}, 0x15, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = semget$private(0x0, 0x0, 0x104) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000e0ffffffffffffff00000000014cbe39a7031d4346825a65b971f3955bb90aa8f2847c7f5fdedebdd64578b7c6b21e233bb46d2799a85849e1f8383c2c0aa2badb7668feb1fbe8c4ef2a0c79545e42dd2408ea480eefef9b124174341dba05d454023ab6ec31a0c885bd34221021fe22ef5230869c8b2b32fc0b75492513cc5490ca6f89ba18ce8836eb4da8b50a36bfc22eeb7414ef4d9b4d781205a53f1df41a24b4eb08f5498dbc6b404f014801be"], 0x0, 0x0, 0x0}) [ 2643.793450] binder: 2955:2964 IncRefs 0 refcount change on invalid ref 1661747200 ret -22 [ 2643.818131] binder: 2952:2954 transaction failed 29189/-22, size 0-0 line 2855 [ 2643.835433] binder: 2955:2964 unknown command 14 [ 2643.840774] binder: undelivered TRANSACTION_ERROR: 29189 [ 2643.844691] binder: 2955:2964 ioctl c0306201 200002c0 returned -22 [ 2643.875435] binder: 2955:3022 IncRefs 0 refcount change on invalid ref 1661747200 ret -22 [ 2643.888157] binder: 2955:3022 unknown command 14 14:47:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000280)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="116348400000000010000000e0ffffffffffffff0000000001"], 0x0, 0x0, 0x0}) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2643.893597] binder: 2955:3022 ioctl c0306201 200002c0 returned -22 14:47:20 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$alg(0x26, 0x5, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x23, 0x0, 0x0) 14:47:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffff00000000}, 0x0) 14:47:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000400c630f000000e0"], 0x0, 0x0, 0x0}) 14:47:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x15, 0x2, 0x24000000000, "0e40937721712262718a5f36da7a30cd"}, 0x15, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = semget$private(0x0, 0x0, 0x104) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000e0ffffffffffffff00000000014cbe39a7031d4346825a65b971f3955bb90aa8f2847c7f5fdedebdd64578b7c6b21e233bb46d2799a85849e1f8383c2c0aa2badb7668feb1fbe8c4ef2a0c79545e42dd2408ea480eefef9b124174341dba05d454023ab6ec31a0c885bd34221021fe22ef5230869c8b2b32fc0b75492513cc5490ca6f89ba18ce8836eb4da8b50a36bfc22eeb7414ef4d9b4d781205a53f1df41a24b4eb08f5498dbc6b404f014801be"], 0x0, 0x0, 0x0}) [ 2644.094318] binder: 3317:3322 IncRefs 0 refcount change on invalid ref 1661747200 ret -22 [ 2644.121549] binder: 3275:3323 transaction failed 29189/-22, size 0-0 line 2855 [ 2644.138078] binder: 3317:3322 unknown command 15 14:47:20 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000280)=0x1, 0x4) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2644.143013] binder: 3317:3322 ioctl c0306201 200002c0 returned -22 [ 2644.148046] binder: undelivered TRANSACTION_ERROR: 29189 [ 2644.182451] binder: 3317:3420 IncRefs 0 refcount change on invalid ref 1661747200 ret -22 [ 2644.247228] binder: 3317:3420 unknown command 15 [ 2644.273545] binder: 3317:3420 ioctl c0306201 200002c0 returned -22 [ 2644.275338] binder: 3333:3481 transaction failed 29201/-22, size -6338049722561629767--4765126853969279758 line 2970 [ 2644.394992] binder: undelivered TRANSACTION_ERROR: 29201 14:47:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffffa0008000}, 0x0) 14:47:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x15, 0x2, 0x24000000000, "0e40937721712262718a5f36da7a30cd"}, 0x15, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = semget$private(0x0, 0x0, 0x104) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000e0ffffffffffffff00000000014cbe39a7031d4346825a65b971f3955bb90aa8f2847c7f5fdedebdd64578b7c6b21e233bb46d2799a85849e1f8383c2c0aa2badb7668feb1fbe8c4ef2a0c79545e42dd2408ea480eefef9b124174341dba05d454023ab6ec31a0c885bd34221021fe22ef5230869c8b2b32fc0b75492513cc5490ca6f89ba18ce8836eb4da8b50a36bfc22eeb7414ef4d9b4d781205a53f1df41a24b4eb08f5498dbc6b404f014801be"], 0x0, 0x0, 0x0}) 14:47:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040086310000000e0"], 0x0, 0x0, 0x0}) 14:47:20 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = dup3(r0, r2, 0x80000) write$FUSE_LSEEK(r3, &(0x7f0000000000)={0x18, 0x0, 0x6, {0xb60}}, 0x18) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000006000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 14:47:20 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2644.656026] binder: 3547:3554 IncRefs 0 refcount change on invalid ref 1661485056 ret -22 [ 2644.663780] binder: 3546:3552 transaction failed 29201/-22, size -6338049722561629767--4765126853969279758 line 2970 [ 2644.689309] binder: 3547:3554 unknown command 16 14:47:20 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2644.707609] binder: undelivered TRANSACTION_ERROR: 29201 [ 2644.710542] binder: 3547:3554 ioctl c0306201 200002c0 returned -22 14:47:20 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x15, 0x2, 0x24000000000, "0e40937721712262718a5f36da7a30cd"}, 0x15, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = semget$private(0x0, 0x0, 0x104) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffffa0010000}, 0x0) [ 2644.754297] binder: 3547:3745 IncRefs 0 refcount change on invalid ref 1661485056 ret -22 [ 2644.776338] binder: 3547:3745 unknown command 16 [ 2644.784911] binder: 3547:3745 ioctl c0306201 200002c0 returned -22 14:47:21 executing program 1: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000740)=0x5, 0x4) r1 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x4, 0x1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r3 = socket$alg(0x26, 0x5, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = getpgrp(0x0) write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x2, {{0x0, 0x2, 0x5}, 0xffff}}, 0x18) tkill(r5, 0x25) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) close(r3) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0xfbd) r7 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x2000000000000, 0x1) ioctl$TUNSETQUEUE(r7, 0x400454d9, &(0x7f00000000c0)={'nr0\x00', 0x400}) fanotify_init(0x0, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$TIOCLINUX7(r7, 0x541c, &(0x7f0000000180)={0x7, 0x9}) syz_kvm_setup_cpu$x86(r3, r8, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040486311000000e0"], 0x0, 0x0, 0x0}) 14:47:21 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2645.046062] binder: 3777:3818 unknown command 17 [ 2645.076740] binder: 3777:3818 ioctl c0306201 200002c0 returned -22 [ 2645.105206] binder: 3777:3875 unknown command 17 [ 2645.121844] binder: 3777:3875 ioctl c0306201 200002c0 returned -22 14:47:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:21 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") fcntl$setsig(r0, 0xa, 0x2) r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r3) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:21 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:21 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x15, 0x2, 0x24000000000, "0e40937721712262718a5f36da7a30cd"}, 0x15, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffffa0020000}, 0x0) 14:47:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000012000000e0"], 0x0, 0x0, 0x0}) [ 2645.392454] binder: 3888:3892 unknown command 18 14:47:21 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2645.421577] binder: 3888:3892 ioctl c0306201 200002c0 returned -22 [ 2645.441844] binder: 3888:3947 unknown command 18 [ 2645.460968] binder: 3888:3947 ioctl c0306201 200002c0 returned -22 14:47:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffffa0040000}, 0x0) 14:47:21 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x15, 0x2, 0x24000000000, "0e40937721712262718a5f36da7a30cd"}, 0x15, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400040486312000000e0"], 0x0, 0x0, 0x0}) 14:47:21 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000000)) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x366, 0xfffffffffffffffc, 0x0, 0x0) 14:47:21 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2645.701759] binder: 4108:4118 unknown command 18 [ 2645.730699] binder: 4108:4118 ioctl c0306201 200002c0 returned -22 [ 2645.761308] binder: 4108:4164 unknown command 18 [ 2645.774567] binder: 4108:4164 ioctl c0306201 200002c0 returned -22 14:47:22 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffffa0080000}, 0x0) 14:47:22 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x15, 0x2, 0x24000000000, "0e40937721712262718a5f36da7a30cd"}, 0x15, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:22 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000020000000e0"], 0x0, 0x0, 0x0}) 14:47:22 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x40000) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/create\x00', 0x2, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f00000000c0)='/dev/kvm\x00', 0x9) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, &(0x7f0000000180)="f00911cb36650f0176250f300f20d86635200000000f22d8660f3a603d53ac65363e0fd81af083a3006000baf80c66b823d4878166efbafc0cec", 0x3a}], 0x1, 0x10, &(0x7f0000000200)=[@efer], 0x1) r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0xc) setpriority(0x3, r6, 0x1) [ 2646.164243] binder: 4325:4332 unknown command 32 14:47:22 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:22 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2646.190001] binder: 4325:4332 ioctl c0306201 200002c0 returned -22 [ 2646.213383] binder: 4325:4360 unknown command 32 [ 2646.225554] binder: 4325:4360 ioctl c0306201 200002c0 returned -22 14:47:22 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) setsockopt$inet_mreqsrc(r0, 0x0, 0x2f, &(0x7f0000000000)={@dev={0xac, 0x14, 0x14, 0x1c}, @local, @local}, 0xc) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000000c0)={'nr0\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000000140)={0x0, 0x40}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r5, 0x84, 0x5, &(0x7f00000001c0)={r6, @in6={{0xa, 0x4e21, 0x8985, @empty, 0x8e12}}}, 0x84) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400002630440000000e0"], 0x0, 0x0, 0x0}) 14:47:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffffa0108000}, 0x0) 14:47:22 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2646.453851] binder: 4448:4451 unknown command 64 [ 2646.470649] binder: 4448:4451 ioctl c0306201 200002c0 returned -22 [ 2646.532170] binder: 4448:4587 unknown command 64 [ 2646.555575] binder: 4448:4587 ioctl c0306201 200002c0 returned -22 14:47:23 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:23 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:23 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0xffffffffa0220000}, 0x0) 14:47:23 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'ifb0\x00', {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1c}}}) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400004630440000000e0"], 0x0, 0x0, 0x0}) [ 2646.918682] binder: 4663:4670 unknown command 64 14:47:23 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2646.945040] binder: 4663:4670 ioctl c0306201 200002c0 returned -22 [ 2646.966738] binder: 4663:4675 unknown command 64 14:47:23 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2647.002099] binder: 4663:4675 ioctl c0306201 200002c0 returned -22 14:47:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400007630440000000e0"], 0x0, 0x0, 0x0}) 14:47:23 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000001000/0x2000)=nil, 0x2000, 0x1}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:23 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2647.235232] binder: 4890:4893 unknown command 64 [ 2647.277797] binder: 4890:4893 ioctl c0306201 200002c0 returned -22 [ 2647.350704] binder: 4890:4961 unknown command 64 [ 2647.365374] binder: 4890:4961 ioctl c0306201 200002c0 returned -22 14:47:23 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:23 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") ioctl$sock_x25_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={@remote={[], 0x1}, 0xc, 'ipddp0\x00'}) r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000000c0)={0x7b, 0x0, [0x100000001, 0x4, 0x9, 0x1]}) r5 = dup3(r3, r0, 0x80000) ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000000)={0x2b8, 0xd, 0x4}) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:23 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x2, 0x60000) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:23 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400003630840000000e0"], 0x0, 0x0, 0x0}) [ 2647.651600] binder: 5007:5012 unknown command 64 14:47:23 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2647.673013] binder: 5007:5012 ioctl c0306201 200002c0 returned -22 14:47:23 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2647.727043] binder_thread_write: 14 callbacks suppressed [ 2647.727058] binder: 5007:5045 IncRefs 0 refcount change on invalid ref 140706560 ret -22 [ 2647.787183] binder: 5007:5045 unknown command 64 [ 2647.805864] binder: 5007:5045 ioctl c0306201 200002c0 returned -22 14:47:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000a630840000000e0"], 0x0, 0x0, 0x0}) 14:47:24 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:24 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2647.989043] binder: 5195:5238 IncRefs 0 refcount change on invalid ref 140708352 ret -22 [ 2648.005300] binder: 5195:5238 unknown command 64 [ 2648.019208] binder: 5195:5238 ioctl c0306201 200002c0 returned -22 [ 2648.044294] binder: 5195:5242 IncRefs 0 refcount change on invalid ref 140708352 ret -22 [ 2648.056243] binder: 5195:5242 unknown command 64 [ 2648.070697] binder: 5195:5242 ioctl c0306201 200002c0 returned -22 14:47:24 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:24 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) fstat(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_virtio(&(0x7f0000000000)='/dev/kvm\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x40000, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=virtio,cache=mmap,seclabel,fowner>', @ANYRESDEC=r5, @ANYBLOB=',appraise_type=imasig,smackfsf[oor=/dev/kvm\x00,\x00']) 14:47:24 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mkdir(0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:24 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400010630840000000e0"], 0x0, 0x0, 0x0}) 14:47:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:24 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:24 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2648.463310] binder: 5349:5357 IncRefs 0 refcount change on invalid ref 140709888 ret -22 [ 2648.525477] binder: 5349:5357 unknown command 64 14:47:24 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7, 0x200080) ioctl$VHOST_GET_VRING_BASE(r4, 0xc008af12, &(0x7f00000000c0)) close(r1) r5 = getuid() lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000280)='\x00', r5, r6) fanotify_init(0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r4, &(0x7f0000000240)={0xb, 0x10, 0xfa00, {&(0x7f0000000100), r8, 0x8}}, 0x18) syz_kvm_setup_cpu$x86(r1, r7, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:24 executing program 3: syz_open_dev$binder(0x0, 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2648.584992] binder: 5349:5357 ioctl c0306201 200002c0 returned -22 14:47:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2648.646611] binder: 5349:5469 IncRefs 0 refcount change on invalid ref 140709888 ret -22 [ 2648.654952] binder: 5349:5469 unknown command 64 14:47:24 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2648.861650] binder: 5349:5469 ioctl c0306201 200002c0 returned -22 14:47:25 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:25 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) connect$pppoe(r3, &(0x7f0000000100)={0x18, 0x0, {0x1, @dev={[], 0x1d}, 'bridge_slave_1\x00'}}, 0x1e) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = syz_open_dev$cec(&(0x7f0000000200)='/dev/cec#\x00', 0x0, 0x2) ioctl$VIDIOC_QUERYSTD(r5, 0x8008563f, &(0x7f0000000240)) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x44000, 0x0) ioctl$TIOCMBIC(r6, 0x5417, &(0x7f00000000c0)=0x1) setsockopt$inet6_MRT6_DEL_MFC(r6, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x4e20, 0x6, @loopback, 0x6}, {0xa, 0x4e24, 0xff, @local, 0x52}, 0x4, [0x3f, 0xdb, 0x5, 0x1ff, 0x0, 0x8, 0x10001, 0x7]}, 0x5c) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r6, 0xc0105303, &(0x7f0000000140)={0x4, 0x831b, 0x9}) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:25 executing program 3: syz_open_dev$binder(0x0, 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000e630c40000000e0"], 0x0, 0x0, 0x0}) 14:47:25 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:25 executing program 3: syz_open_dev$binder(0x0, 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2649.158184] binder: 5584:5589 IncRefs 0 refcount change on invalid ref 207818240 ret -22 [ 2649.191411] binder: 5584:5589 unknown command 64 14:47:25 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2649.228854] binder: 5584:5589 ioctl c0306201 200002c0 returned -22 [ 2649.263174] binder: 5584:5666 IncRefs 0 refcount change on invalid ref 207818240 ret -22 14:47:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2649.315488] binder: 5584:5666 unknown command 64 14:47:25 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2649.356992] binder: 5584:5666 ioctl c0306201 200002c0 returned -22 14:47:25 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x4, 0x200001) r5 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000000300)=0xe8) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000340)={@empty, 0x0}, &(0x7f0000000380)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'ip6gre0\x00', 0x0}) getsockname$packet(r3, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000580)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000005c0)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@empty}}, &(0x7f0000000000)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000700)={'\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000740)={{{@in=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@remote}}, &(0x7f0000000840)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000880)={'vcan0\x00', 0x0}) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f00000008c0)={@multicast2, @broadcast, 0x0}, &(0x7f0000000900)=0xc) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000940)={@loopback, @remote, 0x0}, &(0x7f0000000980)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000009c0)={'rose0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000002240)={0x0, @local, @broadcast}, &(0x7f0000002280)=0xc) getsockname$packet(0xffffffffffffff9c, &(0x7f00000022c0)={0x11, 0x0, 0x0}, &(0x7f0000002300)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000002340)={{{@in6=@empty, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in6=@dev}}, &(0x7f0000002440)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000024c0)={{{@in=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6}}, &(0x7f00000025c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000026c0)={'eql\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000002f80)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f40)={&(0x7f0000000a00)=ANY=[@ANYBLOB=',\b\x00\x00', @ANYRES16=r5, @ANYBLOB="040027bd7000fddbdf250300000008000100", @ANYRES32=r6, @ANYBLOB="b00002003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c00040068617368000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r7, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000000000008000100", @ANYRES32=r8, @ANYBLOB="b00002003c000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000000c00040072616e646f6d000038000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000080003000300000008000400000800003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="e401020038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000800000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000300000008000600", @ANYRES32=r11, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400008000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r12, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e00000008000400b828000008000600", @ANYRES32=r13, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r14, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004003c2c000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400ffffffff080007000000000008000100", @ANYRES32=r15, @ANYBLOB="2c01020038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000600000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040007000000080007000000000038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000001000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r16, @ANYBLOB="080007000000000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000104000008000100", @ANYRES32=r17, @ANYBLOB="8c02020074000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b000000440004005e9700092f0600000100020006000000022d9d0002000000008081fe2b1a00005901010504000000c9b9d04bffff0000b32000020500000089cd0308040000004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000038000100240001006d636173745f72656a6f696e5f636f756e74000000000000000000000000000008000300030000de070004003807000038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400000000803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060061db461e02d200000400040008000600f1de431b", @ANYRES32=r18, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400e0ffffff40000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040006000000080007000000000064000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b00000034000400000005070100000006000804ff000000a8000308ae3900000700000905000000000000000400000009000005ffffffff40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000000000008000600", @ANYRES32=r19, @ANYBLOB="08000100", @ANYRES32=r20, @ANYBLOB="ec00020040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000300000008000600", @ANYRES32=r21, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000700000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000400000038000100240001006d636173745f72656a6f696e5f696e74657276616c000000000000000000000008000300030000000800040002000000"], 0x82c}, 0x1, 0x0, 0x0, 0x1}, 0x0) close(r1) fanotify_init(0x20, 0x0) r22 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r22, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) socket$vsock_dgram(0x28, 0x2, 0x0) r23 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r23) 14:47:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000f630c40000000e0"], 0x0, 0x0, 0x0}) [ 2649.608787] binder: 5861:5909 IncRefs 0 refcount change on invalid ref 207818496 ret -22 [ 2649.650998] binder: 5861:5909 unknown command 64 [ 2649.655957] binder: 5861:5909 ioctl c0306201 200002c0 returned -22 [ 2649.682299] binder: 5861:5921 IncRefs 0 refcount change on invalid ref 207818496 ret -22 [ 2649.705774] binder: 5861:5921 unknown command 64 [ 2649.710824] binder: 5861:5921 ioctl c0306201 200002c0 returned -22 14:47:25 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:25 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:25 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:25 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) 14:47:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400008631040000000e0"], 0x0, 0x0, 0x0}) [ 2649.904176] binder: 5927:5928 IncRefs 0 refcount change on invalid ref 274925568 ret -22 [ 2649.952572] binder: 5927:5928 unknown command 64 14:47:26 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2649.973419] binder: 5927:5928 ioctl c0306201 200002c0 returned -22 14:47:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:26 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2650.021370] binder: 5927:6042 unknown command 64 [ 2650.026288] binder: 5927:6042 ioctl c0306201 200002c0 returned -22 14:47:26 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400009631040000000e0"], 0x0, 0x0, 0x0}) 14:47:26 executing program 2: mkdir(0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2650.220447] binder: 6149:6150 unknown command 64 [ 2650.268669] binder: 6149:6150 ioctl c0306201 200002c0 returned -22 [ 2650.290152] binder: 6149:6157 unknown command 64 [ 2650.305265] binder: 6149:6157 ioctl c0306201 200002c0 returned -22 14:47:26 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:26 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:26 executing program 2: mkdir(0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:26 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000634040000000e0"], 0x0, 0x0, 0x0}) 14:47:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2650.711815] binder: 6266:6275 unknown command 64 14:47:26 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:26 executing program 2: mkdir(0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2650.735888] binder: 6266:6275 ioctl c0306201 200002c0 returned -22 [ 2650.786585] binder: 6266:6318 unknown command 64 [ 2650.792374] binder: 6266:6318 ioctl c0306201 200002c0 returned -22 14:47:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:27 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2000) 14:47:27 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400001634040000000e0"], 0x0, 0x0, 0x0}) [ 2651.025769] binder: 6495:6498 unknown command 64 [ 2651.043175] binder: 6495:6498 ioctl c0306201 200002c0 returned -22 [ 2651.073842] binder: 6495:6510 unknown command 64 [ 2651.085050] binder: 6495:6510 ioctl c0306201 200002c0 returned -22 14:47:27 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:27 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:27 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400011634840000000e0"], 0x0, 0x0, 0x0}) 14:47:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:27 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x54, 0x801) r4 = accept(r1, &(0x7f00000000c0)=@ax25={{0x3, @null}, [@default, @default, @netrom, @rose, @bcast, @bcast]}, &(0x7f0000000000)=0x80) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2011004}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x94, r5, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xaba}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x71b4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x400}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1f}]}, @TIPC_NLA_BEARER={0x30, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e20, @rand_addr=0x1}}}}]}, @TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x20}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x40}, 0x4000) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:27 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2651.483209] binder: 6710:6717 unknown command 64 [ 2651.500528] binder: 6710:6717 ioctl c0306201 200002c0 returned -22 14:47:27 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(0x0, 0x0, &(0x7f0000000200)='v7\x00', 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2651.554013] binder: 6710:6820 unknown command 64 14:47:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2651.592725] binder: 6710:6820 ioctl c0306201 200002c0 returned -22 14:47:27 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400012634840000000e0"], 0x0, 0x0, 0x0}) 14:47:27 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$inet_sctp(0x2, 0x0, 0x84) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000180)=0xffffffff) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000002c0)="f927edfdd0be4f6df8b5e46cd54c4a4a9704f84386fbf85ae0b4785c721dad5a938c576347c26051ded37f237f6168a7209f147a5a9724c25d82ef9de9f46998896a176ac16c221769897cbd2620230a3f3f56a5a61ff4b3d978ffb7e692425e1d61ebcb723a0d288c1f5d74e1e8703ace4ca7607518289a20396156e570a03a81cd5fe90412b8ea97fb26393c2e3be7f3584d37445be8308b", 0x99) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000000)=@assoc_value={0x0, 0x606}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r4, 0x84, 0x19, &(0x7f0000000100)={r5, 0x2}, 0x8) close(r1) fanotify_init(0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f00000001c0)={r5, 0x1, 0x80000001, 0x6, 0x1, 0x100000000, 0x800, 0x6, {r5, @in={{0x2, 0x4e22, @multicast1}}, 0x9, 0xfffffffffffffffc, 0x6, 0x9, 0x69}}, &(0x7f0000000280)=0x7d) ioctl$NBD_SET_FLAGS(r7, 0xab0a, 0x2) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2651.798854] binder: 6933:6935 unknown command 64 [ 2651.818385] binder: 6933:6935 ioctl c0306201 200002c0 returned -22 [ 2651.886341] binder: 6933:7043 unknown command 64 [ 2651.901798] binder: 6933:7043 ioctl c0306201 200002c0 returned -22 14:47:28 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:28 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(0x0, 0x0, 0x0, 0x3000000, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') 14:47:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000048000000e0"], 0x0, 0x0, 0x0}) 14:47:28 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:28 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0xfffffffffffffffa, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) r4 = dup3(r0, r0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f00000008c0)={0x556, 0x4, 0x820d, 0x7ff, 0x6, 0x2, 0xaf, 0x2, 0x0}, &(0x7f0000000900)=0x20) getsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000940)={r5, 0x800, 0xffffffff, 0x3}, &(0x7f0000000980)=0x10) fanotify_init(0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0xfffffffffffffffd) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:28 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2652.230705] binder: 7153:7159 unknown command 72 14:47:28 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x100000890f, &(0x7f00000000c0)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:28 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)='&posix_acl_access[posix_acl_access.Cnodev\x00') [ 2652.300118] binder: 7153:7159 ioctl c0306201 200002c0 returned -22 [ 2652.360102] binder: 7153:7271 unknown command 72 14:47:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2652.387583] binder: 7153:7271 ioctl c0306201 200002c0 returned -22 14:47:28 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) 14:47:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000004c000000e0"], 0x0, 0x0, 0x0}) 14:47:28 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) 14:47:28 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) 14:47:28 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x4400, 0x8) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000100)={@mcast1, 0x0, 0x2, 0x3, 0x3, 0x0, 0x3}, &(0x7f0000000140)=0x20) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) [ 2652.584298] binder: 7332:7384 unknown command 76 [ 2652.619361] binder: 7332:7384 ioctl c0306201 200002c0 returned -22 14:47:28 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5, 0x5]) [ 2652.656219] binder: 7332:7451 unknown command 76 [ 2652.686554] binder: 7332:7451 ioctl c0306201 200002c0 returned -22 14:47:29 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000060000000e0"], 0x0, 0x0, 0x0}) 14:47:29 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) 14:47:29 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) 14:47:29 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x100000890e, &(0x7f0000000040)="0adc1f123c123f319bd050") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x80) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2653.078030] binder_thread_write: 15 callbacks suppressed [ 2653.078045] binder: 7621:7623 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:29 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2653.134224] binder: 7621:7623 unknown command 96 14:47:29 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) [ 2653.163199] binder: 7621:7623 ioctl c0306201 200002c0 returned -22 [ 2653.189243] binder: 7621:7715 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2653.215248] binder: 7621:7715 unknown command 96 [ 2653.232421] binder: 7621:7715 ioctl c0306201 200002c0 returned -22 14:47:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000068000000e0"], 0x0, 0x0, 0x0}) 14:47:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:29 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x10800, 0x0) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f00000000c0)=0x1f) close(r1) fanotify_init(0x0, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2653.386247] binder: 7870:7871 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:29 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) [ 2653.426674] binder: 7870:7871 unknown command 104 [ 2653.444352] binder: 7870:7871 ioctl c0306201 200002c0 returned -22 [ 2653.490026] binder: 7870:7929 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2653.548478] binder: 7870:7929 unknown command 104 [ 2653.572533] binder: 7870:7929 ioctl c0306201 200002c0 returned -22 14:47:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:30 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5, 0x6be5]) 14:47:30 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)="485dbf1cf99ce4271692c04d213548cdee233af74abe2c83f2192f401920a91c7e0cdb957f7c382f89371aef00a8cc4a1c0e79e673e6ad47896b5b9134eff871a8a4f644c662fec0c31e7558a3dc612f947c4e8089ef1b48d6d3af6c5709ea3b0f2dcec830ebe93d978a8fd50ea68a3dfe9c93ddbe5f05d832eb1541ca58c9e551e014ddbd02f949e2844277f09eabb67c25d44a475215773454f6077f9c047ed2605617188978d2de527581b8ffc2f82937833cd14f0ea8f733be53871099ff0ff9c281b0d41217de9853d7a9cb3bf9e87b69", 0xd3}], 0x1, 0x4) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000006c000000e0"], 0x0, 0x0, 0x0}) 14:47:30 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2654.036175] binder: 8097:8100 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2654.056988] binder: 8097:8100 unknown command 108 [ 2654.062228] binder: 8097:8100 ioctl c0306201 200002c0 returned -22 [ 2654.071371] binder: 8097:8107 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2654.085034] binder: 8097:8107 unknown command 108 [ 2654.090401] binder: 8097:8107 ioctl c0306201 200002c0 returned -22 14:47:30 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4, 0x5]) 14:47:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000074000000e0"], 0x0, 0x0, 0x0}) 14:47:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:30 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000, 0x4]) [ 2654.281525] binder: 8246:8309 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:30 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x3, 0x400800) sendmsg$nl_netfilter(r4, &(0x7f0000001740)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001700)={&(0x7f0000001780)=ANY=[@ANYBLOB="f81500000a0b200226bd7000ffdbdf250000000a0c002900ff01000000000000df84131d52b3a6384c263c388fdae2131843ff9c971549beb0eecdcef1a70508221feb0cf867dae1f22a739385ea0e233b13c196490960eb6574cd17dc057296c2063a4aaf42ca14d06c2bc13b4a86485348597a92faa6842dff91b9c2bd461b8c75f519e9c7730f7811dfb859554bdcf956c033f538ff4ffb77850fcfc4225cca0defe95c4ab56250cd8b8e41b0d66039457208004f0000000000c1593b6db94693c2efa4a526954e6a3715fe1af88d2bd896603411e28159f6400eb9f00f6e4934fdce5d1421c2ed9571a9f029f32775c9a5b2f34968b4e02a9c13e6739026b258a08599f71b2e259d348bea57d03a6a108921563b1570667b3997fbbc0249dad15b48be9c966728ed43465729c42525083afc9362223fd3353c9b81bf2cdb7efd100317bf9528421969aa387b59f3113343943ca1681bfed0923dcf78929806547576e32722810fa97920f7f7cc366f62a11ab9acf32b3e970fbc7952bec5f986a36e1bf251c26a0dfee534319d47bfe469e9a2956578abc187ab1d32d08aded1862c9a0dc3bfefa7cc4eef347da0779297e3582601b77417037508051f2735f6d1066b4244b52694d65ad7d170c1b04d125ff3227786eb6583c08ed0f84a03ac9096232c3a190595c8901d61e7432c9cbc0e685d231a856e4546bb08078c7b4c7271eeed32e41edba529cb2c7232c63438566665a3609a74f7f0778aabaaf2977864b1d8a2aa0af870d168aedb23afd5fd07d29912ec7ec76c493df3128ddf58ef8c18f94d3eabd772c0412e058f75eb1c56e0750ceb53b760406bf11873a5bce99c29fb4f21f1bb05b9fe271e182bbbd151df93bb010523c6cbd39d30185cab9a30f49bc00b6e3d34a6d1c3106eb4c654951520fb74e15619f64c0e1290723377eed4b1b8a08b6c58d0b57e1e35feace963310da386c529f27c91b9484d0da353d22dde6e55ffce929670af8a4d27c7b094c3b15ed12a1cadbf224be1e8d38f056cb43ffe71ddab9979f88e20f4c288bc605a45890527f47f24dbd3c43810b72bfdbe3ebd5c60f77d01845efc876ee30cfe387e3e7b73269dff6439e6b8c58924ddfb8cfbf2cbd18af60a6f17d78389f8ad76935afca14b0729c1771c2457aca35b1cf45c0081f0705d72311b8856850be2d681ae2e6948eb5833d154b8e81671b64dfba3328888434b973b2c83832fdd3fd83e6bb59c2b5201760171f8e986038fee75fae3ef496a1ef598c3562097a82d9217db9340abd9b566fe9e8e6bc5c96b54aa493e8e4b005271a60123c4b5c7b48f3dcdb6701eaa27494716248a7322cd8a548eb32f3f4aea735df0b8afaebd0d7f200aadec0e8a0ce82e7484d3ca35cc871574c8de2901e1f1c093a0cd3c79a80119b7a9326457b7acc818fec648b4566d1d0579adf3436e5858733ccba79b8323bff53274646c8607a386327d3fe978417c33650f4a8175d1d4fb9606d8e817ff7313e6574e9219c603ba1b83141f1bd9b0ac5f916adb258ba9ba49c013ba0bb83f0ee16ec6372b667abe96d4c9f6f9cf0865cc090e71b685a6031aed206cd71cf15b3ea67f78bbd543e61e1afc938f187be975ae0cfcbbaf512420cde68ed629016279ab5b92a7120725a3ae0f23c126e055876bb36b1ae36c8e1479881baae061959cf5ef8b6c438a19a7e0ad52f0afdf5ebe7176d7a84f676041df5bc50160455694d7f60a1d88a4764c644adfb2a93f2c78eb20b55ccff99d294b28604bec828a551ff71f4eef045005d3452a4e5ab9ba43168b350c35cafd17abafabe66310a3caa39f6fd528a1a681df1f7ac8629215f50006fadc3591f1aefa2ed4ad299f4e5e81bc0aa3c0b2bdce260b459c57fee4f091f1c78aa7e7f87ca34074796163b6d353118eb6f84fe1cb01eb11784a759c6fd9ecc8bb8a62012c79e1c72f780e84d9f3a70ed5f06b5fc9a311fe676417e3260f3175832aed1a6aa813a9092272778ac1b535bd33cc757ccd7141aaca8601e36a1bb904d92d907c29baf2fa42d50ebecf560c9feb3724762aeb3e69a584931e24393a23a76f0e9dd6bded2b2f1a95faeac4774da9c06049c8e3ebb3775a2945dd411500b64bfa96e30c7772ca85d36c24c5d51c5b6e8808ee1494b4f536c019a11f4991f4f12714bb9bf9ba8b27702b61c0b27e534cee878ace7c353af2c4d30aed8ae332185956309d2cfae96c3f01048b12e30baa15c4782ffa5cc29d682c87839efb6353528a0a9fb446b60fa81754e9a87353c0e5bec45797e19766dc63c7967fe70f6c8cad729c6f343840a710d34573cf5f11947f6c625908acab749323741cdfaaeb0165a18c29fdda77fd3b75a24b3c87e5089e7ec72e83bacfd109f49cdac166ee153690887cf9ead96870a9a1471f7e98c464451fb4c202a8a118cd410c9146ef52129796c25a5a00c23a9d9df510668e8e2999694c05a618904306e67f269fcee12d2f57b915b4d9d4d4a16fe92708dceea9a507ce9e521f0c3e1f8fdfb988e982029109bf75168ad2b6082c8b8d1c0d9807c20e8ba999e9e6e1a1396802e5b48ecde34fcfdd7b90869bca150a1288a865bea00f50d63915e42a22bae7e1dda8d360ecd97ae7de4df38723a7d18dffb45926cf35ee0eff7152bfa28af5de3e51d7916d703dfbf23b317f03376ca789b5ed6bcced65d1c64d35a817ce22a96050bf8ead410f83a8fa09f5502d18dd9167ba2770e62980fcbf678f2d3d2df2237f61abdff2418fe670a3251a8353d31148b91622a101c66f8649415c715cd28180c43d460d4f2cd1868195bfdc16fdfca5b8f62395fe26723e27d26c13201ffe81f8373c43726f781ea351f93ca4b2f3154bae9f7102839bb5bd3ef05a74c355985817639801117360dedc942b2fcbf0ad60adedd07364f9a9a9f7f0435033fd2aab6ec5af39bac42fe4d0a6188712c245fd56b1ce034737a5d564dddf15c15d823f49cb17821a5b0c8209eff8d6425065b1c175808d701d9f6694a76d38c57f27c914c1c9ef79356f9cb47f5508492a2cd9615feaa577edb70e3b6c8d1b9ec0e20b1e09f9e74e3e064f3a332ab12d53761538bea89dd22111269079ee287b30e4f1c4c7242de08fa5d6bc78d5b080b3093d260376d4d9f5c3d46abc9a6b623f9df52cb291d5390716971c86cf41bce316ff30a0a015fbd7451aa509dcbbc0e8fd0a5a824c93d99e6f7a9c74b750a704072077ff6ac62c3f4a2898eed4fe0ba0084bdb361b6bec5d042567e03879f35b19fd9d37175a04b91479ac1da1bd75bb43bff844b02bce65bbe44695e554b7c28c5344d812b5e0d35472ebb7263f26e1a3732dae6ae4b7210c7a76d3c6071d9d4c2ce55199b5d43a674ba299cfb25e2cd26842cb34f5a3fbf0566fc133fa55d3182f8b224d7289631b513dede857edfdb8fabcb12fc721087453d850779fa34725a1ab2e5acf2164233172f41a0b8ed527d6021139907c2014994a374a7c2830890bc1fab5322c51e26478466db3efd28a9bab964071c7142742d7a22842f4172d09c21917639c873cbfafeba879a10ca2a4ad71b023bef6e13b6ad222b94d28a2247a41abcd909805ffa7d9a1aa742766b2ff6a40f9ad9de270421c41a70f54591e6d7d37e2da73a64582d83c0afb731f5743aa87442b8a3ba93888339eb91b7339e28d42d69d0d8d8e505ab6055238bbc38f884b817be2f1a1b9a77ee28e0047d4142b302efe76a66c285cd8323b2c52129eb0ee806dde4a6ad148895cb5f564907d52aa28351843dfcec89ba20b8d8056123f99ef4da4e847b31166f87f7e87f43b5b0836b848ebf85674fa1933fa0fab8bb476ffc6ded830b86538fd26876e6cc3b0742a2ee72c216bca5d5cf486e94c839fa9ae1c87a940b87010fc4ff99ecc8ae92f689ced96e3cd4fb6dd1babecfa953cb85f7e2362af65bdc702d7234b12bb0066a1a2d776f2d99cd6cc1722db63560f8244d01d72b459fb9eea321967ec9f6e8b5d356ec2777d8a225d7e648db6753e1aef70714d2cdd87a3e7ac4986d1ff5271e9f10ac3cc521af9ee117250f7e3c0821b71a4e0b31544f486b625cdbc2f201c740d87290207ab5e0a595832c2f94e77c078270f95402667793b8708882e0a9c4b8492452aa34a3be576b2939ca8d857643daec561808b3e56e6cb85c4063e0dfeab31eb7e2c07c82984d2c35f07f13cdb8b2b33a31e959bdcbda727bd15706b970b4055acf7bf82d64a526cbf067884ae927989c5f01d298a2e5cc9b5807843a59f72f66a73b2c5e3147e85c01afc739283ee2b84cc243db39516689d2a5d5dc1d3d1fbb32704600f2778cf796c8a22cac4d34a6b0ce52babf4ee24ec9ce68ba3596967aafed623ce743dda61a1d29bdd3f99e709e53079f4e7190f23f6e6062e17b349ef551f7bbb14b50c9fe862eff926b0baae75cbbb0591b61fc1a7077f79fdac0fb3d5ce921c29dba00e68fcb0b47a0c2f03a4b11f85700c579c03f3fb15a3e9692bd6e835bbd359f585c011e50ff1c9151e67ad45ae04cdf63e23ec03e1a0e7e74d951e4459ca1fad1307dcdb1a8b39814634325901e447624baa881f3b5232975bfff7c8d7080fb9c66d03f0d87656ab26f4811c38ccafe2e912b0a1bac7d658588e8cc03517afb2dcf41968904988b9a97bdaaa45629b73c11c22332bda6fe681f9c73e70aea5c1f452a05c249fac01b4186002879696e59229e1b550b2f0f4b6366a411f32dd3aa78c4695a72a02aa1f1a0ed373c8120a654bd03a38cbd67db5589c0e95a0d314a560af4684517963aeac1c2152de5fc8c7a04f0492d19da2934a4b98d3276c1975d02a4c4f966f6169af73b9c43691c7407cf459e6233d84ac8ec60f9de9fec2cddb1de36c87f01547b27acfe205592af4d831fad71ab4966838609c572154c5daffa6087586819bfc9289a5fb7f97dcdd342351e8a2b53c89f1923cb25a160a5c9a2249986262c7d8826670035f1198e8d10a4f746bbb814e71306693ea5f4b8ac16915de688c37d9e4cce3a6009d73b81a011813c23506e6b044042f1825fb7ab258febe560e12051795a3fc18d662d764be386865f559f9749b364dd90256eb0bae8f47c93bb5e5d360f4707cfc92bb20cfec3419206c1dd2e0f2e7f14ed32461be63be26f65a49d99550a4ab08713e02be711a554d2d8ab30d2c49cbadd83552c219c8651c09af7875f78cc24c59b65c5ccda5b9fe196040d2422d0111f2691218d199800b466add08bbf6b7f921b9b4e14bfa1fd0e06b662e35e39811f91357c72b2188d4620b33f4662d0d40166de17f1f0521963470cb24a6cfd61fa644dae5d8ccf5d1b9e03b1117adbfb2b20d509637ed81cc8d9dc0b822435d549659f9b619403e81dae9fcb7df6b61e09e6e76c54bb5c64fdaccf82826adc6aeb07b95f61ba34d447b3a190a46e8767a71a503d29451f0ee6a12fcdf6cac0cd29ccfdb5597afbe101c4e7a91d402fcbcec689cac68571d2294437294950c1f2ed886d5886035bdd3cae8f87d255483650fef4695e93d2e0d7754111806fe496cfdc3df5fe311c6570246eab594c2dfb04002160712ccb95ad23f19b995296afdf3e5fdf103f8a7631e346e13450a3f0b763d3a4d509c6ffdc09e06eb9e5bcacb9f8268fa659d74827e8c888881144261d999625b5afcbf2b68ad56ccc78e9927b6e7982dcfb5748200e3e484e9dd609e5f233833cbfb097a7d48a64aaf01ab817f8e2a3302bfdd97134017909a279d87496f8bf48d34f5d5e91249980e00bf26ba9e147f3ad236614c6c569d24a645a28be49ee7dfbd5989ce6ccc55bda0fe80d70bc84c6bf6b3b8c7ec796ce3cbbda5ba6ed92aca026a3f5f8d7ee124be624747aed2b18bd1e355fb7810553a96a993e7f388ee9c236ac3ba7b2dfdac3d7a7fdfc2484453404c41128ee9b4151ed4ab44628118c74806205076e221026ec5359b4bb0a64fdc086e40a69f0e291125fcb813b5e9261d191481f01461fb37591230d8fc9d0c7692ca479a34578f49643b0aa140d914bbeba10d319ab4d1e4006c00234e5889daf3de134366d388b38ee241b627b1ebee5308723b0acd4b0750e45a50614166facd3a336f762d218fbd03796e4d733339969ba036b615160957e01d06b0c61c41d6949c1d34845c696bd21891fc6dfbc6ece765c977b4d48f1269097de4037c52b18e27a1ff3aedc2415587a49bb0402054feb324f36a098445285c455d4c859f00b6be741d675220bd21f3a137030144590e7de9a492e967e6fed38673e523b8ec24e295dc95442fb6530f6e566121f0717b1fb718c78558226ecb07b623ff2bb29e37f819fd6dfe9cb2b23a351a4940fe838e9c151fe3f1e3fd7a7f9c6802766de5db3a840a1f59b23a55d9b661ffe90023eadb13ede7f7e72f77b1fc021dad336e48dd1aeb08f49ab877c287cdd9db04475e7becd2c25155fc32f1f6649042c08ba73d49c7efeb46eebd0b32994fa32ed514a1a40e4a8b02ef61b694122ffdfb90b3d541710537e9ce3e5f43f8be2ccaede9f9df694fb79c7ad9cd9a250f20999472bd4e0c5a10542ce5aefdd240b85aa4be1785d5816d183fc34dc869c389a7b2285fde6d5772f4535e0cac5a9fca3db002010008000f004116000000013300f6a2cc7b51211fc6aadf5449811b32c5b8b0edac2c748546726070e983eae1c2f914c30875ccc3dc28f10b7c38398aa7ab5f2a771b7831fe7c2b4bbbc126277c9799080dc8582a84fac48101c76cf1fb6363c918ea9d3ce7984dce54824a504b5b91a702c4ca9dbf40e18ec52b6477906dc3d6b350348b04263d8de0cc02390891612342d63821473c3b907d4290ff43b13fe53fd33c23d22a3d8b7a1f50cc9d1c52288542581953220b01939e759d87c2aa06de4e65c820a2984b2a67e0790e3367ab729593e07c3806af2f88c64ed5884ff0bb8b72fce46309fa3fbdc931b7be8b5e22ba709fe241f6bdfec20c59098585bb74fec0a3358b360724c4002a00679632b69aec69ee958a527e47682c924173c55e0448b48ba077ed14f54af8b21486fc30d58e50d60b9ee3edb6fa0b76101deba6dbaf0f21a170a57fe59e5c3f301d235fc128510655decfa6075f6fe9499bff1a7b9ac94dc514692f6b7f3ce9c8ee85d046e852ef49edfe0dcbdd1d0d0b9c43ce7da4e40f555b8de7311169d0d1f4069daa72bc07874427ea145e97afee8346263cb4681da3ec2aa92714b6843825efd870fac2fc6bb7a510ece1fd05dfe72cfd1049f119616f4a140002100008000d00ac14142b100036002f6465762f6b766d00000000e01c42060e1361058bf3930aa3bcf6742d611ab497a06ec1aae8bbebc2593d22354ecc5ac945accf9b97d7ecfe59ec93fd94dbbd39d6eb113eab81746b0bc096872b7a5aab374e06b77014690ecf6009496f26c76e847eee8979c95b7f7bd8541be15b980ba411fa94d7c371a928b341e3bf15108fc2fb9a024c809c2259818eb0f37b5463fdb6fb127dc556dc98f4c2303b4ff6b9c9d233b14202c21640a9e0e9338e4e4bb6dd6fb701bab85f4d899b10006f002f6465762f6b766d0000000008007f00ac1e0001451348c6484d13b0ac9bc51fc9bac33bad69a9cf3321c751379c43836a3ec625da0bacbba2216084d251e702b55c597715426d1c9c0553251c4014314c9fdb25dcbf3026f5e57bb7857b6ed6a2a2015f208643ae6d5f1b709b16edfd6290d7367c11e52065045e28907457f640851a9904fa57fcbbfc7b22f9285ebeb4328ec480a1cb28992e83c3ba48e7a065e3c63090d8f80ffe84cf7e3c7c8aa71762bd254202f870179420d6e81ad71676affdf8b0912455cac8054eecc2017652809c188856730091bba1d54a09492c6c24850a9fded29530b8bd22b7bafed4da69fe5ad87ee05d80a056bc8cb9b8f2ade17aa972efc2"], 0x15f8}, 0x1, 0x0, 0x0, 0x8000}, 0x20000014) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2654.333114] binder: 8246:8309 unknown command 116 [ 2654.359913] binder: 8246:8309 ioctl c0306201 200002c0 returned -22 [ 2654.393723] binder: 8246:8322 IncRefs 0 refcount change on invalid ref 0 ret -22 14:47:30 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001, 0x10000]) [ 2654.425543] binder: 8246:8322 unknown command 116 [ 2654.436013] binder: 8246:8322 ioctl c0306201 200002c0 returned -22 14:47:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000007a000000e0"], 0x0, 0x0, 0x0}) 14:47:31 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001]) 14:47:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:31 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f00000000c0), &(0x7f0000000000)=0x68) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) listen(r1, 0x3) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:31 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2654.944864] binder: 8539:8540 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2654.969243] binder: 8539:8540 unknown command 122 [ 2654.975379] binder: 8539:8540 ioctl c0306201 200002c0 returned -22 [ 2655.000338] binder: 8539:8588 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2655.035404] binder: 8539:8588 unknown command 122 14:47:31 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8, 0xffffffffffff8001]) 14:47:31 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0\x00', 0x0, 0x0) ioctl$NBD_SET_TIMEOUT(r5, 0xab09, 0x4) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0xfffe0000000000, 0x81, 0x8000, 0x1, 0x357}) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x4, 0x0, 0x0) [ 2655.053917] binder: 8539:8588 ioctl c0306201 200002c0 returned -22 14:47:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000008000a0000000e0"], 0x0, 0x0, 0x0}) 14:47:31 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x8]) [ 2655.240117] binder: 8755:8756 unknown command 160 [ 2655.245267] binder: 8755:8756 ioctl c0306201 200002c0 returned -22 [ 2655.275357] binder: 8755:8759 unknown command 160 [ 2655.307839] binder: 8755:8759 ioctl c0306201 200002c0 returned -22 14:47:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000001a0000000e0"], 0x0, 0x0, 0x0}) [ 2655.528173] binder: 8965:8967 unknown command 160 [ 2655.533093] binder: 8965:8967 ioctl c0306201 200002c0 returned -22 [ 2655.575219] binder: 8965:8969 unknown command 160 [ 2655.595844] binder: 8965:8969 ioctl c0306201 200002c0 returned -22 14:47:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:31 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2]) 14:47:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:31 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r0) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000002a0000000e0"], 0x0, 0x0, 0x0}) [ 2655.860965] binder: 8974:8979 unknown command 160 14:47:32 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2655.883731] binder: 8974:8979 ioctl c0306201 200002c0 returned -22 [ 2655.909960] binder: 8974:9019 unknown command 160 14:47:32 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2]) [ 2655.930444] binder: 8974:9019 ioctl c0306201 200002c0 returned -22 14:47:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000004a0000000e0"], 0x0, 0x0, 0x0}) 14:47:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:32 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:32 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:32 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2]) [ 2656.082066] binder: 9198:9199 unknown command 160 [ 2656.094532] binder: 9198:9199 ioctl c0306201 200002c0 returned -22 [ 2656.163428] binder: 9198:9205 unknown command 160 [ 2656.175716] binder: 9198:9205 ioctl c0306201 200002c0 returned -22 14:47:32 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000008a0000000e0"], 0x0, 0x0, 0x0}) 14:47:32 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x0]) 14:47:32 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:32 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="c6c7d2f5f62a210c9bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) ioctl$KVM_TRANSLATE(r4, 0xc018ae85, &(0x7f0000000040)={0x1f004, 0x5000, 0x2, 0x5, 0x10001}) set_robust_list(&(0x7f00000001c0)={&(0x7f0000000140)={&(0x7f0000000100)}, 0xb83, &(0x7f0000000180)}, 0x18) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2656.605994] binder: 9419:9424 unknown command 160 14:47:32 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2656.627453] binder: 9419:9424 ioctl c0306201 200002c0 returned -22 [ 2656.646316] binder: 9419:9429 unknown command 160 [ 2656.658731] binder: 9419:9429 ioctl c0306201 200002c0 returned -22 14:47:32 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x0]) 14:47:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000008010a0000000e0"], 0x0, 0x0, 0x0}) 14:47:32 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x2, 0x0]) 14:47:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0xe1b, &(0x7f0000000000)="0ab172974f123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2656.964720] binder: 9641:9646 unknown command 160 [ 2657.000662] binder: 9641:9646 ioctl c0306201 200002c0 returned -22 [ 2657.031406] binder: 9641:9666 unknown command 160 [ 2657.036323] binder: 9641:9666 ioctl c0306201 200002c0 returned -22 14:47:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:33 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:33 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x8]) 14:47:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000022a0000000e0"], 0x0, 0x0, 0x0}) 14:47:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x8001, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x101401, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f00000012c0)={0x0, 0x6, 0xfffffffffffffff7, 0x9, 0x3, 0x3}, &(0x7f0000001300)=0x14) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000001340)={r3, @in6={{0xa, 0x4e24, 0x80000000, @loopback, 0x9}}}, &(0x7f0000001400)=0x84) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_read_part_table(0xa4, 0x3, &(0x7f0000001240)=[{&(0x7f00000000c0)="e45ebe92c14ade52ba0a39dcf1395620bf2e6f120179b3bc2a0b50134edd6d38ee00b124d586ef7d0035540768ca050cf6352bd3f7ed4659247f496f5f64f5ee7be89f710a5822566d652358842901bac60d0c8f0f7cc52f5594d5bbf75f851f45d23e7585e304911823f43a2a054513", 0x70, 0x8}, {&(0x7f0000000140)="df594147188930f73bff87d046e007c8936ab5926db2b2e4d44f7a4f2b4d8a7373b540399c2059088ee0bce0a2593f9bc48f2b0fa4055b06ac8398cd32b5df809592ec80d8cfc851b6966edd4e3e7d3b40ac9a01e3b85ee81b35148247c4e718361602ff2f2cbced761394424d78d77664c9d3f820b8c68d7bf54a9d79192d6e093e79e462f94932c60929e74a8f9925dc29d47343f381380ccbc93d2d73495905df69f6b577438577dadd780658d1cd9aba7f077f14a03a18c9a4b157788387776ca9af790498e0665c27fe724130b29e9131ac3ad3a2c590f2c5c349e9794cfcff715f4cb02019b1ee5c84df2b69e9ab3e66ea41119b2dafe84fcfafee53e740358e6769756df62b53a3fbd22bf22417a0722dab7cbc0a0b906748fbfd12ef2316e467263fb5bbcf29248bf61713e0ad70f1573ca19f481e409c89d1f909dc1546da93c025335fa440ba5335ded1d6d18bc5072e994f54d98b626df375184071f08b4c6cf2778332ada82904ccf03db024af5e2280566a7735ad5d36c827b41f450c887f80aeca2d14662a4ed2bcae99f45e1a14edecc696f90202607c12ab20bcc415fcf42defd2d1ad2a8a71f674698c8d9f25e080f4ee093012b19b0131f7b734e5eace7bf6f6ececcebbf30db7a4985e4c819bbdc571e8a6802678639c05bb49dfa454d112aaefb1588594c7cb0607384d51860740d9df5e6e8659de2514b68e79381f7ed31caf9973a535ded1e7758996cf347a7aec617f77f2c0714c4996e9e18d1072aa85f42fd852541f695c893a3dec50407082dd36b39b72dd43364245ad4f9b26bf8ef17f110eb5fd9bf4383a14bdc56a47f2aa9bf16cd18db13012d2de905e908b53605ca84dfa3eabaa2683f9ff1fd64bd2adfcd4768e4063f2f05e4b7f7b89e44b34154fb67564eb444b54b18eda875b4ec6e199df2e535241867537eadd3ea35c05d65141ddb75257babda7cd5bdd4825e654f4ee718a2c8a6b8bbccce1cdf607834b7d8b881166fbcbb0549eb05cf6ec418966e7e96116f61e7cc146cbcd83ce9ad0f010bf9d40c6da2f8cd3268cddde732ddecbceedccab70fdeec5940b7e1bb75865c7572678df93be0e8dd859979dc061f0eb28bd563d9025039b6814e0d61360f2b8237210dd7a4324b42fd6029d4ab779c1cca01c68cde987ed0d69f25fde6115de045c88819c2d87bfebc9d6a7ddc12e00629c3dd1839fa4892bbc969a96a56d1c5ff6a452a23f7d5b4c699c1bbaa858a560e962c28f8eaa38b5daa675f739f3eb896feed3e3489bed1fc4a825e7bde749c05279321ede15d6c13a2c9b091a1777b10524dd078da3d03931182fbe72c9c7591d2943e3072a9945de10f5ce1058c0deae3a513acaad3d224c452bb5e08245b33d31ab075430d54c7b8a0a526cd838a498fa0b553891ae3391647cd19d306c236bbefc8aef2b8100155faf8b9eb750c1435658381022ce4589fa884bca0900c9891e301478a9dc08cf50838a8f1de3f8e061ee9cdda69e582d85c97c93866a1cc078cb275ae879864280f24ea33c0d8997a723a11b3a0df44e43d2be4de86ebc29703f0f1565a63ebfe58640516664de3483b35a196ed804a5a8f71a0d982d8eab3f3b3c83cd8ecdf7ee904b92fbacc5c946ecfccc7bfa79255d83abaad466c8cca5311991983613de5299a5f9cc9c465c46b16d339bdb40082cd637fa86e805633636afe51e0261c584788b67c0c40505c850c6dc06497091b1bdf2a286e70142a02bb0854a29c6069779410497f7a99f817c00b8e20b5da7c950eceb4c078bf6da80808c226eedd6ed6a5223de0d2476c378ba31bd865e493a4603808c29daeecec2e4f4dc039b3b917dd4c85591122f84eae069175a39ffbb910df07606440fd67f6b5d24716cdbfc20996da446085c8652fab32d0e066321f31f2d6e0bfb564317218fe0cf187369fa2a23154095350903fe1da33e00d55da6e7313d8e22357214d85db4d7ede47cbb570dc5bca09e88b97e6038fd64d0943947c554c74ce23114d583ba88636b853be5c088d9c2514e425ea0508300ea85305ad3f92f38842dca5111bcc797d6a3c27ca417e6dfa9b6d8762d416b6bfde13e21e40d20ae67c757de7015bb241706a8f6e68d1056ef1684734b7369ed6e2c7e37294e584923d19f5b158ea4458943d26a0363fd0cafd4e10e235c5ca00605acdd1cea382b4db9a67fe4cb02656e3f08565c416bd7153f088d9131fe4fe067465e560e09ce43db8c3e113e64d5c30a0efee6291b9e3f1a2bb8fc0c5703d158cebdcadac7b1c659104126352d246513ad91d77e304e52af7b27435d265813fcb4c43424decab3651d7ca8faac0e5059e7350414356e83230ff27ffc0d0472aef94fde77e27c1869b01366dabe3fe5c2e3dc83d2dd5ff305d3300f90afd6a73d4389cd2f450232915d58c4478e43e670c682c138d864bc3888e4c0eac06c3fcdbed014d2a5911ee5f25c43bb0e625a8d2cd11c90d3eaf453c324596a8ee1819ab152cb4c56ddfc202f160b8286474008d17704c595b490d53ed3f7f1cead71607acdf1ec686142e584c72d26be22247e91149ee1f03df49e7f83862d3c94162c31abdc4342ad7841f08ed7bbf805e75aa94af54eb7a850c0db44201c9c0c9f13f6fa4aedb41279c09ab7db6bfa2df13cabf19cd8fe3d743e1342ffac94765eab162d1e00591e1d1593700447f962e990d07d1ac6360d4f9d4686940233abcae266d8ac0b594445038f6d16f168e801934866f3247f3f026a64634175e02261d9e2114a8ece33a20b266211dea9233fa168679e0ec57a0c368f7bfc034764a08c58f7bf4f5a0dd6d110e59997d7a5e9fb25cb96d072441ad76453944020def693d5f125e4ddb51b092946dee2cefa66bd7f72dba40ea72b3e7fd0668f8271cd7162a57134fe1ae25b26508fbe88a55134dc1fe5d7cb12181b5bb1089892bb0363a07522be8f57044b7cf0984152539abf231739ed9a31c4fcb43b0140a866326692d2994d98da79f01cf1d3c461254f727dfa5d48fa64e65acebe14380b00339e19c7dbd4034cf61bbef80e021202b56702736e89d86f5e25a225a20397dac92fee278c23957ae9dbdc57c5f8d8f6b5d8e04c02c8aa995f70bc8b796df43940cf511241bad5469813ac8a996e9945350e6ab98f7bdd20e21e336ac03737bc1ff4669d8b7cd879e029b23776a81197bd88c25d0cf5bede31e5c390e1a69c4a54e24a0343784c8aaecaebcb2d538005a1d96f58c40243d1baef3938d68db87538aa464da221a7413989974317f5d368e194f323dd4998bb526a3fe73a502bc8730f04f0f18b68e9f80a779f6d16fbec492f34bd06f5a884abc76fd65b2623d3ee4c12ee648fca9652f313c0bd8888e96e03dd96982e0228afb8c314e2a271d385ca3f6ee7c6a93c496a22fbe4d25a307fc5b2b7a8cb12f7ea769e45264b96292fe713dfb7b03750b04eb379e09b087e34737ae37544cbe53bc420fd736104770aacd22a39b6da2359f92897f7749be675ebc0edea3ff74a85ac56ab372de5f8f14c3b89bae99afa36758f37b1ba99204cf0728163c18a271726b0463aaa54db7a23616f68663a03e2c052d9814a8e9ddd9c493e28c3b74ff4122e2c400d76e1de83eabae79335e6dce1524a1780b0f817a011e45c679bb477c80493465e5974f53a8bb27338566e8c624fd87e12f615c399db9ac164cf83c15c5e0ce08ef5f27f1e215aa1e3aac48dd40e4eb929208a906ebfed937237f5d5d1c4795040f9565ad1a94fcb9648e484d60852d26a47c20862e92446b2d9c158a51c2a94778e5d931f3ad4763823164367663687789f31e852ff4ccc51e2fb4d648ab4ba88013ae4c74613310d1e45d557b6f3c1d58754e988a63072341ac17e27b83dcf0275cf848fb39cc2ee8cee6543a465ad49309b60f3c0aa139258f81fd89b323a4894634f3b18fea4f93c7302f37e763f12a109b45b70633713ff99749e4ccc477683cf6d2faf8af8fd095062a09cc79bd953acef493d7a35c4b41705104b12814f3cd0ed7d3e9c6134e17bdd2a007b3b57f616fdb89798a73217885450f3317e1b5c4af70e9c1e130eee7d4ead278b60609396ccef76e65ce5b565b3c70de5db729f5834d7bc610e3bb4707e6c14db6f24a8dbea4ef5869863529a4ec3bd42a3fe33bbd20d52dbb0af9cd1ccd04489418f63d78dc8dd41ca1fbdcfdeb33ec15caa4b8d7dfa4063dc96e734ef6025483d4272703ec25ede423436cefd986b989633a90d1e29f68df71c71642ba0239c0f2933f49436475c67d5e677640389cbb043725f8273d2775b4ae20847d3527bcd43c7c9d7ca1f8d4270de773822f0f1d8438aabb68786aa1a113659929c354341e35cf9ba2d1d99c9f0478efcb94cd4f581d145f82bd3f763cfbfea8d9547fdcd1b6f89c060fea15eeb5bf8a28e713b258f33713a5e2700ffe135f948a72a757b0db93ae7404cc5e1ca5de3907cda6799d7427219b7a95e7992cc9247051125658c6ab6f945bb18c9aaef2b3983005a3ac8989e16760069bfefd2defd9e9b3c559a13f654ada7143f7f325e2d2bdd24183781e3f6ae227e2574e44aa4ec01f7eb7d34dcfb3de8d4d5138cbd05b3da76883798cc42e71129758a18baa506eb3e03def6b16f084e3d40d0dec90948cbb7149e87c614cf0bbd958beb29decb39104350745ab182bf9fc83d452f6dd2880c04cf7eab901ddd509b61b6b4cfee16b2c75f9773335db8f8de34d2b5814ad90545b6b2e0886ec9df8856deadd2a11ef91d251c3138b9d5e689bbc8dfc228c78246617fbfc4d85fa39b9b5f5eec2004b04dc699e8ccaac25e13ff7aaa97947471ebffdc266996ca45c2eb1ac0842d447541ec8331bc5731df232daad2a293189374a15c583337e21c4caa26cd563aff3cb231df9556ad0ea89bd677272ff0d01a58b2e50b04f1cbba222dfd810b54b73d85accd4dd26d957e64dada9811b2d1dc6a8ad568b3b89ef70f8a840b291a8f499a3112831a376eaa8cc725677e63488f3d3699c9bec2e3feecdda1ab994ed20d467776148ff110d5dd525bc9dd1d8c96ba8fddf255f2e59b35b0713490921ac54e763fbc6eeefb2085d230b44d3b87ade6716db69d2aebaf154f99fe55a4e7e92e79ab4717d0ca31b46ecd42b05b6ccf3d8f859fa40b3030306bc410b314a495c60d2b5689e366a11479129781dc12dcf4d872506f5255dc704a580d47ccd7b65548f99753863094350a791779d0013af712317c5d8f4e95afe2173867ea90e6afe42b1db832d94008a8a2c85bc77524cbe6a31af47dad0e8ad1cfbfcf59664c2711edcc4b50b6ad857f118dfee6bc5014c71ee7047ccb0e11316c219e23d73668d440cfae6fd067a1feb6bd8e2a75ca1232cf28f91ba02d995fa62306199f9e29512ded7666d6227e1e3ccfd67773ea44c85a6cc3b1703549c19cffb6de157713ef6bd92f3ec6bbafc26d77e86a09a2fce74381a4801870aa9e8cd6ba387a8a8bdd22ddbeec672c7ff318a346205bfb88b63fbf16228e5fbda098ac0de96bb01fb2ea372264aaf96e769b31e33b21a86444b9bc7367340203ca2ee286988fd93c8c4ba6ad274b331143ffd95821d21d6c072982051d66b9eb13b74cb998ca1f6014446a353275d75078c2da602f6cd6472ea3eff618d574db68068ee86078c3eb65ce6fc5b6dcc10d057b675443cb514c0337566316957998a04095bb435cfd3d98f9da3e365cee3cbb030eb4b7b74cd8c52d7406908c1d12c7cb0cf88d", 0x1000, 0x9}, {&(0x7f0000001140)="08c33c041086d514d634f7500e5c31de4221f8507ba048238db4f99612152dd95830d410245aaeb187bb7f02e9581f91ce35d64533cd979278b3a3d40f6a5eb9122aa437d0050a3903c7b7c124a6e19fa2ea5309209eb2f1182da273fecaceb127f86bb1186a76ca9a80263ffca440290700e0a9e0ab2bc4fd01701ea40127ab6e87b9d4347e7b1e0d45764aaa42e9d099d76182aa41547d400a0096184f4152d04f1b28b85668a7266707aee5b3e9766663a542158975ef04c533e473842dd25cb9eaeeee00886bfa3d6c9b5db63ec21a934c0b6512", 0xd6, 0x8}]) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(r3, 0x4040ae72, &(0x7f0000000000)={0x1, 0x4, 0x10001, 0x4, 0xdf}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2657.368780] binder: 9858:9865 unknown command 160 [ 2657.382075] binder: 9858:9865 ioctl c0306201 200002c0 returned -22 14:47:33 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x8]) 14:47:33 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2657.434115] binder: 9858:9913 unknown command 160 14:47:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2657.512808] binder: 9858:9913 ioctl c0306201 200002c0 returned -22 14:47:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440007fffffff000000e0"], 0x0, 0x0, 0x0}) 14:47:33 executing program 2: mkdir(0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000200)=[0x0]) [ 2657.745905] binder: 10091:10161 unknown command 255 [ 2657.753069] binder: 10091:10161 ioctl c0306201 200002c0 returned -22 [ 2657.765809] binder: 10091:10190 unknown command 255 [ 2657.781218] binder: 10091:10190 ioctl c0306201 200002c0 returned -22 14:47:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:34 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:34 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r4, 0xc10c5541, &(0x7f00000000c0)={0x9, 0x2, 0x6, 0x0, 0x0, [], [], [], 0x8001, 0x7}) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000020000000000e0"], 0x0, 0x0, 0x0}) [ 2658.091864] binder_thread_write: 16 callbacks suppressed [ 2658.091879] binder: 10197:10206 IncRefs 0 refcount change on invalid ref 131072 ret -22 [ 2658.130078] binder: 10197:10206 unknown command 0 [ 2658.142756] binder: 10197:10206 ioctl c0306201 200002c0 returned -22 14:47:34 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2658.189110] binder: 10197:10336 IncRefs 0 refcount change on invalid ref 131072 ret -22 [ 2658.207457] binder: 10197:10336 unknown command 0 [ 2658.228585] binder: 10197:10336 ioctl c0306201 200002c0 returned -22 14:47:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:34 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x100, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r4, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f0000000140)={0x210, r5, 0x800, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x4c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x177b4135}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x758e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}]}]}, @TIPC_NLA_LINK={0x2c, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}]}, @TIPC_NLA_LINK={0xac, 0x4, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffe}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xaa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x36ee5b53}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0x48, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffff9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x101}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x243}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xbec}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x198}]}]}, 0x210}, 0x1, 0x0, 0x0, 0x1}, 0x400c000) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000030000000000e0"], 0x0, 0x0, 0x0}) 14:47:34 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2658.439501] binder: 10416:10418 IncRefs 0 refcount change on invalid ref 196608 ret -22 [ 2658.487631] binder: 10416:10418 unknown command 0 [ 2658.507941] binder: 10416:10418 ioctl c0306201 200002c0 returned -22 14:47:34 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2658.565979] binder: 10416:10599 IncRefs 0 refcount change on invalid ref 196608 ret -22 [ 2658.617764] binder: 10416:10599 unknown command 0 [ 2658.655059] binder: 10416:10599 ioctl c0306201 200002c0 returned -22 14:47:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:35 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:35 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) write(r2, &(0x7f00000000c0)="cb685d9f68b045fd2fc8dc589c593dddc55a6b93828aa419a4e1e38204b4da2fdb0ca285500fe678eeb0bbf4e0a81f4e7e99a4e84df2fce9ac7fcf526534b357347459cad98c9b03d5cc6ff14e10461746263939f9956cf5f6698f1ddd6d59470816969c6929fe14676977a5a416e57efc0f25aae99e78313c478b0f12654fc059335936a0fea41f095aa0d80ab1d82ef41e6d9d44501893fc", 0x99) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000040000000000e0"], 0x0, 0x0, 0x0}) 14:47:35 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2659.055603] binder: 10733:10741 IncRefs 0 refcount change on invalid ref 262144 ret -22 [ 2659.100747] binder: 10733:10741 unknown command 0 14:47:35 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2659.130423] binder: 10733:10741 ioctl c0306201 200002c0 returned -22 14:47:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2659.184179] binder: 10733:10921 IncRefs 0 refcount change on invalid ref 262144 ret -22 14:47:35 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f00000000c0)={0x4, 0x6, [{0x1, 0x0, 0x5}, {0x0, 0x0, 0x8}, {0x10000, 0x0, 0xfffffffffffffffd}, {0x8a8, 0x0, 0x4}]}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2659.281279] binder: 10733:10921 unknown command 0 14:47:35 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2659.350949] binder: 10733:10921 ioctl c0306201 200002c0 returned -22 14:47:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000050000000000e0"], 0x0, 0x0, 0x0}) [ 2659.592753] binder: 11104:11145 IncRefs 0 refcount change on invalid ref 327680 ret -22 [ 2659.648247] binder: 11104:11145 unknown command 0 [ 2659.660182] binder: 11104:11145 ioctl c0306201 200002c0 returned -22 [ 2659.733526] binder: 11104:11234 IncRefs 0 refcount change on invalid ref 327680 ret -22 [ 2659.773697] binder: 11104:11234 unknown command 0 [ 2659.792541] binder: 11104:11234 ioctl c0306201 200002c0 returned -22 14:47:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:36 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xbb, 0x20000) write$FUSE_NOTIFY_STORE(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="2d00000004000000ef0675a72f5928fb1d350ef40b00000000000000000300000000000000387e6d420000000005000000000000000000000000f315ad1141a75028893af11aed97cdebd8a6dd2d54c97bdd4e73141bc419cbba93"], 0x2d) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r3, 0x80dc5521, &(0x7f0000000100)=""/49) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000060000000000e0"], 0x0, 0x0, 0x0}) [ 2660.032489] binder: 11282:11319 IncRefs 0 refcount change on invalid ref 393216 ret -22 [ 2660.065366] binder: 11282:11319 unknown command 0 [ 2660.101276] binder: 11282:11319 ioctl c0306201 200002c0 returned -22 14:47:36 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:36 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x2000, 0x0) ioctl$KVM_NMI(r3, 0xae9a) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x400, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2660.163393] binder: 11282:11488 IncRefs 0 refcount change on invalid ref 393216 ret -22 [ 2660.186625] binder: 11282:11488 unknown command 0 [ 2660.193412] binder: 11282:11488 ioctl c0306201 200002c0 returned -22 14:47:36 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000070000000000e0"], 0x0, 0x0, 0x0}) 14:47:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2660.494225] binder: 11707:11708 unknown command 0 [ 2660.526126] binder: 11707:11708 ioctl c0306201 200002c0 returned -22 [ 2660.555087] binder: 11707:11763 unknown command 0 [ 2660.572008] binder: 11707:11763 ioctl c0306201 200002c0 returned -22 14:47:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:36 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) close(r1) fanotify_init(0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x3, 0x2) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) r5 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) ioctl$VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000180)={0xd700, 0x0, 0x4, 0x10800, {r3, r4/1000+30000}, {0x2, 0x2, 0x8000, 0x1, 0x4, 0x4b5, "45842943"}, 0x3261fcfa, 0x3, @planes=&(0x7f0000000140)={0x3, 0x0, @fd=r5, 0xb22d}, 0x4}) 14:47:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000a0000000000e0"], 0x0, 0x0, 0x0}) [ 2660.854944] binder: 11814:11816 unknown command 0 [ 2660.880603] binder: 11814:11816 ioctl c0306201 200002c0 returned -22 [ 2660.948627] binder: 11814:11843 unknown command 0 [ 2660.963355] binder: 11814:11843 ioctl c0306201 200002c0 returned -22 14:47:37 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e21, @broadcast}}, [0xfffffffffffffffc, 0x8, 0xff, 0xffffffffffffff61, 0xae, 0xb80, 0x7, 0x3, 0x3, 0xe6a, 0xfff, 0xfffffffffffffffb, 0x7f, 0x9]}, &(0x7f0000000000)=0x100) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000001c0)={r4, 0x6}, 0x8) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:37 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000120000000000e0"], 0x0, 0x0, 0x0}) 14:47:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2661.170646] binder: 11930:11935 unknown command 0 14:47:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x4, 0x802) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2661.191744] binder: 11930:11935 ioctl c0306201 200002c0 returned -22 [ 2661.219764] binder: 11930:11979 unknown command 0 [ 2661.225620] binder: 11930:11979 ioctl c0306201 200002c0 returned -22 14:47:37 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000480000000000e0"], 0x0, 0x0, 0x0}) 14:47:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:37 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)="485dbf1cf99ce4271692c04d213548cdee233af74abe2c83f2192f401920a91c7e0cdb957f7c382f89371aef00a8cc4a1c0e79e673e6ad47896b5b9134eff871a8a4f644c662fec0c31e7558a3dc612f947c4e8089ef1b48d6d3af6c5709ea3b0f2dcec830ebe93d978a8fd50ea68a3dfe9c93ddbe5f05d832eb1541ca58c9e551e014ddbd02f949e2844277f09eabb67c25d44a475215773454f6077f9c047ed2605617188978d2de527581b8ffc2f82937833cd14f0ea8f733be53871099ff0ff9c281b0d41217de9853d7a9cb3bf9e87b69", 0xd3}], 0x1, 0x4) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f00000000c0)={'security\x00'}, &(0x7f0000000000)=0x54) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2661.629059] binder: 12255:12265 unknown command 0 [ 2661.659683] binder: 12255:12265 ioctl c0306201 200002c0 returned -22 [ 2661.678441] binder: 12255:12378 unknown command 0 [ 2661.732447] binder: 12255:12378 ioctl c0306201 200002c0 returned -22 14:47:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000004c0000000000e0"], 0x0, 0x0, 0x0}) 14:47:37 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:37 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) r5 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x0, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r5, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r6, 0x0, 0x70bd27, 0x25dfdbfb, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x4}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x24040014) set_tid_address(&(0x7f0000000000)) 14:47:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)="485dbf1cf99ce4271692c04d213548cdee233af74abe2c83f2192f401920a91c7e0cdb957f7c382f89371aef00a8cc4a1c0e79e673e6ad47896b5b9134eff871a8a4f644c662fec0c31e7558a3dc612f947c4e8089ef1b48d6d3af6c5709ea3b0f2dcec830ebe93d978a8fd50ea68a3dfe9c93ddbe5f05d832eb1541ca58c9e551e014ddbd02f949e2844277f09eabb67c25d44a475215773454f6077f9c047ed2605617188978d2de527581b8ffc2f82937833cd14f0ea8f733be53871099ff0ff9c281b0d41217de9853d7a9cb3bf9e87b69", 0xd3}], 0x1, 0x4) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2661.918292] binder: 12684:12685 unknown command 0 [ 2661.945187] binder: 12684:12685 ioctl c0306201 200002c0 returned -22 [ 2661.985329] binder: 12684:12766 unknown command 0 [ 2662.036818] binder: 12684:12766 ioctl c0306201 200002c0 returned -22 14:47:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000600000000000e0"], 0x0, 0x0, 0x0}) [ 2662.190586] binder: 13003:13004 unknown command 0 [ 2662.211643] binder: 13003:13004 ioctl c0306201 200002c0 returned -22 [ 2662.224033] binder: 13003:13007 unknown command 0 [ 2662.230263] binder: 13003:13007 ioctl c0306201 200002c0 returned -22 14:47:38 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:38 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:38 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) fstat(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) close(r5) fchownat(r5, &(0x7f00000000c0)='./file0\x00', r6, r7, 0x1000) 14:47:38 executing program 2: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000680000000000e0"], 0x0, 0x0, 0x0}) [ 2662.379968] binder: 13013:13019 unknown command 0 [ 2662.392898] binder: 13013:13019 ioctl c0306201 200002c0 returned -22 [ 2662.425026] binder: 13013:13063 unknown command 0 14:47:38 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2662.446578] binder: 13013:13063 ioctl c0306201 200002c0 returned -22 14:47:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000006c0000000000e0"], 0x0, 0x0, 0x0}) [ 2662.610264] binder: 13233:13235 unknown command 0 [ 2662.622060] binder: 13233:13235 ioctl c0306201 200002c0 returned -22 14:47:38 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r2, 0xae00, 0x0) [ 2662.652285] binder: 13233:13249 unknown command 0 [ 2662.671009] binder: 13233:13249 ioctl c0306201 200002c0 returned -22 14:47:38 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000740000000000e0"], 0x0, 0x0, 0x0}) [ 2662.831471] binder: 13342:13343 unknown command 0 [ 2662.853656] binder: 13342:13343 ioctl c0306201 200002c0 returned -22 [ 2662.885608] binder: 13342:13347 unknown command 0 [ 2662.898712] binder: 13342:13347 ioctl c0306201 200002c0 returned -22 14:47:39 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000007a0000000000e0"], 0x0, 0x0, 0x0}) 14:47:39 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f00000000c0)) lsetxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='security.evm\x00', &(0x7f00000001c0)=@ng={0x4, 0x0, "e9c9a433b7a4b658ae588150ed588d0b3d58"}, 0x14, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x800000, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319b") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:39 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2663.263244] binder_thread_write: 18 callbacks suppressed [ 2663.263259] binder: 13453:13461 IncRefs 0 refcount change on invalid ref 7995392 ret -22 [ 2663.317485] binder: 13453:13461 unknown command 0 [ 2663.322571] binder: 13453:13461 ioctl c0306201 200002c0 returned -22 14:47:39 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:39 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xd76, 0x400040) ioctl$TCGETS2(r1, 0x802c542a, &(0x7f00000000c0)) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2663.422287] binder: 13453:13647 IncRefs 0 refcount change on invalid ref 7995392 ret -22 [ 2663.514888] binder: 13453:13647 unknown command 0 14:47:39 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2663.558077] binder: 13453:13647 ioctl c0306201 200002c0 returned -22 14:47:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000a00100000000e0"], 0x0, 0x0, 0x0}) 14:47:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:39 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r3) fanotify_init(0x0, 0x0) r4 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) timerfd_settime(r4, 0x1, &(0x7f00000000c0)={{}, {0x0, 0x1c9c380}}, &(0x7f0000000100)) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2663.713920] binder: 13879:13880 IncRefs 0 refcount change on invalid ref 27262976 ret -22 14:47:39 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2663.817079] binder: 13879:13880 unknown command 0 [ 2663.841527] binder: 13879:13880 ioctl c0306201 200002c0 returned -22 [ 2663.869992] binder: 13879:13993 IncRefs 0 refcount change on invalid ref 27262976 ret -22 14:47:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:40 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2663.936928] binder: 13879:13993 unknown command 0 [ 2663.942070] binder: 13879:13993 ioctl c0306201 200002c0 returned -22 14:47:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319b") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:40 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x3ff, 0x400000) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f00000000c0)={{0xa9e, 0x4}, {0x1, 0x2c7}, 0x2b3c62ea, 0x4, 0x8001}) recvmmsg(r0, &(0x7f0000006ac0)=[{{&(0x7f0000000140)=@rc, 0x80, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/84, 0x54}, {&(0x7f0000000240)=""/44, 0x2c}, {&(0x7f0000000280)=""/162, 0xa2}, {&(0x7f0000000340)=""/18, 0x12}], 0x4, &(0x7f00000003c0)=""/223, 0xdf}, 0x8e}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000004c0)=""/137, 0x89}, {&(0x7f0000000580)=""/126, 0x7e}, {&(0x7f0000000600)=""/30, 0x1e}], 0x3, &(0x7f0000000680)=""/195, 0xc3}, 0x9}, {{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000780)=""/27, 0x1b}, {&(0x7f00000007c0)=""/99, 0x63}, {&(0x7f0000000840)=""/235, 0xeb}, {&(0x7f0000000940)=""/249, 0xf9}, {&(0x7f0000000a40)=""/99, 0x63}, {&(0x7f0000000ac0)=""/187, 0xbb}, {&(0x7f0000000b80)=""/228, 0xe4}, {&(0x7f0000000c80)=""/3, 0x3}, {&(0x7f0000000cc0)=""/228, 0xe4}], 0x9, &(0x7f0000000e80)=""/4096, 0x1000}, 0x2}, {{&(0x7f0000001e80)=@nfc_llcp, 0x80, &(0x7f0000002380)=[{&(0x7f0000001f00)=""/177, 0xb1}, {&(0x7f0000001fc0)=""/242, 0xf2}, {&(0x7f00000020c0)=""/160, 0xa0}, {&(0x7f0000002180)=""/195, 0xc3}, {&(0x7f0000002280)=""/83, 0x53}, {&(0x7f0000002300)=""/68, 0x44}], 0x6, &(0x7f0000002400)=""/102, 0x66}, 0xfffffffffffffffe}, {{&(0x7f0000002480)=@sco, 0x80, &(0x7f0000002840)=[{&(0x7f0000002500)=""/17, 0x11}, {&(0x7f0000002540)=""/194, 0xc2}, {&(0x7f0000002640)=""/166, 0xa6}, {&(0x7f0000002700)=""/134, 0x86}, {&(0x7f00000027c0)=""/67, 0x43}], 0x5, &(0x7f00000028c0)=""/136, 0x88}, 0xffffffff80000000}, {{&(0x7f0000002980)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}}}, 0x80, &(0x7f0000003f40)=[{&(0x7f0000002a00)=""/195, 0xc3}, {&(0x7f0000002b00)=""/64, 0x40}, {&(0x7f0000002b40)=""/23, 0x17}, {&(0x7f0000002b80)=""/4096, 0x1000}, {&(0x7f0000003b80)=""/44, 0x2c}, {&(0x7f0000003bc0)=""/120, 0x78}, {&(0x7f0000003c40)=""/251, 0xfb}, {&(0x7f0000003d40)=""/229, 0xe5}, {&(0x7f0000003e40)=""/153, 0x99}, {&(0x7f0000003f00)=""/62, 0x3e}], 0xa}, 0x100000000}, {{&(0x7f0000004000)=@tipc, 0x80, &(0x7f0000004400)=[{&(0x7f0000004080)=""/13, 0xd}, {&(0x7f00000040c0)=""/194, 0xc2}, {&(0x7f00000041c0)=""/1, 0x1}, {&(0x7f0000004200)}, {&(0x7f0000004240)=""/16, 0x10}, {&(0x7f0000004280)=""/142, 0x8e}, {&(0x7f0000004340)=""/143, 0x8f}], 0x7, &(0x7f0000004480)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000005480)=@ethernet={0x0, @link_local}, 0x80, &(0x7f0000005640)=[{&(0x7f0000005500)=""/49, 0x31}, {&(0x7f0000005540)=""/97, 0x61}, {&(0x7f00000055c0)=""/97, 0x61}], 0x3, &(0x7f0000005680)=""/182, 0xb6}, 0x5}, {{&(0x7f0000005740)=@rc, 0x80, &(0x7f00000069c0)=[{&(0x7f00000057c0)=""/152, 0x98}, {&(0x7f0000005880)=""/4096, 0x1000}, {&(0x7f0000006880)=""/145, 0x91}, {&(0x7f0000006940)=""/106, 0x6a}], 0x4, &(0x7f0000006a00)=""/137, 0x89}, 0x8}], 0x9, 0x2043, &(0x7f0000006d00)={0x0, 0x989680}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) stat(&(0x7f0000006d40)='./file0\x00', &(0x7f0000006d80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r1, 0x400454ce, r5) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000004200)={0x103ff, 0x3, 0x5001, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) 14:47:40 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000a00200000000e0"], 0x0, 0x0, 0x0}) 14:47:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:40 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2664.360766] binder: 14207:14209 IncRefs 0 refcount change on invalid ref 44040192 ret -22 [ 2664.398496] binder: 14207:14209 unknown command 0 14:47:40 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2664.412876] binder: 14207:14209 ioctl c0306201 200002c0 returned -22 [ 2664.443207] binder: 14207:14317 IncRefs 0 refcount change on invalid ref 44040192 ret -22 14:47:40 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) r4 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x84, &(0x7f0000000140)=[@in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e24, 0x8, @empty, 0x7}, @in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e20, 0x100000000, @dev={0xfe, 0x80, [], 0xd}, 0xfffffffffffffff7}, @in={0x2, 0x4e23, @multicast1}, @in6={0xa, 0x4e20, 0x3f, @rand_addr="a07219fdf54594ed9312397a65c9037b", 0xc00000000000000}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000280)={r5, @in={{0x2, 0x4e22, @empty}}, 0x7fff, 0x5, 0x4, 0x5a, 0x2}, &(0x7f0000000340)=0x98) fanotify_init(0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x111400, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r8, 0x84, 0x1e, &(0x7f00000000c0)=0x7f, 0x4) syz_kvm_setup_cpu$x86(r1, r7, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r4, 0x84, 0x23, &(0x7f0000000380)={r6, 0x3f}, 0x8) ioctl$sock_rose_SIOCRSCLRRT(r4, 0x89e4) 14:47:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2664.502701] binder: 14207:14317 unknown command 0 14:47:40 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2664.557850] binder: 14207:14317 ioctl c0306201 200002c0 returned -22 14:47:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000300000000e0"], 0x0, 0x0, 0x0}) 14:47:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2664.719920] binder: 14449:14450 IncRefs 0 refcount change on invalid ref 50331648 ret -22 [ 2664.761410] binder: 14449:14450 unknown command 0 [ 2664.795932] binder: 14449:14450 ioctl c0306201 200002c0 returned -22 [ 2664.834740] binder: 14449:14555 IncRefs 0 refcount change on invalid ref 50331648 ret -22 [ 2664.867072] binder: 14449:14555 unknown command 0 [ 2664.900781] binder: 14449:14555 ioctl c0306201 200002c0 returned -22 14:47:41 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319b") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:41 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:41 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) nanosleep(&(0x7f00000001c0), &(0x7f0000000200)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x8}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000140)={r5, 0x3, 0x30}, &(0x7f0000000180)=0xc) fanotify_init(0x0, 0x0) mremap(&(0x7f0000013000/0x2000)=nil, 0x2000, 0x2000, 0x2, &(0x7f0000003000/0x2000)=nil) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000240)=0xffff) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000a00400000000e0"], 0x0, 0x0, 0x0}) 14:47:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:41 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2665.278103] binder: 14671:14675 IncRefs 0 refcount change on invalid ref 77594624 ret -22 [ 2665.300133] binder: 14671:14675 unknown command 0 14:47:41 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2665.327184] binder: 14671:14675 ioctl c0306201 200002c0 returned -22 14:47:41 executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x1, 0x2) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2665.374701] binder: 14671:14756 IncRefs 0 refcount change on invalid ref 77594624 ret -22 14:47:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2665.451565] binder: 14671:14756 unknown command 0 [ 2665.461764] binder: 14671:14756 ioctl c0306201 200002c0 returned -22 14:47:41 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000500000000e0"], 0x0, 0x0, 0x0}) 14:47:41 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2665.667314] binder: 14856:14900 unknown command 0 [ 2665.672407] binder: 14856:14900 ioctl c0306201 200002c0 returned -22 14:47:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:42 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x100, 0x0) getsockname$ax25(r5, &(0x7f00000000c0)={{0x3, @bcast}, [@bcast, @default, @bcast, @rose, @null, @default, @netrom, @netrom]}, &(0x7f0000000140)=0x48) 14:47:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000600000000e0"], 0x0, 0x0, 0x0}) 14:47:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd0") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:42 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2666.154367] binder: 15012:15016 unknown command 0 [ 2666.190187] binder: 15012:15016 ioctl c0306201 200002c0 returned -22 [ 2666.214526] binder: 15012:15047 unknown command 0 [ 2666.226753] binder: 15012:15047 ioctl c0306201 200002c0 returned -22 14:47:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000700000000e0"], 0x0, 0x0, 0x0}) 14:47:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2666.408636] binder: 15199:15228 unknown command 0 14:47:42 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) writev(r0, &(0x7f00000004c0)=[{&(0x7f00000000c0)="c93c189831a5ccaa12148a57e4e3372e12b9909315f6a5398b5c3bfb36ae57f2c2b5ad68f61190fbc2fa49323d281b8b8f2d29640e0b5a799edea679aa121f27afbf1e3a59eede3eea98ffc755e9fc0e9ed5b032d27eef95c558272f33d7f5d18707ee65f8d8d328bd67f27ebaf1f1f6f71d2b1e48", 0x75}, {&(0x7f0000000000)="a4", 0x1}, {&(0x7f0000000140)="ace5f2175563db05022b36e938ef4aaf0c8cd01af6bcdab22214d4cdac057c97caa9233f88c5d649d89cbfd94de23963a015ee110981142f0da2e7e2c379fdd34b1e24d2aa54579b8eb97bf27a6a77a6dacbd3d52fcc9679e6dd9228444b2647e84bdf34f2f459d5bd1b8f2d5be4ebf1c4156570b9263339abca40b40d7d4768bcfa415b9dedf5795d443692929bce7699b163c4326fb9f86bccf7ff0f763d52bea1297fa80645fe7a1cbc77", 0xac}, {&(0x7f0000000200)="6f7ed961a95bd4e780d4856274bfbd1bb21d3dbd22232f02dd058124586ee472940cbd4c9a8c78c299ef440ca822cade1cc91020844da58a410caa78863909cb2cc73889da78b4e7341e5ba1628390548af18016e3e4f1a24aac3a79e0c49513", 0x60}, {&(0x7f0000000280)="636323c136b0457dac", 0x9}, {&(0x7f00000002c0)="fc1f4e8857eee4d734a9c1c95a6f70d63f4224e4cbc82a7bd8795659b4bb2d680dbe2bafb10b78fe47b5cc74cfebf6686a175e6a805ad24e2dc527e16d93cf706ea07bb39c5460da9a821c02592100001356a82bce7e8b4abad0fca6d031a1", 0x5f}, {&(0x7f0000000340)="8ed261359fed068c6142ec97223af051461688d9ddcada3b07137782b95997677a609c5591e3d9abe67fba264aabe049fc3c8bbfb09a617467482768856adfd61740cb691dd78fed43a010daf5a7d000e41575a9ec4dbcd995d4d215b6746ba510053315d6a410f43fbbee1fbdac21c2ff003f333edd39a038b2e304e2750401da1f2b4b8f261ddd45ae56645dcdc392b20c0ba5100d55b15506b318be6b0ebd4e5831122242fb909f24bc9772e92651094b96", 0xb3}, {&(0x7f0000000400)="090627b05e1fc79705731a19b553cf19e1d052298171221fe7c8b01ca5a829a41c90dae1757460391417fd5082d6bead532ff05ecba582191f7a2d4bcd93113b8dbc97f1cf05277c98dd00cc6a57446294926dbb801e13db260fc87ce36ab7b31c132e4825b010200d3c706ae8332d356669f58305f2ec31ff72334e36cb21285cbf8979a8ff7170f3c894db707eb40a6f1f8ff676", 0x95}], 0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001980)='/dev/dsp\x00', 0x220c00, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r4, 0xc1205531, &(0x7f00000019c0)={0x3, 0x3060, 0xd, 0x0, [], [], [], 0x7, 0x5, 0x7fffffff, 0x7fbc629d, "6ffbdb8b1b6e2f9ce184c4a790ba62f7"}) close(r1) connect$tipc(r4, &(0x7f0000001b00)=@id={0x1e, 0x3, 0x3, {0x4e24, 0x1}}, 0x10) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) lstat(&(0x7f00000017c0)='./file0\x00', &(0x7f0000001800)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$ntfs(&(0x7f0000000540)='ntfs\x00', &(0x7f0000000580)='./file0\x00', 0x2, 0x3, &(0x7f0000001740)=[{&(0x7f00000005c0)="25711297e1c7191dcc6764b184eb045673c96684909d7cc037bbfe96fbffdf642980e73983dbb3bdf42a3ced43e583db3cc8861f76a6f163a8231521787fe0cf702e2fd513eb5a33795f22fc30ff1b7b9af3bd8be5dcebd4abcddf615005ef6229cfe39b4ed616b1a037982892c4cdaca3f32e08b74dff2bf38c050276a9d848c6ff8a9acceec9cb54c23a0973754e2160b4a598f45e99ad9c38b5057f396e028539b26a46e44e85f1603fdc66bfbcc2cc9494d21cdbeaec2277ad86209a51be7a885b69fe68e888fe331b197b376ba6f0c5ba815bfa8e4b6216d4625bd17b25cfa396a6bcab79c2e29aa8ff84c79cf4625afcc86fdb6bc6602718", 0xfb, 0x9}, {&(0x7f00000006c0)="507296de727ea51b7658498e56a283fe4fdd721dcf2c954e20be48ec6665f3c85b495e3b83fc7b5d05aa7644fb1bf0e931819af742fce55cb0a6cc1afcc4a6a6e65eaf64ea91738319bdf17963f645191b7c91ed812f068e159667d60f21aeb0c9619cd91ba6c3cb8a8b821204f0a15d0dc1d4ee0ec994a4190d2d949fecd7ee8354259493ae8258e9d2c5085ce4536c1098f07e44d07e6c81a51831c4a75272d6e89485fdbd6a33aa9e2bd143b9997bfd47744d0bffe31027d7e1dad9d6782064aeb3ed2d146d9399cd6de94a6e6423b100858f43cafd7293552e9334bc28c78368d48beaec170798ee82d5fec6f363b5d23378426a92e8c1259762c8685eba9e5f5c014827467e3af36ecbed6759b868038eaa0dbaa3552c966685fec08bb62c8544dc125232883a52bebb1fb49bbeea84a51ec4fca47acf769d3fd9d68c6e9e3bf1b986397268a92102700678752c36386fea1c6ee591dc55cd7e74896858b1fc44ab0b4d976b409a826c2c83ea14355afe189a5262c261858b62762e708996919d87ab03f3d1925df2b16fdbb55d0ef9fb16f73cd2987a6252a6d8cd13824124834bb1be2fa169b2a534ac5f9a0ffebcc47f5aa88a4995faa31b336d897d164c1d8bfeac367b39ba9caf867dcaa6281bfcb21921a1739610774631106deebe7def4f5a978d387c07cb7cb49570ce5f78c66d398724cc0c1727f0d88300a5cdfbb781fe33cad1c428e4542595fdf38cba3a47ed6a9ef4055b8dc08a68efb521676c77320beebf6fa7ced22bef854537887fd227746807eb952339e1ef573265a62f1ee0a6964c7a543e39333c3188360d165c7fe7608ab06546ede6542ac59ecc16e169c1895cea25e42321f788b736231a13d8a19bb8298886e8d21f4c465d9395821515b0676cd8ca867e6618a10a3088e0839060a3785e77ee7516829cbcbe5de5a86bc0eb556cdbb59c1de72effd312047bb84d4537d088b4555a0f64719b95e0251d7415d5180da80bd4ca963eeb3a2c5492505089674e3b9b5e6c4dfb4eb090619b7a8b465c18d42a847c7e87aefb331fd9040edd95388f23070847b6f3fdc32aa3bbcf6a38e86aaa72fffeec4248c381e144f2a9a603be2a9db561a13fa8685c5bfe37c17344d82eee8ca1b5a7f7af41307d82149d3a038f54b609ad0c136abe3e7c01f56d6b2200d4520c05981f7289738e587112b706a191f6cfe7930f5f84c6659a7e1e313454400c92c82c77239c0c17b6f350aae3e4acaeb53c7aff2c650a29d50ae744a69c6ede36ca03b2597eb9907fdd0917a45d0ad5b6ddfbea0f19f6f909c57bcf7e67ea42b8d42ba97a548dfc9c4123ea4f3f0475982b437e1d5212238ddfba3db437406e44be70b42f3388e0d69b607a83d77c5d6028db73e6304764e3ad7b18be1751bc7a46f664a8cd3333f4ed9803f0a13e07bea30af9adf14f7a6dc183c9e4eebe1606047b72576cb5ed50c90e531cd733ef164a0acd466fb75d7eac4655893cf444de7d9ef1c18afdcf954738b975e89cdd4a1fa5f65246cf68fa89e019ef980023168173794cf2e30b88191c5e44a5017a2007bc1a1da6544453805666dc9b9f85828a22dafcc922ba6af50cdebb9c43f62efa35a3a92f8bcc865ec123d6d36af2e63dbc4d27a1cd11146b2e212595f4a143ddfa21930015050ad41b434be18e930bc3f3586af67981a96f0b68b6d391b0e184eb0d123bdee9e7c225470c47c7bcacbb455657beedcb4c1666a210d48486ccd854f2c945e3ef4cae66e7f8eaef1d6891b0bbf77790ebdc42256a8ed599ed7838a4dc0c148d1e8860c94da00e886c0692b50f74653f94b23d49371e3efe2288a1995b9875e0cbc269d6b65ff1a1ca2d01843721d9c007e6e5fb81f1e8a8413f2c2e2e535c048815f1600de3fa651b64f81bd8162b4add468fc16f3df6a047da0a7e36a4f0adb276c1018708b6a4ff67624f7f9cffea46eef98315907a510126c2328b3658c75a7cde3ae40ca928e5acd5f1e4e5d9ac0de12398c4b22b8a73a0f250270b661dcf0781d65021fae700a6dcfc6cab068f6e771c8b22e4dcd75d7b9fd352dc315c1400c8a03fbcf6e024790dfc0ea91f5394dd376c092bb9f67cf926bb72bb61e8c3d6345a0c3f7eb2ba51cf8aae7182d563cd56c50a4403bfa6fa647bc0d5ed709ab05711a4d2791852c2a4e21e309a112a5fac4b188da48420984911d3618789cc746c7bfe6f5fad42e1f855c98f2055b66623e35a8edb4f01f209746b67693da3b562feb99942a423883691d6fb868ff976adf451ae220123be6ef2c9ca65a6b79fc958a55efb0da64b557cd6a25addfe7c84151e5e3ca5ba49713096ef535d68f3344e0d5285bf2f7ec4b3f31534275da2b597b0cca986730451cc442ab442a797c13d885db24ea0f4146c9d19ef71a6e823e01af52375070863f71a12ff4be2efce8268be84625ae89d7acf1cffecc70a0ca75cdc00ed0e1faeb1a53d35ebd9f29e5a43dc95acdcb9b673e2138973fc2e045680a1331ff6984cf11eae8787df37e89911ebd296cb6aeebce6b74e6f1a09bcbfc877642af9d7adb1f45a0e84f8ec84f35860546130dcdd9f68914f52d6e2da0f8bd3f3e6791b35eb1e0e7210a164cc0adc457df9b793a3c56ce2f85519e5dbcd8d8e332f1d5b2c129eea89a4185a3ffb9560368e08b6747e662f09fa58f5e80077e45c1e9548e5b1154c8325a067533b740f0006d3bccea9516faf5b444eeeb63ff6fac6ff5cadf306501abc3d4e03c27baa32c4ea6b202ae36f7592883658317a7efdfa28aa734a108ec7a2e867e9abe9d19a22dc6a58e39319fd453adc72e313e30f85881c1a28b128e45968a544f0b40504e699e41092977fea42ccfd8b630d6f66094cce0add7f4830587a7e0554787a8934c6d395b89c243ef5fffbc30b7eeec330116a3d41991713626fe3aafb7cbf5788a307d3bc5b13ada3612f598d1f1156d15b56974f5bca7912280a3ce74e0a86ae3748a6e35ca1e3d6ddf82ad74edf0523f31c0e649a5a53920570f77f9f06a785f2c13e4b4239fbb303c4a5588839e4572751c747e0edb8d56ec571e770d6919f008e9eae4136a1398bc44baeca505e02f9dd313a10bbac5211a64da850829a1d4f35ed83ee8ddf1432ea4354719dac5683595ee9f448152d31518ffe8f768ca4467e2749ed6a6cc51e6c7c08092577556c4e9aeed2e77765396e2b803598a23e034dd00e3ee55041fc1e3df4bd5d8c77eaeab054bd4cc192d98e3a13c0bfbd06fd603aa8f76fbad6409e5e1f4a9bef913c29cbafca9b6f21e4cd7e2bc902501d18afe50c5d9803db6c7b8a06d87dac65a751b978f990fe8696008a9d6ab5bd328a11ca7a62e43d76412c60bc89822a7c46833ac492e329c30ec6913bc22176d08de1d9f51be9c96e9bc230bff60331a05c9f7232a551bdf39f88b8fdb8dc9b143404f12fd930408eb849d5fcba63bd0aba3579bdbcb346439e58ce28f3474916959da29d1c0810c538ec74da3783b2b7797b478c6e7731f86e72e5d8b5a82cb40cf7d8c418fe426e221a5207e2eb9521ed2b303c9571900c2d72a8f1170a2b4b113bf7ec5d8242bbb428256b76305fa19ab140d75e59a28d90ffe1b89fef2177e30a1493c433de49c832bfb592beb9e6b171ab4b36be11a23e2a4947f1e4bdccfb940d5ec9c7e1a9fd57b1910ed887d83933d8963541f26c81b16c3e0cdc63454ab8e450f7e4d3cb832163970cd0be0a0195ef49c2933db8f54681d83712b6f050db3cd6e9d0d828bed1d10f2a8551873bcb23720d2f4c385146bead7e4d8cd4a72f5bce4552f51f23f816d70f0fadf66bcc544df953426899f53023074011f5536119d65ea08a233bc92f1d08f86b3c32a4013df7709b16362f6b14e1de09a478b7c78ac56a2a34bd14ca6e1299ff5306d33eb9b2d0d4b1349301c2de738b95af8bd9717237ab1bd179207241760c2528427508a80ad5536201d076ed114daed688352f643e6dd478d35452564c45a4d141f409dcda60109b58314e2c1f62ff65d8bb99b6a284300fbb32536d693a2a1a9683df46402d1b1828d8e72ab1178b260a41167b8683ef8bbea5299c98544e30fa0da29cb976ad5abe352456cad7bc6a3c3de6b87c6a7d565466cb7427a3f21a1b8b077259f2bdf63dfd9b117aa36a3720d7800b100bb9b4dc4c962a2ab3332661a8555e43d98b1fae95808ccd4138083646b73237c98395f9b2b9a631bd58788d26acb9876398e9cd05f13f7ec9f91e0c991d27c0de37d867ef6218127e6544ebe96cdb835ecabd7512834baeae3458f80218e9f35e8cfa0990bc269b7e46cb29489625b97b49739fa114ba8a8ca2c2cbe09211b8d00d40d7dc07f99fc8c72a1e14a3a79537db475eac09fa8201519caa060c071f49822aed5f133ac1404f2b9615510a46afb1a2b8ac4a5d98b44b661283e16188fce2433e934e178953b23c67e19f701d1313ee6c764519be103859458ed1d57b033fdf1973c8e210b1882d168773a4ca1ea8a8a09b57b032f49f87277954cf5403ef14a8cf0c739953dd9d0fb70dc2fe7d8c6a201b59738e70fdec0ab1a03a320f5dac8345a1514bd743cdf77f084a6fefbec917d2e9cc5c210d33b5640f7d92b02269bbdc2f77900605c4417fa64c73f9307d96156dafa4e626959fb92fbfd1a282c2d44d2192f8a51a00ac45fc6b2c5cf7812b2d98fd3890d1a7e5ffa637b0dcb613a3bdaa0d26c7bf46c309d702accf073dabebbde50344417ef1a8d90ed1caf4f011ccbfa3fad60724db63b9dcdcd07d162cb03d87c557f0da04088888b662802ac22aedc06abedd8edb1a2beb36dc5ee413b4816065372a3a719646deddf28ce743bfcd915e63e17a4d4e6bac358b9e9710689fe7440f1660e8af3e1628fa2e63daf309c0ea5c0e360b06bf95fd6f1c18ec8ff9bd8b2479e7de26329345ed084a104ab7f2c7dca0f8f9ac4e59b1df691be2a79c6c2807427f0bdd3885b5ed46122fe24611704f3c28bfbcd6686f4fa65f6756eea91bfb3d269cc28ab7572dad0cca2c3f9863d80d873df51872985cc2305854daeed431ad504663773334b0f1f133e5d3c9ba90095fcd91b82e9a48c6841894fc28d620e5cbe0e03098e1e3a76f2c0d03cf6468882d685d845c6d9c886a0294176e512e2e0027f34dac3b68cb87a7e9d7d9050b2219239b2e4103ffd520ccd6e5774c0d80a86e6e2ce4bc441c35c01aae20292d61484e153ddb15b939ea944db94f92b0ff8b8059568bf5b8b68cf724a36128943bad7639ba84c5da9ce6102451a27536c220b9ec684892dfb25aab3ba783103d60e0c97e9650a758dc75c1566375020035e687cb81ca5cf0bf838faa89ac1db03458077e8202a45d95e6ae879378050fd663a2148b2b6c5f644e2e73ca88fdf8984dddaa858935e397ce27239fcd0961c51739dd304a82f5094575faa525c617ffa5d04faee723f37a08c41db12febc8c4bec3dd0e4bdebcb28261480c8d2fdce5274b872da39211613e849abda8b68afe28e6971c55ffef5f5cb7242710136b2fdb46245e790833eaf6b440e60f69d7b30818cad2de1eba1378de76e30c3e0c5443b14671d9b3c381c8217d00b1656aac52f028230fa60aa94bb653f0b4269ad5daef3a35325b73cfe33d35ac68b8186f40b5fec170e645055e11fde4bc6052c59e3be4d89f25f1c3c60f2d9b0dbb3b77d2770f5c7343333f1f348ee7c1d8e47a8234f378b756fa88d0eb2f92cebc34111c084594abfcd2c16fdab7487ed51446e26a", 0x1000, 0x1}, {&(0x7f00000016c0)="de283055ac76e07673103eca763d2ea818df1667aaa95abec48837e129eb10ebed1266ce2c08970a8308d563d46906aaeb0b2f217f27f1837b9a467e9b841c19d94ff227886d0281ead53f84d0401e2c", 0x50, 0x7f}], 0x1002000, &(0x7f0000001880)={[{@nls={'nls', 0x3d, 'cp1250'}}, {@errors_recover='errors=recover'}, {@umask={'umask', 0x3d, 0x3}}, {@disable_sparse_yes='disable_sparse=yes'}], [{@obj_role={'obj_role', 0x3d, '/dev/kvm\x00'}}, {@appraise_type='appraise_type=imasig'}, {@context={'context', 0x3d, 'staff_u'}}, {@pcr={'pcr', 0x3d, 0x2e}}, {@euid_eq={'euid', 0x3d, r6}}, {@fsmagic={'fsmagic', 0x3d, 0x9}}, {@measure='measure'}, {@context={'context', 0x3d, 'unconfined_u'}}]}) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) [ 2666.441590] binder: 15199:15228 ioctl c0306201 200002c0 returned -22 [ 2666.494817] binder: 15199:15245 unknown command 0 [ 2666.517092] binder: 15199:15245 ioctl c0306201 200002c0 returned -22 14:47:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000a00800000000e0"], 0x0, 0x0, 0x0}) 14:47:42 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='wlan1wlan1\x82+userppp0-mime_typekeyring}GPL-(trusted\x00') r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x14, 0xc1003) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) 14:47:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2666.675048] binder: 15343:15346 unknown command 0 [ 2666.728185] binder: 15343:15346 ioctl c0306201 200002c0 returned -22 [ 2666.764704] binder: 15343:15352 unknown command 0 14:47:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) [ 2666.799004] binder: 15343:15352 ioctl c0306201 200002c0 returned -22 14:47:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd0") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:43 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:43 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000a00000000e0"], 0x0, 0x0, 0x0}) 14:47:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:43 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) [ 2667.224470] binder: 15569:15570 unknown command 0 14:47:43 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) [ 2667.261809] binder: 15569:15570 ioctl c0306201 200002c0 returned -22 [ 2667.322036] binder: 15569:15734 unknown command 0 14:47:43 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) prctl$PR_SET_TSC(0x1a, 0x2) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2667.348072] binder: 15569:15734 ioctl c0306201 200002c0 returned -22 14:47:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000630b00000000e0"], 0x0, 0x0, 0x0}) 14:47:43 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) [ 2667.575696] binder: 15833:15879 unknown command 0 [ 2667.597481] binder: 15833:15879 ioctl c0306201 200002c0 returned -22 [ 2667.630676] binder: 15833:15986 unknown command 0 14:47:43 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) [ 2667.693808] binder: 15833:15986 ioctl c0306201 200002c0 returned -22 14:47:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd0") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:44 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:44 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r3) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000630c00000000e0"], 0x0, 0x0, 0x0}) 14:47:44 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) [ 2668.129158] binder: 16011:16015 unknown command 0 14:47:44 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) [ 2668.152206] binder: 16011:16015 ioctl c0306201 200002c0 returned -22 [ 2668.183378] binder: 16011:16022 unknown command 0 [ 2668.226144] binder: 16011:16022 ioctl c0306201 200002c0 returned -22 14:47:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000630d00000000e0"], 0x0, 0x0, 0x0}) 14:47:44 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)='\x00', 0xffffffffffffffff}, 0x30) waitid(0x2, r4, &(0x7f0000000140), 0x21000004, &(0x7f00000001c0)) close(r1) r5 = fanotify_init(0x3, 0x0) ioctl$TCGETS2(r5, 0x802c542a, &(0x7f0000000000)) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sync() syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:44 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) [ 2668.434552] binder_thread_write: 13 callbacks suppressed [ 2668.434567] binder: 16234:16235 IncRefs 0 refcount change on invalid ref 224591872 ret -22 14:47:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2668.553923] binder: 16234:16235 unknown command 0 [ 2668.630804] binder: 16234:16235 ioctl c0306201 200002c0 returned -22 [ 2668.705962] binder: 16234:16346 IncRefs 0 refcount change on invalid ref 224591872 ret -22 [ 2668.753423] binder: 16234:16346 unknown command 0 [ 2668.766809] binder: 16234:16346 ioctl c0306201 200002c0 returned -22 14:47:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) 14:47:45 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000001200000000e0"], 0x0, 0x0, 0x0}) 14:47:45 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2669.083347] binder: 16452:16453 IncRefs 0 refcount change on invalid ref 301989888 ret -22 [ 2669.120556] binder: 16452:16453 unknown command 0 14:47:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) [ 2669.156902] binder: 16452:16453 ioctl c0306201 200002c0 returned -22 [ 2669.184554] binder: 16452:16506 IncRefs 0 refcount change on invalid ref 301989888 ret -22 [ 2669.233964] binder: 16452:16506 unknown command 0 14:47:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2669.274210] binder: 16452:16506 ioctl c0306201 200002c0 returned -22 14:47:45 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x80) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f0000001640)=""/75, &(0x7f00000015c0)=0x4b) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@initdev}}, &(0x7f0000000280)=0xe8) sendmsg(r2, &(0x7f0000001600)={&(0x7f00000002c0)=@ll={0x11, 0x1f, r3, 0x1, 0xb8c, 0x6, @link_local}, 0x80, &(0x7f0000001580)=[{&(0x7f0000000340)="e30320966a88709e78c0dfe9c9a4f937c154c3ecc0a97d1d551be943bfb0421fe8d430d81652488e5ad1fed78b14e16d4f458aa0c7fc20e9749c70c0f182a8a2e99f8559af43809b1b825901dcb6bcd8c3526c250664137bc6dda46c065c2dc044abb19a0aae44d9ad3b561354aff4b09eebce8300d1c783a4c4aa203737e0d55b60af046cdd3d5052706db416daade95fe4a9739918d32cad7836a105556d56c737b1f27e7706c9a27ef8ad1d77db371ffe8b92bdaa8d37514f5e286586", 0xbe}, {&(0x7f0000000400)="7ed91b76be90e626e4025ce85b3e6c669ca3444248d5efa01412e23543806d78a1e08da9ef7fb45a5703b72f917fe4c8566212f87ac0a658703ebec0c79b0d0db83795a34c6d81c8442d384d35749376bc1662fdf64d5e43f44783ecb2e086f0b7be271ebb08253a2c45c2ab5f255d87b76b4224390e9913cb", 0x79}, {&(0x7f0000000480)="425d743b5334a3b546a8eeb4f81c7b4c1e53b081bf4d978a8f64ad500a26df1f8b6d6ffc3cdc940951c1c13e245d28a14aa547c4f8e9cfbeb628c31a2993bc1f9db1d61f511ab5f374c0d348364180e90b5f3d786075f7b7cb134e0e2d52aca4da904ee1a9b87baa309eeb5f5e19c199cf24e73e81462b29f05bad3c73ac24c00fc802ca857b96738c63dfb4f569c19c4d03f6e1a67bbb7d3b9393e3ce735d15422a67b2e15434c1ab2cf49fa96095bb60b1fa6ad2ea58c59fe6c144ba925707e1043cdd4dbc63ab266b2ae12e22d5d0e7ec017f499e149b4320beb13bbde9df42dd8db8599ec0aee68be8afbcd9d5d2dba74c3527d5190fcc50ad4bf3888bb5ec4e8c9f79f405d65b330a6f6a7db76774bdd8298a1b36f7e9c45f71313ebc3e88dd36b3a256b81ffb2edd6d30f4ef8419c32fc3c0289d3e866f17dd27681dd8e4698d1bf4d0ff210644839418011fd0000a001caaf1e2b1145e346fb9f7330391ae48ddfdba243b37662fd0682e2e6260b354a14dcfbee0beac64c803ca1f1dc7906892f01c50d96ec909e9928700d3b5bf66ed99097b673a1008a45e16a0f97c235f5791abe799bb8be60450838938c32c8a4b5b54ed4c94d8da6dd64a65ea29b778311cc469cfcb6888403d67afcfe318243b68df790e385dbd7a3f57885ce08a6680586514d22b2946a3b498a5451daf43295b9ee10984d62cfcc19f0f19524820ed15b47e098e81aa054eabb81d34d016e3028ced8096018c7bae293e7f0282ca906120bf82656b8ca49e698cf2b31b53f3c90453af6d5972d1b5b4e0a1659fb3e781e7465846aca94423e9137cfe42f1458636f53930a0584fc93572612d754553514da7285a02132d8c354351564230082b9545b4a0e5b73af7484ebad0cfb0907ee2d810a17fea89262c6c6ac30e54617bbfda070231e4327d4fa69e858bdfb7084efdef270e583ee6dfffab58b99bc0cd8862b2ac099a1356fd2864c8110d3403d6ff1eea7f37388697e4350e11f6fa7847ee592b79a4fcec6128be98e5e3aab6ff5306711812b3e301f3d55fd76c0cfb14e34f65be0d151611ade8708462257e8f5f8d367976d55c575a6fca4db3f2d86e791def50c56597a6b2992271ad649f663713ebc1e3ba9e84f9256b0402142f75bb03a3241dc8618849cfcf40d3ad928ab33a3b55082faa8b86bb49b1d4dbbc9bf613a8f4f79dcdae9fffcb8ae26a3a8b0c506c3a10c2cc809de71e069ed06f874490ecb973446c4873cb2f8df5d25ee3b540e37d52e72ee6cc677e009370b91b205f7fb95d11f1430450d4502948317be0e14b85c5fc349c20a6a885a789a9eaff114e5c7d123519e2915aa197997af2c39a19dcda0242855f89171cb25b03c2b6bdca4f483b03a6b5acc577a3e616c8215c2234623784ed35dd7dfed37cb331668e1679bd70c983fa6ff9bf2ffdb7e2ad9edb4bc25e989f497014fbd0bd7a6bdcf46510e64c20c2418427437ecfb7413d4586789002cd467695b146ac164319746f71a93b221226e0d9b0d1845a794348e72deac7d16006ce667f136a2f4b739338106751c9ceb9a4d904699fea8f3aa4859453f9464885ccd3cfe26de4f6270ba352f9b6bfeb0bffa069e99700f02f0aaafb795d12aef93b26e78380bfd7b1932299554f089b0f88310732e714580073670b29fd80fb04c00392c596af7f27b41082a4d58f32a7fd4e1beed9f8d65013591361890947796b39d38aa9c32ebfa6637fd016d14a903f3058c7ad313ddbd2583db4d86f676f1078ba19d91fa5f1d0238e0667df872a8bba695cb6dccab1218e9c6fb8a350c82f5229947ffc851a955aa7755f195bc0041281222fd4947989c7749d496de305f750951d3df717a59b69bf2a747c64f5040e7b95f06215971fe688835c1f2305fc40b11dde7f6f5d93aea53bffdde20dee3eebe138e8bfab01c9b1863dae2129296f26b75c7858095894d559b891edfb1eee457d460d4b2d3af76435b35443e4316ba46bfdc676ab33adce1941bf9bf7c80b67bb3012498becce77a184fa9322cad1e3dc0da3b04e131b5c02c6cb2f9a048b8d7430d03b8c78214b9266a10fd08e1c55babe497f1be0ff1387a6f652bb459ac6c95d07a7e3ff8ae1d2b845b817f8be30ec38664c5e3a52129bc6cab36cc0e4c9e4620a9a86d31ba954039b7ba7d1343f11e65fc7cac26feb1981edbc335a8af4c12dfaee48b4af368278a19ebb491b2e347d32964b375416bcd94d1499b1bdc8390354c03802be9d2262f96a99d3820d4e11a4947c25355f45f426a31e75f500e01a95621dfb6efa6899987d2c7e0339bb9fb2549c9f66da98d35d7162ad50b2a58713ba964fdf0c655c85d76390d034f1938a26bf9daba09f58c57b24bee13d28c6770abe92609895eaa1c5695e471ed2eb7c86ddc3fc36c96b52b437fbcf3b83c69dde54d3a76e56490f50fb6ed46dfb5927f8472fca1a015252ad0f70f805ecbbae7889c5dc79719955ef8de22c1d478934b93a0598df30da53544148fff017019066bfc6457c101bc1cf736f53aa6093e1324f9755c07ee3364379f6ed22190abdb0da24d6d17523c867286c2d159d845cb995ac347f4d53c331deeba2e3dc65bb0e68a47408ef2c41bc24116bd6a158a945905c90c40401e924f5533ddfc42bdc55b60ac1a417e844eed2719f8a7fdc9fb0f777a3e45982f558813e0025698f332cde6314042406b66269b3436def9c9fb955ff0f0981e2c07bdc710c652554a82146a5252ffdbf7bcb776470fe1ba736d49d6c389b9773ccafb4a7492957bbaa2787a6758373788c7cdda6218697fb1fa737e8a90127e7360a6feab451b308a555333e9300ce569537de7b146303b3315aac3793f5ba30344cb79949e84e59d3c0a5087d3a642a6e751e132bdbfdbbb1df79db224843db4b5cd3fefdc7db30cf6daa70e2e82620f306d1954ba8e06289d890d9385e776b7584acc233f772a42b40b91f8d0737920cda299c1c8e1c42b21949bbb60fcfb9dfae7c09db4f39acf23019ac06e4c8a07d91f62a934ec524f2a71826f6da2605a577495d6560b87acbe865a6ae255dfa20b0a29d6d34a39c267f633279d1dd711a5014267b7c71435cd8bb139d316c7a4d5a4f5f7f5b77c9e824467b056b2323629a416d655019b10953cf0b66a1352ff1f92db8e105c80a0f46c7ee810e56d1e9ef2a2e59c60eaab5b5f616f50f5eacbf999b401fa5e43e2f64f3dfdf335894d1baf6c0b83c2a7abdefed0ccf29e05cf69eabffb71cd3cae0b084a23e47a5b7dea671ed4eaea19b9a06b3204a7991522c46cba76cf9210329169c758be43a78cd0376c99a38638fdb139e6d52a9f8cc5a0366d8e07a80a75e654652febde28be64d23298c348faca872df8f37c72b9189521dcfb43be31ade42c76f6c84c8fee4f687e34cac5883d4cccbeff76bfeef6ccde4767202e4143360949926fc79202cfe9c4581499a5eaa8f24d73b69fd1e2d3f627ffc1dd51b89ec344cd8a232569f43ad8c3e4386531f9e2f07201d536712350be0f7e52db86101cb72f0c0232a8872382ddd4b95fc36eeaadcf2a5150d3452a26d9c4862ad640ab5052076f11e289b0ba7a544f98d5f750a190edcf2d45f481f66bfd4e4604f5a5c25a8679cac0baa45f5290fd77ef26757f925b2bf3133bc4d9274e5aac142d1ef5c227261c75c9b317ff82001c6585c543075593ad0b0ab7e8a2d9dec94e9874b31630dda2c19129cafc02fd35467036ec38c63e7500105604e048aef418b224d02d77ba276ed5c511b97906cb28889b3aa5792a5bb05b58cd38c2d0fe25b65a6034d6fd773731990176ee4a70f55ec7f21a15e8f85fb569ab8d39d8c4d77f44adae70a23dcccaa493dcf35c9c84ba3983b30a043b0e7956d41db046778fa38c526e24723f8df5b927040af5ff8a1c6a87a984dba43db2b10a56280e7bb7c9a2023add017305d48781eea0d8cbe851f1e52378df13f7977fa8a021c0ee2b1a5f110843100546ea0b584b6d885edb41f66c3c7dd968da6386227faf119e7c5ba56d8087b83a8205deaa65882905f7739e8e46b801e2061f8db5025dd5e312b4b3b3463ceee0b8aa66c36c75818a984d6941a5a4369d0cac51254cc94fab304eba5ac0a311ac6f772f2affda6258a473f43987c69cdcebdb904bd14b99395c925fe3e8e920b73be7b7e260bf0bceaf6f9d2f9ad453c3277d9f17191ef8b05759b3e7edf84e975d31e7f27ed634a34bf578382a1129bac2eea7afe79b350a80a121204c0f89f27a76f79b9ed33873c45c627bc92e03690c5c3d2047224c492593560cf76116ee742777091effddf924aa0715b8dabef4570bfc8753bbf2816abba6bf6f46ae39082260339ce89702d81e1ad122dd79912897981ad69e490e7ef7f925683ea071f00de65407290ee50d56f96487e1d89b7fbc3cb86efbb30f56a2c3f095b5d9f46bc6c9f81941f6abda736654a1156a24e54a90c2b0aabb86804e1fc3c81f7f0757b10ba3b63a312ec1b5be5ca5eca634d8244046795a767685c369b650add312a6aee39fddd167febf21d557498c963bb1f3c06abc4f785a672412b3606877255451489b2a06543f309e35ecbe1c6d4eb7a336d83b1dca5d6570d5a5bfd448889098006118ee565d931bdbc6a9765b4a5dc334205e6fd16e3a1ebca752b6954a9a956da40e81934197fd957012d0596693ddc30442f7b4a5686957b5965b087bbefbafd97ab058773b943f59c97381aca25ef68de3e36016b654608905951d0796e1be9c15dc8dc31ad98f92aa33e2ee34a1183c8c1594c6aeaf5934419964ee6ff74e1b6947b79b514887f76964d9d18beb7f7a29ea3021c639846e97b11ab11ef0a2dc20390996d876aa4c319188496adde38b52d7d8bd7a77134ee46e27384ab6cea5dea2607dea1441b07e529fd9222463e5eda3c47ab372e52b94286d4ed628b73ce03dda1097d065c867970583d1a576855469b1848dfae9069fdfb8dcc5e6de26a2ad767ec159aa6d7c5cb1346430d3d1bca227b2efe2ffc4afca3d972215b5a4ef5a3e80cdd74e477bb679bcc839bc76c30741fa9b5be573685177b6988bd041da879b009ae09171d6c015cb6a669b8774afcad9286cb47b595375fc1399ea85512c57247318d039a7190e1963d40205ce6225b35670e67703b1225705bbaa273c5a0eb970a5c5120ef08dbbea6c7ea1d75bd922470807f74e079dd1f3fc1f0c62b0fd083fe11ab74c01524358b70b796a6947789ec19c128ae21378574131eab451cce61463dbab30bcf996e4776f3d9181a1b710be04e77658470baffc2c8d37e44f9efe19c78630fe5d529976eb67d79bc45a6ea7942dd7d69e5d34ed593ccf9598734a3c579ef3460490f1062d478129140c323b1ffb0b4f6f57e347c0b1b314a0e6e4c54a394145f5ef8af27061f467a495a4d08aaebff2ebde0e00c4d68d17368288d148939fd5a03f69df540b6fa4d4f071709651561f58a6636ac7b475db0d5df4f4235df1b49dc3bf47ca48f5328a91332fc022f03c53a8aec188108761a3cda0ebe0f9576d27b634d8bfed2ef10f7722c86b5b7d076c4cb78a45f9522fd314b68651d16acfa43030ea7a02efc2d7a36ca06a105c5908f92517431155f83c62421e6436566dd048196f8dbe0049286b856da81d3495ab699e3292c875592d030fa8a57e4c4029c2e71f764677680605d872885f475bbf6c433c431b90d1229cc118f3d5cf6020093b2868ac14984302fa5d8b3bfd1a7e5f47cfbc0be9e", 0x1000}, {&(0x7f0000001480)="083fb9e4dab28918c473dbe55779f6459c9f0ee61be84dc08322f50afce784c661aa8f235b586bd83848619403eabb47d61d7d86358a27616380606a8d623964a2bde02ae0743bcd7474c74669d8dfd40e4b8d3282f4bbfd964fca9a323b3486881773be979f91bd25b384b17d95c4f19966f595adf13c042051a9a64ba019a57b44a321b82d2d6b35311baa92d08fb717af1bb24d0bbc7da2b7fdb2f46f74acc3cda01295a626ccd371d11737bab92d3289577f778c4d5f3c386ba180f0299115a8fa70dc25185d60cd46a244e8b740b079fe375da222dbf061bd907647045e6e", 0xe1}], 0x4, &(0x7f00000015c0)}, 0x40000) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x1, 0x0) openat(r4, &(0x7f00000000c0)='./file0\x00', 0x20000, 0x10) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f0000000100)={0x2, [0x8, 0x1ff]}, 0x8) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_init_net_socket$ax25(0x3, 0x3, 0xcf) close(r2) fanotify_init(0x0, 0x1) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r7, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) 14:47:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000002000000000e0"], 0x0, 0x0, 0x0}) [ 2669.496014] binder: 16676:16678 IncRefs 0 refcount change on invalid ref 536870912 ret -22 [ 2669.517686] binder: 16676:16678 unknown command 0 [ 2669.523791] binder: 16676:16678 ioctl c0306201 200002c0 returned -22 14:47:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) [ 2669.552430] binder: 16676:16743 IncRefs 0 refcount change on invalid ref 536870912 ret -22 [ 2669.629971] binder: 16676:16743 unknown command 0 [ 2669.665609] binder: 16676:16743 ioctl c0306201 200002c0 returned -22 14:47:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:46 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x101c80) ioctl$KVM_ARM_SET_DEVICE_ADDR(r1, 0x4010aeab, &(0x7f00000000c0)={0xe6c, 0x10000}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000a02200000000e0"], 0x0, 0x0, 0x0}) 14:47:46 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:46 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) [ 2669.991263] binder: 16792:16793 IncRefs 0 refcount change on invalid ref 580911104 ret -22 14:47:46 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) [ 2670.039218] binder: 16792:16793 unknown command 0 [ 2670.044527] binder: 16792:16793 ioctl c0306201 200002c0 returned -22 [ 2670.068956] binder: 16792:16801 IncRefs 0 refcount change on invalid ref 580911104 ret -22 [ 2670.103625] binder: 16792:16801 unknown command 0 [ 2670.120762] binder: 16792:16801 ioctl c0306201 200002c0 returned -22 14:47:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000004800000000e0"], 0x0, 0x0, 0x0}) 14:47:46 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) [ 2670.317807] binder: 17009:17012 IncRefs 0 refcount change on invalid ref 1207959552 ret -22 14:47:46 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f00000000c0)={'broute\x00'}, &(0x7f0000000000)=0x78) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x3c, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0xff, @mcast1, 0x1}, @in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e23, @broadcast}]}, &(0x7f0000000200)=0x10) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000240)={r5, 0x6c7e, 0x7, [0xb8, 0x1000, 0x8, 0x80, 0x3ba, 0x0, 0x4fc4]}, 0x16) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2670.361238] binder: 17009:17012 unknown command 0 [ 2670.369646] binder: 17009:17012 ioctl c0306201 200002c0 returned -22 14:47:46 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000"], 0x40}}, 0x0) [ 2670.420469] binder: 17009:17063 IncRefs 0 refcount change on invalid ref 1207959552 ret -22 [ 2670.545721] binder: 17009:17063 unknown command 0 [ 2670.576401] binder: 17009:17063 ioctl c0306201 200002c0 returned -22 14:47:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:47 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000"], 0x40}}, 0x0) 14:47:47 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x109000, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f00000000c0)=0x7f, 0x4) r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) ioctl$sock_ax25_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x2, [@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @null]}) 14:47:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000004c00000000e0"], 0x0, 0x0, 0x0}) 14:47:47 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2670.984235] binder: 17129:17130 unknown command 0 14:47:47 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000"], 0x40}}, 0x0) [ 2671.030107] binder: 17129:17130 ioctl c0306201 200002c0 returned -22 14:47:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2671.091611] binder: 17129:17220 unknown command 0 [ 2671.111168] binder: 17129:17220 ioctl c0306201 200002c0 returned -22 14:47:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000006000000000e0"], 0x0, 0x0, 0x0}) 14:47:47 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb00000000"], 0x60}}, 0x0) 14:47:47 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x8a00, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f00000000c0), 0x4) [ 2671.304129] binder: 17348:17350 unknown command 0 [ 2671.344655] binder: 17348:17350 ioctl c0306201 200002c0 returned -22 [ 2671.374894] binder: 17348:17432 unknown command 0 14:47:47 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb00000000"], 0x60}}, 0x0) [ 2671.405608] binder: 17348:17432 ioctl c0306201 200002c0 returned -22 14:47:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:48 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) fcntl$setstatus(r0, 0x4, 0x42800) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video2\x00', 0x2, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000140), 0x1, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x201, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) r4 = fcntl$dupfd(r1, 0x406, r3) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f0000000000), &(0x7f00000000c0)=0x4) ioctl$PPPIOCSMRU(r4, 0x40047452, &(0x7f0000000080)=0x1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000009000/0x18000)=nil, 0x0, 0xffffffffffffff62, 0xc, 0x0, 0x0) 14:47:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000b6300000000e0"], 0x0, 0x0, 0x0}) 14:47:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb00000000"], 0x60}}, 0x0) 14:47:48 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2671.954419] binder: 17566:17574 unknown command 0 [ 2671.972052] binder: 17566:17574 ioctl c0306201 200002c0 returned -22 [ 2671.981843] binder: 17566:17602 unknown command 0 [ 2671.997889] binder: 17566:17602 ioctl c0306201 200002c0 returned -22 14:47:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb0000000000000000000000000300050000000000"], 0x70}}, 0x0) 14:47:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000c6300000000e0"], 0x0, 0x0, 0x0}) 14:47:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:48 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$alg(0x26, 0x5, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0305710, &(0x7f0000000240)={0x0, 0x1, 0x3, 0x9}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x400100, 0x0) getsockopt$inet_tcp_buf(r2, 0x6, 0x0, &(0x7f00000000c0)=""/248, &(0x7f00000001c0)=0xf8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)={0x0, r1, 0x7, 0x3}, 0x14) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r4) fanotify_init(0x0, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r1, 0x40086408, &(0x7f0000000280)={0x0, 0x3}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2672.168014] binder: 17767:17768 unknown command 0 [ 2672.206154] binder: 17767:17768 ioctl c0306201 200002c0 returned -22 [ 2672.251689] binder: 17767:17837 unknown command 0 14:47:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb0000000000000000000000000300050000000000"], 0x70}}, 0x0) [ 2672.276829] binder: 17767:17837 ioctl c0306201 200002c0 returned -22 14:47:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb0000000000000000000000000300050000000000"], 0x70}}, 0x0) 14:47:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000d6300000000e0"], 0x0, 0x0, 0x0}) 14:47:48 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x6, 0x0) 14:47:48 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2672.851349] binder: 18112:18120 unknown command 0 14:47:49 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e0000001"], 0x78}}, 0x0) [ 2672.874293] binder: 18112:18120 ioctl c0306201 200002c0 returned -22 [ 2672.889986] binder: 18112:18123 unknown command 0 [ 2672.900928] binder: 18112:18123 ioctl c0306201 200002c0 returned -22 14:47:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000006800000000e0"], 0x0, 0x0, 0x0}) 14:47:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2673.039689] binder: 18229:18247 unknown command 0 [ 2673.049557] binder: 18229:18247 ioctl c0306201 200002c0 returned -22 [ 2673.067496] binder: 18229:18270 unknown command 0 [ 2673.078476] binder: 18229:18270 ioctl c0306201 200002c0 returned -22 14:47:49 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e0000001"], 0x78}}, 0x0) 14:47:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000006c00000000e0"], 0x0, 0x0, 0x0}) 14:47:49 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f00000000c0)=0x600, 0x4) 14:47:49 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e0000001"], 0x78}}, 0x0) [ 2673.303560] binder: 18345:18352 unknown command 0 14:47:49 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2673.330291] binder: 18345:18352 ioctl c0306201 200002c0 returned -22 [ 2673.370681] binder: 18345:18459 unknown command 0 14:47:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2673.393641] binder: 18345:18459 ioctl c0306201 200002c0 returned -22 14:47:49 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e000000100000000"], 0x7c}}, 0x0) 14:47:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000007400000000e0"], 0x0, 0x0, 0x0}) 14:47:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:50 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$BLKBSZGET(r3, 0x80081270, &(0x7f0000000000)) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f0000000240)) close(r1) fanotify_init(0x0, 0x0) r4 = dup(r0) r5 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0xfffffffffffff5dc, 0x400040) ioctl$CAPI_MANUFACTURER_CMD(r5, 0xc0104320, &(0x7f0000000200)={0x8, &(0x7f0000000100)="5f0900472f26a3e26c319eda0c61bc2407ff9c333a7274d65414112d6515642277faf5588e5ec72c825a7be95835145b28e471a56ad60024a480ed4e4c0f187b309d0908b3f0948aaf6724d9cd90381ac0d2931f5bca177a9582d302fd0a0a30b6edfba451e08df3c14c3d8b4003f1edea5bcb2f38566a955204cd1de6fe99a639ae196f253330daa0de70a95c2f45b799618d2eed642b92d9b25b23eca710380c0ff730e1889aaba06108b830a1c7697dc79e5b115cbd1184c08e1d3f0adf941151e86c6473590a5de43f53"}) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) ioctl$RTC_WIE_ON(r4, 0x700f) 14:47:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e000000100000000"], 0x7c}}, 0x0) 14:47:50 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) [ 2673.901033] binder_thread_write: 14 callbacks suppressed [ 2673.901048] binder: 18694:18695 IncRefs 0 refcount change on invalid ref 1946157056 ret -22 [ 2673.923271] binder: 18694:18695 unknown command 0 [ 2673.950446] binder: 18694:18695 ioctl c0306201 200002c0 returned -22 [ 2673.986179] binder: 18694:18715 IncRefs 0 refcount change on invalid ref 1946157056 ret -22 14:47:50 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e000000100000000"], 0x7c}}, 0x0) 14:47:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2674.077689] binder: 18694:18715 unknown command 0 [ 2674.083546] binder: 18694:18715 ioctl c0306201 200002c0 returned -22 14:47:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000007a00000000e0"], 0x0, 0x0, 0x0}) 14:47:50 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e0000001000000000000"], 0x7e}}, 0x0) [ 2674.276143] binder: 18920:18965 IncRefs 0 refcount change on invalid ref 2046820352 ret -22 [ 2674.342921] binder: 18920:18965 unknown command 0 [ 2674.356807] binder: 18920:18965 ioctl c0306201 200002c0 returned -22 [ 2674.384451] binder: 18920:19029 IncRefs 0 refcount change on invalid ref 2046820352 ret -22 [ 2674.423843] binder: 18920:19029 unknown command 0 [ 2674.432899] binder: 18920:19029 ioctl c0306201 200002c0 returned -22 14:47:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:50 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) socket$isdn(0x22, 0x3, 0x25) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080), 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:50 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e0000001000000000000"], 0x7e}}, 0x0) 14:47:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000404063000000e0"], 0x0, 0x0, 0x0}) [ 2674.713868] binder: 19042:19044 IncRefs 0 refcount change on invalid ref 1077936128 ret -22 [ 2674.742789] binder: 19042:19044 unknown command 99 14:47:50 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e0000001000000000000"], 0x7e}}, 0x0) [ 2674.774532] binder: 19042:19044 ioctl c0306201 200002c0 returned -22 [ 2674.815899] binder: 19042:19195 IncRefs 0 refcount change on invalid ref 1077936128 ret -22 [ 2674.880049] binder: 19042:19195 unknown command 99 14:47:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2674.906118] binder: 19042:19195 ioctl c0306201 200002c0 returned -22 14:47:51 executing program 1: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fallocate(r0, 0x23, 0x4, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000000c0)='{}GPLtrustedppp1ppp0em0^wlan1\x00') 14:47:51 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000a00080000000e0"], 0x0, 0x0, 0x0}) 14:47:51 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e000000100000000000000"], 0x7f}}, 0x0) 14:47:51 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 2675.112298] binder: 19273:19291 IncRefs 0 refcount change on invalid ref 10485760 ret -22 [ 2675.147011] binder: 19273:19291 unknown command 128 [ 2675.152749] binder: 19273:19291 ioctl c0306201 200002c0 returned -22 [ 2675.195938] binder: 19273:19355 IncRefs 0 refcount change on invalid ref 10485760 ret -22 [ 2675.254707] binder: 19273:19355 unknown command 128 [ 2675.300683] binder: 19273:19355 ioctl c0306201 200002c0 returned -22 14:47:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080), 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:51 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e000000100000000000000"], 0x7f}}, 0x0) 14:47:51 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f00000000c0)={0x1, 'lapb0\x00', 0x1}, 0x18) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x80, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r5, 0x10f, 0x85) 14:47:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000a01080000000e0"], 0x0, 0x0, 0x0}) [ 2675.611275] binder: 19479:19483 IncRefs 0 refcount change on invalid ref 278921216 ret -22 [ 2675.640755] binder: 19479:19483 unknown command 128 14:47:51 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e000000100000000000000"], 0x7f}}, 0x0) [ 2675.661481] binder: 19479:19483 ioctl c0306201 200002c0 returned -22 [ 2675.682415] IPVS: Unknown mcast interface: lapb0 [ 2675.687988] binder: 19479:19503 IncRefs 0 refcount change on invalid ref 278921216 ret -22 [ 2675.702957] binder: 19479:19503 unknown command 128 [ 2675.726995] binder: 19479:19503 ioctl c0306201 200002c0 returned -22 14:47:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000010000e0"], 0x0, 0x0, 0x0}) 14:47:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:52 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) write$FUSE_NOTIFY_STORE(r1, &(0x7f00000000c0)={0x31, 0x4, 0x0, {0x1, 0x8001, 0x9, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x31) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r1, 0x4004ae8b, &(0x7f0000000100)={0x9d, "93297187a2b69fd6e1e7be56537b2818062d704a6375611373998db45e74cd9c3ecde3fe49c943965b97ea137f154087c4d6877ac2fb1bfbad6e6b7ef93c5cdbd2df2a4eba1c7f8d2cd455f28e6a8f2ef23b28a16393acc83a749ee869006ee4532f4dfb3fbf9b04a7dd4432fe34e8066ed13e919b1a3c85e6efe6718a4bec2b95a0a0d5137aeb64a71f2ebe81c573090b13a048e15447afbcd5a3b35a"}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r0) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2675.912877] binder: 19696:19697 unknown command 256 14:47:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 14:47:52 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 2675.949042] binder: 19696:19697 ioctl c0306201 200002c0 returned -22 [ 2676.015282] binder: 19696:19802 unknown command 256 14:47:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2676.056424] binder: 19696:19802 ioctl c0306201 200002c0 returned -22 14:47:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080), 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:52 executing program 3: 14:47:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000404063010000e0"], 0x0, 0x0, 0x0}) 14:47:52 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r2, 0xc04c5349, &(0x7f0000000180)={0x5, 0x400, 0x1}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) get_mempolicy(&(0x7f0000000000), &(0x7f00000000c0), 0x4838, &(0x7f0000ffb000/0x4000)=nil, 0x2) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x2, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$SIOCNRDECOBS(r6, 0x89e2) fanotify_init(0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:52 executing program 3: [ 2676.616278] binder: 20120:20128 unknown command 355 14:47:52 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000000)={0x0, 0x4, "c558997e"}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000100)={r5, 0x7, 0x30, 0x7, 0x1}, &(0x7f0000000140)=0x18) 14:47:52 executing program 3: [ 2676.648104] binder: 20120:20128 ioctl c0306201 200002c0 returned -22 [ 2676.685884] binder: 20120:20182 unknown command 355 [ 2676.702703] binder: 20120:20182 ioctl c0306201 200002c0 returned -22 14:47:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:52 executing program 3: 14:47:53 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000020000e0"], 0x0, 0x0, 0x0}) [ 2676.913724] binder: 20341:20349 unknown command 512 [ 2676.951821] binder: 20341:20349 ioctl c0306201 200002c0 returned -22 [ 2676.995293] binder: 20341:20443 unknown command 512 [ 2677.021944] binder: 20341:20443 ioctl c0306201 200002c0 returned -22 14:47:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:53 executing program 1: modify_ldt$read(0x0, &(0x7f00000000c0)=""/208, 0xd0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:53 executing program 3: 14:47:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000400463020000e0"], 0x0, 0x0, 0x0}) [ 2677.357487] binder: 20452:20457 unknown command 611 14:47:53 executing program 3: [ 2677.392344] binder: 20452:20457 ioctl c0306201 200002c0 returned -22 [ 2677.407828] binder: 20452:20474 unknown command 611 [ 2677.420690] binder: 20452:20474 ioctl c0306201 200002c0 returned -22 14:47:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000030000e0"], 0x0, 0x0, 0x0}) 14:47:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2677.547481] binder: 20631:20632 unknown command 768 14:47:53 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2677.570295] binder: 20631:20632 ioctl c0306201 200002c0 returned -22 [ 2677.596043] binder: 20631:20673 unknown command 768 14:47:53 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x8140, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x102}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r3, 0x1, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x44800}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x208000, 0x10) getsockopt$bt_BT_SNDMTU(r5, 0x112, 0xc, &(0x7f0000000100), &(0x7f0000000140)=0x2) setsockopt$bt_l2cap_L2CAP_OPTIONS(r5, 0x6, 0x1, &(0x7f00000000c0)={0x3, 0x4, 0x80000001, 0x80, 0x7, 0x800, 0x1}, 0xc) close(r1) fanotify_init(0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0xfffffffffffffffc) syz_kvm_setup_cpu$x86(r1, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2677.633232] binder: 20631:20673 ioctl c0306201 200002c0 returned -22 14:47:53 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000400863030000e0"], 0x0, 0x0, 0x0}) 14:47:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:53 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2677.798748] binder: 20904:20906 unknown command 867 [ 2677.817042] binder: 20904:20906 ioctl c0306201 200002c0 returned -22 [ 2677.854328] binder: 20904:20967 unknown command 867 14:47:54 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000001680)='/dev/dlm-control\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000001980)={0x0}, &(0x7f00000019c0)=0x4f) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000001a40)={r5, 0x38, &(0x7f0000001a00)=[@in6={0xa, 0x4e23, 0x4, @mcast2, 0x4}, @in6={0xa, 0x4e21, 0xfffffffffffffff7, @mcast2, 0xd9d}]}, &(0x7f0000001a80)=0x10) r6 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) fanotify_init(0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f00000017c0)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f00000018c0)=0xe8) syz_mount_image$reiserfs(&(0x7f00000000c0)='reiserfs\x00', &(0x7f0000000100)='./file0\x00', 0x4, 0xa, &(0x7f00000016c0)=[{&(0x7f0000000140)="2bc3a82f8f77b0425c922cdfa8f3fbaf0cb69e5ee2fa3c18cf27e86b2f70e6866151959d1a82cba0568ce0fd65351d9619490c76ef9e32c6bb463c21a7048ac5ffe8ad2dcec64beebe87c48f46159669b1d723c3203e66d3cd1c1512ea8674fbf703abea659e497a9efe6db793e2d73ca01efc47a20be2dab323dd0cf0f2d29ad304b34c304ba1a001ec6fcad82a39cb7bdb7f489e8fdb603d003830825ae7c5659d1412258ce2bc58bb252ecc2c5deded70e4b54ab107e4158d3778f206", 0xbe, 0x2fc}, {&(0x7f0000000200)="dd2558c6c27e64eced0a", 0xa}, {&(0x7f0000000240)="62eefa405386346842c187e56be01a5d3516a12dac8008032903059790fe1eafa49eb35aeae4a1205dfed65c229276381dcc3868babe52e922c36246699fa827f37bb76a1f5da6ba64b77c78c278e601797c1dd45ab8fb9cb9dd5ea660a72d79972383e90ea045423fa4971daacb80161ae352b1392ea7b34e569660e300a282491e76280fac35e73dd5eb52713cab1fb1a37e595b02662bf18e649142add3", 0x9f, 0x3}, {&(0x7f0000000300)="32ba6b2c6d87697bd024045184f4865ffb64a9598d6e0e290a4c957ad151c60213661c0e9c497c8aeb439f77c0d025fd46f69fba56498be1619332625572e47c40442d23de419627ef5c9377d5dd1a1b5cf73f75cb4705447dcc7bf0fb8c5f58b7e66a1194949e6888ff3c57b5eda264d0a309db90f5d24f452a4388f96538003bbe170f9a9109d2ad0bd13661b9cbc073f3d4d88e67b84c2d63b050f8b7e2c947698926331ad4ce85e449d8ad62beede0df5254819d99ff78d4bdf14d608b4912adec0a8eec2d6a1017dae8d657fd75780e7a40b63de6ed12dc", 0xda, 0x7514}, {&(0x7f0000000400)="d8bc752c822b3d1a2534c64a93c9371104229825174e218904bbad970345745904e7cf8dd08d6354d7ab69e7a9aa095f3442b0b8f1cb09dc4af46e0c29326fa57c2c95ed9992aa103a029d25d7875b746f17999ffd2e25ebbcc729a8305c3d04d0e8894f1927143a9113037888e73905b9f5ba05fb4d854a6fb11ecfa8288a166c48f1b347a4a52ac7083ad80084f9edf4d29fa1b982973e7a523f79e2c896bd4d4e8e7474f76fe5e653a9e4f009c8177ea7960a26fed8420d40336e9ac753dd9844dda4f4252fb4e4a4ece3892692b02306036ee7d2441900e8f35522a0d939ed7eb35cadea5f1ff9e0934c3cb0f2a21fea4c19b4b68d43c13b9f95d60c519dd9cf5c2530a87bf84acf2fe5f99aa50c7077649c20fde2a73a83db80af4a45b0d37d099a9f936bf5e4bdb64951e1a41abaac154825f4114c6377f1ac274e41270affc3c7d3d41eba15789b215b80c8cf887cce1837b809d320e6378562ac73ade5acc2b850a0ad7e46be2d549abec0cf467ebbb27d4f68a65a6c45bee3b554c16f35c5df094dd27ad1cead837801b5f92595533e48c176f6f1c91ca1f40e21436a7fbde34030426764789836199d1edf492eaf21a6d74ce1ca6394ed1214e70aaea697f39d9ed3b55c299c2bad10939ae3dcc2a91fe521bb133d5cd24d9bba274f8c8f02ab3f8732bb65b8965ffd31cf0b3cc3de9f35e3c558f91c52644c4b83abf29858ebeb17470e81ae926aaf9ab85625fdc0d680a132db1417996f1fcdbfe13efc48e6f9ab44662763bbd303cce249d2f6dd5891e1cc802dd063365b6f904824bc2c230dca684ad8f0ff2668057f0ef7129f0963652f97114f73632287a18cfda9504474d32f07e631cb4e9abd78d07ed1d906722ab239f456319a0e18c4b7150c8c40e0a43f52c453ef68ed1589031feeb6aa13291c6e3fdbd7b5e7a63125bb83edd0f3d2b0f98eeef3295082905a031fba11651cfe2e8d20c99257a1efc7d37ec848bb11def5cedc1cd44b1aa1ff68ab934123e842677bf844533826ffe2d5900a4ec510e8c44e155c574788aff9ef2d4985427e0285fbdf9b5ff5bb7e1d9ab038d50f1bca1801de0d5b2c63ca2b42fcbe56c42d258742f04959bd8c33fd33caf2e5053485d6c7f8a0bf02d0f1c5e4ade41b2a12ac2d5a7c865bac3cb960fd2fa3c7b8b0daad147a0c1428fe8f7b953e71e3b1508ba4e96ec60c7806de4e6a1d4248845cb0fec7f7490d082ff718f19ac94e261c0db2e367e016944a91f5d919706d72680f6fef3da7123e28d271cc5e3180512d07b744707a3ea9151f89c7e7c18bc9cd3e940a6137577eb72fadf4d3baa6d9c6f3973113519f9dfe683d1cbb6f5bbfe463bc5ce2ba885226e76e8386fb18b0626b4a3b8cc0d2290c89d6c447b5e0139dba1114fe704608314c943613d9ccc4bc01b1e0f00a6b788af22eb7d26d79c7a9e27a1d31f8387dd405adccbb570f22f1e62eaceef02143371170c235995c2a7a8a4e246d9e59ec577010bfddead807c148c3339a453c792a207d54e75823a25ccd11e6f0db848c7c48f524dbced9ab7d08d4c967de595faca98114ed2a5cfaf85f0d537bd875a7305c034c2bf3c2e9b737c416606769dbc81036153980c3f96b8234169e3ae4e2779463ebb671014e3fe93c4053730382cf71f72df9823f4bba77dfa74397e2432923179c66f025f0f86550e47dc559de20442c5644172f7908ced9c9fd62eb5c15cee70ef6c2e286711e57128d7cc8a117ddfd7a0fc6dbbcf0b42f9d2af5aee7b210a9c47af2c80a2f0bf9ecebb458ed3a57071823e4cc9e75b690a0d3195aed09e4f54d72e4d396c6d8709ae7c44fd96d9cd92b9504122000e6b40ac9c33b3be4367a1c5576bd456ce1054669c0d680ec3a45a0c92bafe8ef8596d98ff28dc428240faa9d6c9aa1a5e1c9f0814fd13f0b99e2a55db1def576950ab2d6c20bbc29d7eb7dd244ee8a1f80a1fe9cd59502da2d8fce3f10f9f76f8effbcb71f693acc8df4e3f954abd5a599ddb19dfae7209cd891938f7e2ab229ecfeb74d679c01114b06369edc338fd65e604e6d5010e921788e34deae7581a0f72c482e8ace88d53835c720933e4c86bbb141aa14f736ed0aa7007f64344a95e10d94ba9fbbf17388aa5cac8f1709c4a8f8a018699fc3063bd7908605bc9648c4155b234233101ce74bdbd3c9be92910de7a4f172b658564601b0bdcda3b7f983355255701775c1dc1f5f26adb5748c4a2141ca9cec48c5bbfac2d2368a5bff7ef504b7afc908cc8170597995f06ceaa16586e3fa6a17b656dbe2171733448420fffbe9bacda645b8669efd6dd3cfdba442f9a2f80642ce9a9a21172f6e68146ea40f9cf6c1ed72eaed6cb81718ba3f32c19902f399935b49e2db3b1df707a3b77fcd8d2187636891fd6d626929a7bbfdb66595a6c748ab9260f461fbd72cefe4b2dc26e3f7404525c4b927a1982cb9650d8caf976596990b4e6f47e38daacfbbd2507b8ef66fca51f65e7280b37334d2216108bd228b636bb6a3deebdad280a44f3c38fbacc8e71dd73e81abf6b4fb99a893207d215354493e90f30242c6606bd6e407ddcfcb273d55f8729f5315d55096c2cf1d112e53bf562f25026aa529bce84b3678839f596e7f75b59b40ba67f96be0b80f9c035fd399933d463465227a4238a03ee874fcaca44dc6ebadfa1cf4bbe7bf38933b421ee3fca20f8ed3b58fae0cbcde34ea7849b6f098d575db491ab50dd07376ad27b78bb69868000840d60b508b90b7c1b86af38048d6bf9de96ca8011d5e6192fd4b375a1e405e9f3dc5b08d27a163f120971033384f85f7ac91e24fb1bce5d16ed4f304ca219907bab822c4ac19d132248eef48c4f2b83344ac6c6f4a63af93475ce486dc9d33dd6032896fc8a4bf33d76aa25480127bb131e1f2bd8d49e4ce407652b6edf62d96ac27e1d61def06f78c8a105e23314fc98212ac81f8fe13bdd6cf3ed45da7eae8f6e3e550628b0f85b7fd1b02be3d0b2e4d225d00b5d53c8ada30ff067a7131897e7c548f23ec20b8ebaaae6c5dfbd8c5730a1e33ab56973fbbfe5d611a6aa2a77d51471057d7ae5517617d0aa957831a1dd6d079a8a827f9a6730c8926223074593f1e6cbc9a7b432f9810054c88d4eaa9a55def4bf6a86e18934d0b987c1a44bde96791bbeb04a64a64e934c7f20f3a4380be52852ee4318bbbb82862a7b8996551a17f4573a958bc5c41ac1be2dbd9397b5224b745ac2c7b06692b65bcfa5ceac379f990d1c7172445ca46f00644eedb17971f1590ed6ac6375e034f573f6a96e3bd19a1848929f4042f7a588523e6fbb9b4906e83859f03dafa5842b0dc1e845462280fef6dde0ecd2db155111b1ebb1844ee0e841772f06da1faee990f8cd29d5e96fc619d24a8b26e80b170262d22270f750c453f7502293aa16f9fc238314aef25117a22be7d10f7cf016e7f78f71314172e680501156e91a30d14fdadd7052207f22b47806826e8c22467dc976ec520d77c599dda16c82c4d4b80eef765ecdefd2e346ba41abce013f64676373978d027ca4f2646c42e608b4456c5c4c9f28c7a31ba185c7b42ab50fdd88302b41a5e71f2bc21d10f4812d9141bea1caf45ccddb56f0764976f87b2012559e4c893c59758f163c5635c9fe8874fa582b38ba4bfc078810e01d76a9752d54eebfc78326fd58656f8fee709fa9bf18cdd9e1d7e61aa3fb6a92df222be4afae321caf0c4ac8bbe83b53bf3530a4e89ee7c5144870d93cdb8eedc93c2210c694b406dc55becdfe130dd9afa695c77de07d25504fe2d64133cccff12885ed3be69444bddcbe8242537f98dbce55477ec57755cdd6377a23deebdff307150e018434acf3506d7dc2fb622b0672c633455f05b14c35444c39c128985c535894924466201831f8a54c57326a3771efb7e99edf388808828fe78a43ea841390ae3c870e39a9a6c342358b3bfd087cbd1732e4ddc41d2861b0b6dff506a204e5f62e90694c10d3418d45ddd1ff8e47a202e1c6917cd302480825c97ae294d9167db9689e90272dd2aeda4aa0dc9baffcd3f0b6eb33d9df778e27fde12543f9324dd76cac559f14236a6566c31b0971e887b4557cee444ea547e53d6a7fa053a44119377c993e8639d9e80377e263b9612784bd4e1242bdefc70690a24e2c974c1e19ac4038c09956cb1eab240a6f96aca0eb0dded99ad05dbd8920446c6bb6d3b66930a128ea0cb72fbbab0de2ba12a5fe9f0a515e82ecb033979535ed51fe8ddd35a83138224386189031114b2c066a4290b5d77acf1a931057784f0379a471f6afd12e5069d98b691047ab9ac39e4461ee07548e9bda15e606bd81ce5b849ef3950c5bba261aa0374a9481518966e9adf50e06b80a00b634c3f01f7dcd9f87166a454a28f9e57efcfa9a35cdc89d9d5bda05b53dc8eed0fe406012550740bfda5c20d22ce9b0fe9340351ee5b6718a840c8927a0b25cef8a5aebb04a038491fadd5291f61aadb4246e1183a049aeec193b6152b5437a72315208e395591d3e9e7c737d05a579ab382c662080cebc40fb36d7863210b6a3fac6794e033c9b8b5c5f2d1a7de5d5a91995b483f3a1ac6bcc4540f5b5716ae5e3fb4a98d72eec337c8353112da431aabe46957ed583e7b5fbcdb2dd81780529d74c6cf10273a1e3a639250a85577d9ce563c7012ac1ceebe0bc2736ec36a143af47fc17aea1e89c55f622b447def947e8e168d8983111b7d4529acda7ef6a66e9f8732ceda4e1fb7be25b2e2efa02a6029bf66a46ffad5760b5497dd2318c7556774e74c9d1594bc9e2e83f5ee48c3106798c5d1ac1b467e2bf29f4ff554b71b573354bb0fa9c67b91465c5487403da35582ceb4e91b58773c17ecf74f862a5e9fde8f41879502c9571ca0189d326294c8bf2d58f3555e12f4567a746d52cf7d3361d9b748a010a1867d33d1546341119619994478515234fa1cc0b6ebc8b2d8e470034245745ed74f3b1ea244bab34ddf7733cfc908013b839c17553eb93f8a14ee8e3ab7cdff5dfa80debae2aded04872606760a91052dea4080e9555b52b1605b8336ce1a57545116d4010f8edc10f5a55eed1c157d73b50477137249f3cdf8e17463a96cefefd8c93c2effb7572f71b09be58e41f349c31b9d5fd399d22fd7adb09d3eb61a40741d399e7abbcf5859e22e9486825bb39c13766cb28fa7247b40b4aa8af60b7fcff1ad41b19f572cc4a0496d517d43a6cb71b2ddf592a38ae3567aaa8de28dbe1c90ba7c96a675f908423a6ccb606bbf6ab26f7da78a42479bcae57eccfe5204d4027948107d3c03818450351e6148506919f83ef7235be6bf521d3a7dc171ff09243c2260c70af9bafdab07dd3435f18e656673daebdec86d6eb089609cf1e902ba6d72acd86cc25177f79b257cdcb2ca72e4ffc54cec996b1b073a40c347ca20bce85e47b0ecec0ca89bbd5194d71ba961722b17bded1cc49e32d0dbdf4d46a9e61652568cf4d7374fcfcda125ccabcb06a154af5155cbf641c1c220ad7b56dc13c4f2d6ad67296c48c05db92d752502e78bfc098ef6c4d81b5d19b21047ba15c857f45c470e353a09c938bca67351a97bcc2c37570df7b3f76e24bb713502cc7e54a17e1ff2cc4949fbe9a563589812b46edd955dfcdd6ef08fd8815f1c09eeeda85dc56a9ba9df609c9199137d7ef673516f9dc8989436d53f5fdee5dcda97c66e7f7e35c7b1698d060655d539ad16f61b8ba88a26a9d74a3e329ddffd8d0e2f7d04a63c80a7889bc6a4debf", 0x1000, 0x4}, {&(0x7f0000001400)="7b56a0232a2e403c351d6330fd433863075e82b205607f8b92f842e6e172d326fa89d15d10ebe031af6c2657c803b6e6ca0acd93f76dfcd8dc1bd0e3c13c540b951709c6c689879aa182c62ca9c083019c55dcf2fdb7cc5425db66975cfd1a4d295fc784ef7f8e771182c73cd7e99a8be69feb693608792e3084fdbe8ddbca3d4f140617af6d73a4ac964c1ae6aacbe48f867fa74fdcfd65aebaf91d69dd283a504fca7afae63a9fbfa3cdb54c52e89965b655c09c84155add13b91d655a5bed6d8f17ea", 0xc4, 0x7fffffff}, {&(0x7f0000001500)="b5020ff5f45c347f4391dd228ca84c49a3631221bfaa08e33894e8e294563ed173b1321e842eec12b60a92099f67407eac248fe8831c716d1993a331c383e8b9c63f58017ed724745f4da18586867c283b3b5cbfed1dd5cf3fdd41fc9101662203d29b31f343ce0817c81467a1fb8cbe3bdda2c593783c4480ce98cac51e8a5033e82d78586880be62af0377544c3910a985d0ee35c1f8f937f7909ceffb227fba44ca3a", 0xa4, 0x2}, {&(0x7f00000015c0)="4e2d2c28ae030058790263899c06e4587b762de4d5df325731264c55e67d0e98715761", 0x23, 0x2}, {&(0x7f0000001600)="7dc06912fcaae105970ce25cb4d5a17abc123a57a06814e5a5b440495c7790298e701db53725a29828817559b6a3fca3c921b4ccc8cdfbf63bc93cd1ed591deca854a2a3ff0213255927a0eb228305ee09f303ccddf7417aa70aac", 0x5b, 0x1}, {&(0x7f0000001680), 0x0, 0x7}], 0x102040, &(0x7f0000001900)={[{@data_journal='data=journal'}, {@acl='acl'}, {@grpjquota='grpjquota'}, {@grpquota='grpquota'}, {@hash_rupasov='hash=rupasov'}, {@hash_tea='hash=tea'}, {@tails_small='tails=small'}, {@balloc_noborder='block-allocator=noborder'}], [{@fowner_lt={'fowner<', r7}}]}) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r8, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) ioctl$PPPIOCSDEBUG(r6, 0x40047440, &(0x7f0000001ac0)=0x8) [ 2677.877197] binder: 20904:20967 ioctl c0306201 200002c0 returned -22 14:47:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000040000e0"], 0x0, 0x0, 0x0}) 14:47:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:54 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) 14:47:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2678.183032] binder: 21105:21106 unknown command 1024 14:47:54 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2678.219754] binder: 21105:21106 ioctl c0306201 200002c0 returned -22 [ 2678.255969] binder: 21105:21118 unknown command 1024 [ 2678.282276] binder: 21105:21118 ioctl c0306201 200002c0 returned -22 14:47:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000400463040000e0"], 0x0, 0x0, 0x0}) [ 2678.442406] binder: 21197:21207 unknown command 1123 [ 2678.464149] binder: 21197:21207 ioctl c0306201 200002c0 returned -22 [ 2678.482945] binder: 21197:21228 unknown command 1123 [ 2678.488507] binder: 21197:21228 ioctl c0306201 200002c0 returned -22 14:47:54 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:54 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r3) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:54 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) 14:47:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000050000e0"], 0x0, 0x0, 0x0}) [ 2678.777095] binder: 21233:21234 unknown command 1280 [ 2678.802673] binder: 21233:21234 ioctl c0306201 200002c0 returned -22 14:47:54 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2678.847023] binder: 21233:21262 unknown command 1280 [ 2678.857500] binder: 21233:21262 ioctl c0306201 200002c0 returned -22 14:47:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000060000e0"], 0x0, 0x0, 0x0}) 14:47:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:55 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) sigaltstack(&(0x7f0000012000/0x1000)=nil, &(0x7f0000000280)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) pipe2(&(0x7f0000000240), 0x84800) close(r2) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e22, 0x2, @mcast2, 0x4}}}, &(0x7f0000000180)=0x84) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000001c0)={r5, 0x8}, &(0x7f0000000200)=0x8) fanotify_init(0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:55 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2679.049448] binder_thread_write: 18 callbacks suppressed [ 2679.049463] binder: 21453:21454 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2679.114154] binder: 21453:21454 unknown command 1536 [ 2679.201873] binder: 21453:21454 ioctl c0306201 200002c0 returned -22 [ 2679.240271] binder: 21453:21503 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2679.240327] binder: 21453:21503 unknown command 1536 [ 2679.286626] binder: 21453:21503 ioctl c0306201 200002c0 returned -22 14:47:55 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:55 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) 14:47:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000070000e0"], 0x0, 0x0, 0x0}) 14:47:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:55 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/qat_adf_ctl\x00', 0x1, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000001c0)={0x0, 0x3}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000240)={r2, @in6={{0xa, 0x4e21, 0x0, @remote, 0x303}}}, 0x84) r3 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r1, 0x400442c9, &(0x7f0000000300)={0x53fc7c2f}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x3, 0x20242) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r5, 0xc02c5341, &(0x7f00000000c0)) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) close(r3) fanotify_init(0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0x4008af12, &(0x7f0000000140)={0x3, 0x7}) syz_kvm_setup_cpu$x86(r3, r7, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:55 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) r5 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x40881, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r5, &(0x7f00000000c0)={0x27, 0x3, 0x0, {0x4, 0x6, 0x0, '.\\user'}}, 0x27) [ 2679.743874] binder: 21570:21579 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2679.764917] binder: 21570:21579 unknown command 1792 [ 2679.772933] binder: 21570:21579 ioctl c0306201 200002c0 returned -22 14:47:55 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2679.817592] binder: 21570:21635 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2679.846422] binder: 21570:21635 unknown command 1792 [ 2679.870350] binder: 21570:21635 ioctl c0306201 200002c0 returned -22 14:47:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:56 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) 14:47:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000400463070000e0"], 0x0, 0x0, 0x0}) [ 2680.091872] binder: 21723:21754 IncRefs 0 refcount change on invalid ref 71303168 ret -22 [ 2680.127624] binder: 21723:21754 unknown command 1891 [ 2680.149410] binder: 21723:21754 ioctl c0306201 200002c0 returned -22 [ 2680.180768] binder: 21723:21903 IncRefs 0 refcount change on invalid ref 71303168 ret -22 [ 2680.199767] binder: 21723:21903 unknown command 1891 [ 2680.211890] binder: 21723:21903 ioctl c0306201 200002c0 returned -22 14:47:56 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:56 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x701040, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:56 executing program 3: ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) 14:47:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000401063080000e0"], 0x0, 0x0, 0x0}) 14:47:56 executing program 3: ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) [ 2680.470900] binder: 21915:21917 IncRefs 0 refcount change on invalid ref 272629760 ret -22 [ 2680.488321] binder: 21915:21917 unknown command 2147 [ 2680.504253] binder: 21915:21917 ioctl c0306201 200002c0 returned -22 [ 2680.523219] binder: 21915:21933 IncRefs 0 refcount change on invalid ref 272629760 ret -22 [ 2680.546561] binder: 21915:21933 unknown command 2147 [ 2680.557765] binder: 21915:21933 ioctl c0306201 200002c0 returned -22 14:47:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:56 executing program 3: ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) 14:47:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000401063090000e0"], 0x0, 0x0, 0x0}) 14:47:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:56 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:56 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x8, &(0x7f00000000c0)="3149e7a6ad400bc2d3e8c501748f9909a2c4312f1e8489f343563f28c93cd2f8218e9bea347bceb141a78cc5b1eefe25e8b649cc273ccfb60c0613242a1a7bee85c33a53785c8c2d90d51a6edc7d9b696aa91473926a89b0eeddc1253e9c13fa68c074f94ee2e65f00708f8c1aef671d361e38e17d93640d3034696a9594dad4fdc7ab1d62ac38c7a457815705041917370f0d4cd91b50d0c2960626d7d533724fd13351482221c897d431ec3b746c292d925da3bd614a11fb23542a186d7029436188055b47e5e46ba0c83e61f05736c564cb6095ab63e51675f2da9dd20de29db6d1cadc52167886a590313c9cbb745e021121e3382b70e209958164b3d40d94ffe502c87e65d229ddbed9f9441e1138751c60696f0f211efdc159cefa987592ef4430f0e391111a5897b50ddc914e123305533eeefc8856a8a1b7dc6a00830813a173ffff3b58ddc36af8061b1b6a") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) close(r1) keyctl$set_reqkey_keyring(0xe, 0x1) fanotify_init(0x0, 0x4) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000010000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000000)="6564f3e10e0f0015ba4100b84000ef0fbab90e00060f01f00f01d10f07260f300f01d12e0f30", 0x26}], 0x1, 0x10, &(0x7f0000000240)=[@vmwrite={0x8, 0x0, 0x3, 0x0, 0x3, 0x0, 0x6, 0x0, 0x80}], 0x1) [ 2680.745840] binder: 22198:22222 IncRefs 0 refcount change on invalid ref 272629760 ret -22 14:47:56 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2680.796588] binder: 22198:22222 unknown command 2403 [ 2680.801850] binder: 22198:22222 ioctl c0306201 200002c0 returned -22 14:47:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2680.901635] binder: 22198:22336 IncRefs 0 refcount change on invalid ref 272629760 ret -22 [ 2680.939769] binder: 22198:22336 unknown command 2403 14:47:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:57 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2680.966314] binder: 22198:22336 ioctl c0306201 200002c0 returned -22 14:47:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000000000a0000e0"], 0x0, 0x0, 0x0}) 14:47:57 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 2681.092891] binder: 22531:22538 unknown command 2560 14:47:57 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x10000) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2681.149700] binder: 22531:22538 ioctl c0306201 200002c0 returned -22 [ 2681.171541] binder: 22531:22590 unknown command 2560 14:47:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:57 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2681.207748] binder: 22531:22590 ioctl c0306201 200002c0 returned -22 14:47:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000004008630a0000e0"], 0x0, 0x0, 0x0}) 14:47:57 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:57 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2681.355222] binder: 22683:22684 unknown command 2659 [ 2681.375985] binder: 22683:22684 ioctl c0306201 200002c0 returned -22 [ 2681.397518] binder: 22683:22716 unknown command 2659 [ 2681.405254] binder: 22683:22716 ioctl c0306201 200002c0 returned -22 14:47:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000000630b0000e0"], 0x0, 0x0, 0x0}) 14:47:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:57 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:57 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2681.555748] binder: 22885:22891 unknown command 2915 14:47:57 executing program 1: r0 = socket$vsock_stream(0x28, 0x1, 0x0) fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f00000000c0)=@sha1={0x1, "e043d49220f13849795c8a5ba98f8cf642a4cfa7"}, 0x15, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r2) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, &(0x7f0000000180)={{0x2e, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21, 0x0, 'wlc\x00', 0x4, 0x8, 0x67}, {@dev={0xac, 0x14, 0x14, 0x28}, 0x4e23, 0x7, 0x2, 0x2, 0x2}}, 0x44) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r5, &(0x7f0000000100)='trusted.overlay.redirect\x00', &(0x7f0000000140)='.\x00', 0x2, 0x2) 14:47:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2681.648627] binder: 22885:22891 ioctl c0306201 200002c0 returned -22 14:47:57 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) 14:47:57 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 2681.710339] binder: 22885:22910 unknown command 2915 [ 2681.757683] binder: 22885:22910 ioctl c0306201 200002c0 returned -22 14:47:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000000630c0000e0"], 0x0, 0x0, 0x0}) 14:47:58 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) 14:47:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2681.924095] binder: 23119:23122 unknown command 3171 14:47:58 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x3) fsetxattr$security_selinux(r1, &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:ssh_exec_t:s0\x00', 0x20, 0x1) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) [ 2681.951960] binder: 23119:23122 ioctl c0306201 200002c0 returned -22 [ 2682.018623] binder: 23119:23140 unknown command 3171 14:47:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:58 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) [ 2682.057067] binder: 23119:23140 ioctl c0306201 200002c0 returned -22 14:47:58 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000000630d0000e0"], 0x0, 0x0, 0x0}) 14:47:58 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) 14:47:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r2) fanotify_init(0x200000000, 0x1) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0xfffffd74, 0x0, 0x0, 0x0) [ 2682.270596] binder: 23362:23363 unknown command 3427 [ 2682.295677] binder: 23362:23363 ioctl c0306201 200002c0 returned -22 14:47:58 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:58 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) [ 2682.330921] binder: 23362:23424 unknown command 3427 [ 2682.370535] binder: 23362:23424 ioctl c0306201 200002c0 returned -22 14:47:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000400c630e0000e0"], 0x0, 0x0, 0x0}) 14:47:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:58 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) [ 2682.562253] binder: 23489:23492 unknown command 3683 [ 2682.577242] binder: 23489:23492 ioctl c0306201 200002c0 returned -22 [ 2682.589225] binder: 23489:23543 unknown command 3683 [ 2682.594646] binder: 23489:23543 ioctl c0306201 200002c0 returned -22 14:47:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:58 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000400c630f0000e0"], 0x0, 0x0, 0x0}) 14:47:58 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x8000) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f00000000c0)={0x0, 0xc, [0xfffffffffffff548, 0x8, 0x1]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r5, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) 14:47:58 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) [ 2682.735806] binder: 23655:23667 unknown command 3939 [ 2682.761195] binder: 23655:23667 ioctl c0306201 200002c0 returned -22 14:47:58 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:58 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, 0x0) 14:47:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2682.809099] binder: 23655:23708 unknown command 3939 [ 2682.814368] binder: 23655:23708 ioctl c0306201 200002c0 returned -22 14:47:59 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, 0x0) 14:47:59 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:59 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) close(r1) fanotify_init(0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7fffffff, 0x101000) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x356, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f00000000c0)={0x3, 0x3, 0x8000, 0x2, 0x0}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000000140)={r6, 0x101}, &(0x7f0000000180)=0x8) 14:47:59 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_ALM_SET(r0, 0x40247007, 0x0) 14:47:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000400863100000e0"], 0x0, 0x0, 0x0}) 14:47:59 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:47:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:59 executing program 3: r0 = socket$kcm(0x10, 0x400000000000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="2e00000018008100e00d80ecdb4cb9041c4865160b000000d4126efb040004002b51da1b40d819a9ffe200040000", 0x2e}], 0x1}, 0x0) 14:47:59 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x2, 0x0, 0x0}) [ 2683.316359] binder: 23942:23948 unknown command 4195 [ 2683.326122] netlink: 'syz-executor.3': attribute type 4 has an invalid length. [ 2683.334050] binder: 23942:23948 ioctl c0306201 200002c0 returned -22 [ 2683.340930] binder: 23944:23946 transaction failed 29189/-22, size 0-8 line 2855 14:47:59 executing program 3: r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0xc0, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r0, r0}, &(0x7f0000000440)=""/243, 0xf3, &(0x7f0000000240)={&(0x7f00000001c0)={'crct10dif-generic\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\x8d\x00'}}) [ 2683.363367] binder: 23944:23946 ioctl c0306201 20000440 returned -14 [ 2683.372839] binder: 23942:23968 unknown command 4195 [ 2683.375418] binder: undelivered TRANSACTION_ERROR: 29189 [ 2683.389375] binder: 23942:23968 ioctl c0306201 200002c0 returned -22 14:47:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000404863110000e0"], 0x0, 0x0, 0x0}) 14:47:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:47:59 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffc7, &(0x7f0000000140)) [ 2683.562820] binder: 24164:24165 unknown command 4451 [ 2683.611761] binder: 24164:24165 ioctl c0306201 200002c0 returned -22 14:47:59 executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @initdev}}}}, 0x0) [ 2683.658672] binder: 24164:24285 unknown command 4451 14:47:59 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000001c0)={0x0, {0x2, 0x0, @local}, {0x2, 0x0, @dev}, {0x2, 0x0, @remote}}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write(r0, &(0x7f0000000140)="150000000800080000000000c86b6525000010", 0x13) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0) [ 2683.681082] binder: 24164:24285 ioctl c0306201 200002c0 returned -22 14:48:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000120000e0"], 0x0, 0x0, 0x0}) 14:48:00 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_TSC_KHZ(r0, 0xaea2, 0x0) flistxattr(r0, &(0x7f0000000240)=""/67, 0x43) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000000)={'IDLETIMER\x00'}, &(0x7f0000000040)=0x1e) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f00000000c0)="66b8ea000f00d8eadd5484f88a00f0833600660f71d50066ba4100edb8010000000f01d90f0866b8bd008ee0b94d0200000f32360f07", 0x36}], 0xaaaaaaaaaaaabce, 0x5, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 14:48:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:48:00 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 2683.909739] binder: 24483:24484 unknown command 4608 14:48:00 executing program 1: perf_event_open(0x0, 0xffffffffffffffff, 0x800, 0xffffffffffffffff, 0x0) clone(0x13102001fee, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, &(0x7f00000000c0)={0x0, 0x1}) r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x3) write$binfmt_misc(r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000100)=[0xee01, 0xee00]) socketpair(0x9, 0x2, 0x1, &(0x7f0000000000)) [ 2683.937277] binder: 24483:24484 ioctl c0306201 200002c0 returned -22 [ 2683.972085] binder: 24483:24533 unknown command 4608 14:48:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2684.013777] binder: 24483:24533 ioctl c0306201 200002c0 returned -22 14:48:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000404863120000e0"], 0x0, 0x0, 0x0}) 14:48:00 executing program 1: syz_emit_ethernet(0x2a, &(0x7f0000000380)={@local, @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, @udp={0x0, 0x0, 0x8}}}}}, 0x0) [ 2684.248729] binder_thread_write: 20 callbacks suppressed [ 2684.248744] binder: 24713:24716 IncRefs 0 refcount change on invalid ref 1212153856 ret -22 [ 2684.299930] binder: 24713:24716 unknown command 4707 [ 2684.318463] binder: 24713:24716 ioctl c0306201 200002c0 returned -22 14:48:00 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="baa000edf26df20f080347640f0058d5640f320f381dec0f221b8d4e9c66b80500000066b94a7b00000f01c1", 0x2c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$vsock(0xffffffffffffff9c, 0x0, 0x2000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb], 0x1f000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2684.358110] binder: 24713:24813 IncRefs 0 refcount change on invalid ref 1212153856 ret -22 [ 2684.386602] binder: 24713:24813 unknown command 4707 [ 2684.391878] binder: 24713:24813 ioctl c0306201 200002c0 returned -22 14:48:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:48:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000200000e0"], 0x0, 0x0, 0x0}) [ 2684.615740] binder: 25027:25028 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2684.631387] picdev_read: 2 callbacks suppressed [ 2684.631405] kvm: pic: non byte read [ 2684.653936] binder: 25027:25028 unknown command 8192 [ 2684.660428] binder: 25027:25028 ioctl c0306201 200002c0 returned -22 14:48:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) dup2(r0, r1) 14:48:00 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2684.694743] kvm: pic: non byte read [ 2684.717637] kvm: pic: non byte read [ 2684.722501] kvm: pic: non byte read [ 2684.750461] binder: 25027:25040 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2684.768835] kvm: pic: non byte read [ 2684.785993] kvm: pic: non byte read [ 2684.791170] binder: 25027:25040 unknown command 8192 [ 2684.798997] binder: 25027:25040 ioctl c0306201 200002c0 returned -22 [ 2684.826034] kvm: pic: non byte read 14:48:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000026304400000e0"], 0x0, 0x0, 0x0}) [ 2684.848041] kvm: pic: non byte read [ 2684.874378] kvm: pic: non byte read 14:48:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="baa000edf26df20f080347640f0058d5640f320f381dec0f221b8d4e9c66b80500000066b94a7b00000f01c1", 0x2c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vsock\x00', 0x0, 0x0) sendmsg$key(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x2, 0x5, 0x9a90, 0x0, 0x2}, 0x10}}, 0x20000000) syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb], 0x1f000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14:48:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2684.894899] kvm: pic: non byte read [ 2684.914597] binder: 25243:25244 IncRefs 0 refcount change on invalid ref 1661075456 ret -22 [ 2684.976897] binder: 25243:25244 unknown command 16388 [ 2685.017929] binder: 25243:25244 ioctl c0306201 200002c0 returned -22 [ 2685.101090] binder: 25243:25298 IncRefs 0 refcount change on invalid ref 1661075456 ret -22 [ 2685.126593] binder: 25243:25298 unknown command 16388 [ 2685.130646] kvm: pic: single mode not supported [ 2685.140523] binder: 25243:25298 ioctl c0306201 200002c0 returned -22 14:48:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:48:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2685.186311] kvm: pic: level sensitive irq not supported [ 2685.194933] kvm: pic: single mode not supported [ 2685.201280] kvm: pic: level sensitive irq not supported 14:48:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="baa000edf26df20f080347640f0058d5640f320f381dec0f221b8d4e9c66b80500000066b94a7b00000f01c1", 0x2c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$key(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x2, 0x0, 0x0, 0xb, 0x2}, 0x10}}, 0x0) syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb], 0x1f000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14:48:01 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000046304400000e0"], 0x0, 0x0, 0x0}) [ 2685.363238] binder: 25462:25470 IncRefs 0 refcount change on invalid ref 1661206528 ret -22 [ 2685.408402] binder: 25462:25470 unknown command 16388 [ 2685.443419] binder: 25462:25470 ioctl c0306201 200002c0 returned -22 14:48:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2685.474919] binder: 25462:25658 IncRefs 0 refcount change on invalid ref 1661206528 ret -22 14:48:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="baa000edf26df20f080347640f0058d5640f320f381dec0f221b8d4e9c66b80500000066b94a7b00000f01c1", 0x2c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vsock\x00', 0x0, 0x0) sendmsg$key(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x2, 0x5, 0x9a90, 0x0, 0x2}, 0x10}}, 0x20000000) syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb], 0x1f000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14:48:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2685.533105] kvm: pic: single mode not supported 14:48:01 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2685.592449] kvm: pic: level sensitive irq not supported [ 2685.595125] kvm: pic: single mode not supported [ 2685.600915] kvm: pic: level sensitive irq not supported [ 2685.636371] binder: 25462:25658 unknown command 16388 [ 2685.681492] binder: 25462:25658 ioctl c0306201 200002c0 returned -22 14:48:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000076304400000e0"], 0x0, 0x0, 0x0}) 14:48:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000011000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) setxattr$trusted_overlay_upper(0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00fb16e8ffbd7c"], 0x1, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 2685.772370] kvm: pic: single mode not supported 14:48:02 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:48:02 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 2685.823562] kvm: pic: level sensitive irq not supported [ 2685.845125] kvm: pic: single mode not supported [ 2685.850864] kvm: pic: level sensitive irq not supported [ 2685.914461] binder: 25894:25897 IncRefs 0 refcount change on invalid ref 1661403136 ret -22 [ 2685.973696] binder: 25894:25897 unknown command 16388 [ 2685.986768] binder: 25894:25897 ioctl c0306201 200002c0 returned -22 14:48:02 executing program 3: r0 = syz_open_dev$usbmon(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) ioctl$TIOCNXCL(r0, 0x540d) r1 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r1, 0xffffffffffffffc7, &(0x7f0000000140)) socket$inet_udplite(0x2, 0x2, 0x88) syz_genetlink_get_family_id$tipc2(&(0x7f0000000500)='TIPCv2\x00') [ 2686.040547] binder: 25894:25988 IncRefs 0 refcount change on invalid ref 1661403136 ret -22 14:48:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2686.093724] binder: 25894:25988 unknown command 16388 [ 2686.112905] binder: 25894:25988 ioctl c0306201 200002c0 returned -22 14:48:02 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000003c0)="0adc1f123c123f319bd070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r2, 0x105, 0x0, 0x0, {{}, 0x0, 0x2, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}}, 0x0) 14:48:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000036308400000e0"], 0x0, 0x0, 0x0}) [ 2686.339458] binder: 26237:26258 unknown command 16392 14:48:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@nat={'XatY\x00\x00\x00\x00\x00\x03\xe0\x01\x00', 0x19, 0x3, 0x90, [0x20001600, 0x0, 0x0, 0x200018d8, 0x20001908], 0x0, 0x0, &(0x7f0000001600)=[{0x4}, {0x0, '\x00', 0x2}, {0x0, '\x00', 0x2}]}, 0x108) [ 2686.362541] binder: 26237:26258 ioctl c0306201 200002c0 returned -22 14:48:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 2686.402983] binder: 26237:26430 unknown command 16392 14:48:02 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='!']}) [ 2686.436404] binder: 26237:26430 ioctl c0306201 200002c0 returned -22 14:48:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000a6308400000e0"], 0x0, 0x0, 0x0}) 14:48:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2686.582526] binder: 26498:26499 unknown command 16392 [ 2686.626351] binder: 26498:26499 ioctl c0306201 200002c0 returned -22 [ 2686.670015] binder: 26498:26554 unknown command 16392 [ 2686.688752] binder: 26498:26554 ioctl c0306201 200002c0 returned -22 14:48:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:03 executing program 1: getcwd(&(0x7f0000000100)=""/62, 0x3e) 14:48:03 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1, 0x0, 0x0, 0x0}, 0x0) 14:48:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000106308400000e0"], 0x0, 0x0, 0x0}) 14:48:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2686.911581] binder: 26669:26675 unknown command 16392 14:48:03 executing program 1: r0 = add_key(&(0x7f0000000080)='.request_key_auth\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) r1 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$unlink(0x9, r0, r1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x1, 0x6) ioctl$int_in(r3, 0x800000c004500a, &(0x7f0000000040)=0x6) write$FUSE_NOTIFY_RETRIEVE(r3, 0x0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, 0x0) dup2(r2, r3) socket$isdn(0x22, 0x3, 0x25) epoll_create1(0x0) 14:48:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2686.937056] binder: 26669:26675 ioctl c0306201 200002c0 returned -22 [ 2686.975150] binder: 26669:26737 unknown command 16392 [ 2687.010572] binder: 26669:26737 ioctl c0306201 200002c0 returned -22 14:48:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000e630c400000e0"], 0x0, 0x0, 0x0}) 14:48:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x2) 14:48:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2687.209858] binder: 26826:26827 unknown command 16396 [ 2687.240095] binder: 26826:26827 ioctl c0306201 200002c0 returned -22 14:48:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x3) [ 2687.325697] binder: 26826:27005 unknown command 16396 [ 2687.373251] binder: 26826:27005 ioctl c0306201 200002c0 returned -22 14:48:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:03 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000f630c400000e0"], 0x0, 0x0, 0x0}) 14:48:03 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000300)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd000000100001000b081000418e00000004fcff", 0x58}], 0x1) 14:48:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x4) [ 2687.771192] binder: 27118:27119 unknown command 16396 14:48:03 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000040)=0x2000000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0x0, 0x40000007ffe}, 0x14) 14:48:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2687.816618] binder: 27118:27119 ioctl c0306201 200002c0 returned -22 [ 2687.856074] binder: 27118:27132 unknown command 16396 14:48:04 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 2687.890153] binder: 27118:27132 ioctl c0306201 200002c0 returned -22 14:48:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000086310400000e0"], 0x0, 0x0, 0x0}) 14:48:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x5) [ 2688.110262] binder: 27348:27349 unknown command 16400 [ 2688.118634] binder: 27348:27349 ioctl c0306201 200002c0 returned -22 [ 2688.161585] binder: 27348:27355 unknown command 16400 [ 2688.191459] binder: 27348:27355 ioctl c0306201 200002c0 returned -22 14:48:04 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:04 executing program 1: r0 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-twofish-3way\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x10000080800) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000200)={r1, r1}) 14:48:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000096310400000e0"], 0x0, 0x0, 0x0}) 14:48:04 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, 0x0, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x6) [ 2688.496781] binder: 27463:27469 unknown command 16400 [ 2688.516710] binder: 27463:27469 ioctl c0306201 200002c0 returned -22 14:48:04 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2688.562783] binder: 27463:27545 unknown command 16400 [ 2688.624382] binder: 27463:27545 ioctl c0306201 200002c0 returned -22 14:48:04 executing program 1: r0 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-twofish-3way\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x10000080800) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000200)={r1, r1}) 14:48:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xa) 14:48:04 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000006340400000e0"], 0x0, 0x0, 0x0}) 14:48:04 executing program 1: r0 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-twofish-3way\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x10000080800) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000200)={r1, r1}) 14:48:05 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2688.870254] binder: 27713:27724 unknown command 16448 [ 2688.914560] binder: 27713:27724 ioctl c0306201 200002c0 returned -22 [ 2688.967434] binder: 27713:27805 unknown command 16448 14:48:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xc) [ 2688.991933] binder: 27713:27805 ioctl c0306201 200002c0 returned -22 14:48:05 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, 0x0, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000016340400000e0"], 0x0, 0x0, 0x0}) 14:48:05 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xe) 14:48:05 executing program 1: r0 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-twofish-3way\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x10000080800) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000200)={r1, r1}) 14:48:05 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2689.526399] binder_thread_write: 16 callbacks suppressed [ 2689.526428] binder: 27916:27926 IncRefs 0 refcount change on invalid ref 1661009920 ret -22 14:48:05 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9917}, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x4003ff) r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4006, 0x0) sendfile(r1, r1, 0x0, 0x8800000) [ 2689.604594] binder: 27916:27926 unknown command 16448 [ 2689.640022] binder: 27916:27926 ioctl c0306201 200002c0 returned -22 14:48:05 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2689.680475] binder: 27916:28008 IncRefs 0 refcount change on invalid ref 1661009920 ret -22 14:48:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x10) [ 2689.731122] binder: 27916:28008 unknown command 16448 [ 2689.767953] audit: type=1800 audit(1556117285.885:932): pid=28010 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=16702 res=0 [ 2689.804562] binder: 27916:28008 ioctl c0306201 200002c0 returned -22 14:48:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000116348400000e0"], 0x0, 0x0, 0x0}) [ 2690.035459] binder: 28079:28105 IncRefs 0 refcount change on invalid ref 1662058496 ret -22 [ 2690.077050] binder: 28079:28105 unknown command 16456 [ 2690.096614] binder: 28079:28105 ioctl c0306201 200002c0 returned -22 [ 2690.135974] binder: 28079:28150 IncRefs 0 refcount change on invalid ref 1662058496 ret -22 [ 2690.220855] binder: 28079:28150 unknown command 16456 [ 2690.226146] binder: 28079:28150 ioctl c0306201 200002c0 returned -22 14:48:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, 0x0, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:06 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:06 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x17) 14:48:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000126348400000e0"], 0x0, 0x0, 0x0}) 14:48:06 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9917}, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x4003ff) r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4006, 0x0) sendfile(r1, r1, 0x0, 0x8800000) 14:48:06 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2690.811685] binder: 28266:28279 IncRefs 0 refcount change on invalid ref 1662124032 ret -22 [ 2690.878090] binder: 28266:28279 unknown command 16456 [ 2690.892022] audit: type=1800 audit(1556117287.015:933): pid=28264 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=17346 res=0 14:48:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x60) 14:48:07 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2690.946989] binder: 28266:28279 ioctl c0306201 200002c0 returned -22 [ 2690.971166] binder: 28266:28378 IncRefs 0 refcount change on invalid ref 1662124032 ret -22 14:48:07 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2691.035784] binder: 28266:28378 unknown command 16456 [ 2691.077861] binder: 28266:28378 ioctl c0306201 200002c0 returned -22 14:48:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000480000e0"], 0x0, 0x0, 0x0}) [ 2691.244850] binder: 28489:28490 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2691.285425] binder: 28489:28490 unknown command 18432 [ 2691.311339] binder: 28489:28490 ioctl c0306201 200002c0 returned -22 [ 2691.350787] binder: 28489:28492 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2691.372139] binder: 28489:28492 unknown command 18432 [ 2691.386887] binder: 28489:28492 ioctl c0306201 200002c0 returned -22 14:48:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:07 executing program 3: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:08 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x1a0) 14:48:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000000004c0000e0"], 0x0, 0x0, 0x0}) 14:48:08 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:08 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200aa0802000000000000000000000105000600200000000a00000000000000000500e50000070000001f000000000000250000000000000200010000000000002000020000627c05000500000000000a00000000010000ff1700000000000000000000000001170000000000000000"], 0x80}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400000000000238, 0x0) [ 2691.883841] binder: 28505:28506 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2691.918967] binder: 28505:28506 unknown command 19456 14:48:08 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2691.958252] binder: 28505:28506 ioctl c0306201 200002c0 returned -22 [ 2691.996178] binder: 28505:28698 IncRefs 0 refcount change on invalid ref 0 ret -22 14:48:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x2a0) [ 2692.045736] binder: 28505:28698 unknown command 19456 14:48:08 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) 14:48:08 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r0 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2692.090453] binder: 28505:28698 ioctl c0306201 200002c0 returned -22 14:48:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000600000e0"], 0x0, 0x0, 0x0}) [ 2692.229015] binder: 28810:28815 unknown command 24576 [ 2692.257039] binder: 28810:28815 ioctl c0306201 200002c0 returned -22 [ 2692.306622] binder: 28810:28931 unknown command 24576 [ 2692.311886] binder: 28810:28931 ioctl c0306201 200002c0 returned -22 14:48:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x300) 14:48:08 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:08 executing program 1: r0 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, 0xffffffffffffffff, 0x0) 14:48:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000680000e0"], 0x0, 0x0, 0x0}) 14:48:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x4a0) [ 2692.835029] binder: 29052:29053 unknown command 26624 14:48:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2692.860160] binder: 29052:29053 ioctl c0306201 200002c0 returned -22 [ 2692.891030] binder: 29052:29153 unknown command 26624 [ 2692.896285] binder: 29052:29153 ioctl c0306201 200002c0 returned -22 14:48:09 executing program 1: r0 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, 0xffffffffffffffff, 0x0) 14:48:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000000006c0000e0"], 0x0, 0x0, 0x0}) 14:48:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x500) 14:48:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2693.105855] binder: 29268:29269 unknown command 27648 [ 2693.135845] binder: 29268:29269 ioctl c0306201 200002c0 returned -22 [ 2693.165376] binder: 29268:29307 unknown command 27648 [ 2693.180819] binder: 29268:29307 ioctl c0306201 200002c0 returned -22 14:48:09 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) write$FUSE_STATFS(r0, &(0x7f00000000c0)={0x60}, 0x60) 14:48:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:09 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, 0x0, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000000740000e0"], 0x0, 0x0, 0x0}) 14:48:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x600) 14:48:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2693.665122] binder: 29488:29490 unknown command 29696 14:48:09 executing program 1: [ 2693.693574] binder: 29488:29490 ioctl c0306201 200002c0 returned -22 [ 2693.725658] binder: 29488:29500 unknown command 29696 14:48:09 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2693.769022] binder: 29488:29500 ioctl c0306201 200002c0 returned -22 14:48:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000000000007a0000e0"], 0x0, 0x0, 0x0}) 14:48:10 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="baa000edf26df20f080347640f0058d5640f320f381dec0f221b8d4e9c66b80500000066b94a7b00000f01c1", 0x2c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb], 0x1f000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14:48:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x8a0) 14:48:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2693.949413] binder: 29607:29608 unknown command 31232 [ 2693.995615] binder: 29607:29608 ioctl c0306201 200002c0 returned -22 [ 2694.031484] binder: 29607:29616 unknown command 31232 [ 2694.037877] picdev_read: 53 callbacks suppressed 14:48:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2694.037883] kvm: pic: non byte read [ 2694.048231] binder: 29607:29616 ioctl c0306201 200002c0 returned -22 [ 2694.077310] kvm: pic: non byte read [ 2694.100885] kvm: pic: non byte read [ 2694.124118] kvm: pic: non byte read [ 2694.148585] kvm: pic: non byte read [ 2694.159526] kvm: pic: non byte read [ 2694.163612] kvm: pic: non byte read [ 2694.183885] kvm: pic: non byte read [ 2694.191642] kvm: pic: non byte read [ 2694.204037] kvm: pic: non byte read 14:48:10 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000008000a00000e0"], 0x0, 0x0, 0x0}) 14:48:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xa00) 14:48:10 executing program 1: r0 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) accept4(r1, 0x0, 0x0, 0x10000080800) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000200)) 14:48:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2694.655157] binder_thread_write: 10 callbacks suppressed [ 2694.655174] binder: 29831:29833 IncRefs 0 refcount change on invalid ref -2147483648 ret -22 [ 2694.694924] binder: 29831:29833 unknown command 40960 14:48:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d770") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2694.702992] binder: 29831:29833 ioctl c0306201 200002c0 returned -22 [ 2694.722931] binder: 29831:29889 IncRefs 0 refcount change on invalid ref -2147483648 ret -22 [ 2694.737557] binder: 29831:29889 unknown command 40960 14:48:10 executing program 1: r0 = getpgrp(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) accept4(r1, 0x0, 0x0, 0x10000080800) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000200)) 14:48:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xc00) [ 2694.781333] binder: 29831:29889 ioctl c0306201 200002c0 returned -22 14:48:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d770") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000001a00000e0"], 0x0, 0x0, 0x0}) 14:48:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d770") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2695.024696] binder: 30127:30158 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2695.062822] binder: 30127:30158 unknown command 40961 [ 2695.086711] binder: 30127:30158 ioctl c0306201 200002c0 returned -22 [ 2695.117591] binder: 30127:30163 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2695.136279] binder: 30127:30163 unknown command 40961 [ 2695.152051] binder: 30127:30163 ioctl c0306201 200002c0 returned -22 14:48:11 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xe00) 14:48:11 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="baa000edf26df20f080347640f0058d5640f320f381dec0f221b8d4e9c66b80500000066b94a7b00000f01c1", 0x2c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb], 0x1f000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14:48:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000002a00000e0"], 0x0, 0x0, 0x0}) 14:48:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319b") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2695.555226] binder: 30171:30173 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2695.583584] binder: 30171:30173 unknown command 40962 14:48:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319b") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2695.608231] binder: 30171:30173 ioctl c0306201 200002c0 returned -22 [ 2695.626800] binder: 30171:30204 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2695.664686] binder: 30171:30204 unknown command 40962 [ 2695.683986] binder: 30171:30204 ioctl c0306201 200002c0 returned -22 14:48:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x1700) 14:48:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319b") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000004a00000e0"], 0x0, 0x0, 0x0}) [ 2695.848213] binder: 30350:30368 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2695.885580] binder: 30350:30368 unknown command 40964 14:48:12 executing program 1: ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000740)={"e1ed75d5e5d7d66c28962e10ba20cd805ba17ecac2b13bdcd3aa3f3d50ca3697a7852c0703a8408eb5058dc7a253f0ae04a40c2482d8ef525e87c3e3fbd208fae4467c2f6dccd8b6d34c20aa6927024e4db8734fc44a83cacf746b44bbe3073dc288ac1b9c55b8223fd5cc2ae21fe816e64a9cdec8d9acacb2a54acc35e43481cefff86403f5a58fb6ccb59c29cae48816a9c5b8841bd935349dcd88d42fc5a1b12c319596142c600c2f5693bce364a5016a8b4beefc50f8f8cd15e79ba214b0ba14076e4e6501d099ca87db3b548a832e2806fd4d42fddd742e8bad1266859c116733f96c49a5afc10432192dbd2a24429a67f9fdbe4688e89d91e0cb03d6f011ccfc45d495bbc427035e00c570a3e0924bc645af6a30c9f889b7bc38066b9938242a71baa1dc08c6e3e34b6f606d419f3aa418587276a08b321b63f4336d24e1829638682032150718f79c0a5d2d87170925d5226a517017e391739fdf1d384238a3687b28d842ad45ee3b210d176dfe98326d2a7a9bef7eceba5f65d06cef986e2bae77084ae7f23ff869656b15fceb10ade13bb7bcda1c1b5bf4c17cc67ade4e4eadecf748c72a3f6b6a1f4ace3398a103556f1dbf7feceb526541cae21ce6a15b7362478d9e0420d656c91da0cb2ec4de6e078180db887f92eb49f3b8fccf612fb1e9143c35626294f4625ab0863767c96b6b93a5c525740b4032e0468d284579cf46969ac8166db80941d7beea7858d86687c11bfc6b773e81dd8bd58bf893e34c54b4c7ed3872161505c01525061b9c47c3e40bb49a72a925cf34409c93e2c2bfda77bfab0685683d6752fe1a12ef3eae656e98946a007d81a11dfd0f758dde0badf8d7790746f34c936d6078dac102661ab705aceded833f0558a5bff22b9f36166a0851f50b955cb2567e7093a492ad86675aa86fb523f33b6d65fa4268401bae136d90273dc6c51cc4ca1433529e12f86fc2183b9684274e268791bc44bc9faa2740fe55b816348529e1c867827f244c0ef340434eed0b3afe9f6eca2629e164ad1137a73d1bbbb62e7bcea5951ab4cdc34971d32fea692327fc62b369fc5f7f98f4b1f47c08c723978547f7b39067cb978e93952b5454ac568878ff80c726cc8892b4c7f25279d6670f03b3fe91308f52923b1cc320287c8a5c268c3a1509906993cdb8cc8cd6e3fa598336fadcc07e20ffa848986533413e4310e60f3413442032bf97c80042f144fe905b3cd28d76ddc1cf03bf022b52fe07989d0433bd07f6c0cc8fd139f2a0739a44f99643f8a98d0a9383116e89901f7a5ff32adcfaceb97d61c067522e5069f57d03683e6285ff848573b8b066a539fd0d4cd6ba1a3bd0b2705d2ad1a63465948629efb2e6194517becc10177c05f11979369231f72c97f6e5803bb8527650fb8b7f7808649920872d530331dd377da85a"}) mount$9p_rdma(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000500)={'trans=rdma,', {'port'}}) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/loop-control\x00', 0x0, 0x0) keyctl$get_security(0x11, 0x0, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) removexattr(0x0, &(0x7f00000000c0)=@random={'osx.', 'self($vboxnet0-vboxnet0lo^)\x00'}) connect$unix(0xffffffffffffffff, &(0x7f0000000140)=@abs, 0x6e) semget$private(0x0, 0x0, 0x100) creat(&(0x7f0000000000)='./file0\x00', 0x10) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) syncfs(r0) [ 2695.911702] binder: 30350:30368 ioctl c0306201 200002c0 returned -22 14:48:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd0") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2695.963101] binder: 30350:30486 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2696.062182] binder: 30350:30486 unknown command 40964 [ 2696.123322] binder: 30350:30486 ioctl c0306201 200002c0 returned -22 14:48:12 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x2000) 14:48:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd0") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000008a00000e0"], 0x0, 0x0, 0x0}) 14:48:12 executing program 1: ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000740)={"e1ed75d5e5d7d66c28962e10ba20cd805ba17ecac2b13bdcd3aa3f3d50ca3697a7852c0703a8408eb5058dc7a253f0ae04a40c2482d8ef525e87c3e3fbd208fae4467c2f6dccd8b6d34c20aa6927024e4db8734fc44a83cacf746b44bbe3073dc288ac1b9c55b8223fd5cc2ae21fe816e64a9cdec8d9acacb2a54acc35e43481cefff86403f5a58fb6ccb59c29cae48816a9c5b8841bd935349dcd88d42fc5a1b12c319596142c600c2f5693bce364a5016a8b4beefc50f8f8cd15e79ba214b0ba14076e4e6501d099ca87db3b548a832e2806fd4d42fddd742e8bad1266859c116733f96c49a5afc10432192dbd2a24429a67f9fdbe4688e89d91e0cb03d6f011ccfc45d495bbc427035e00c570a3e0924bc645af6a30c9f889b7bc38066b9938242a71baa1dc08c6e3e34b6f606d419f3aa418587276a08b321b63f4336d24e1829638682032150718f79c0a5d2d87170925d5226a517017e391739fdf1d384238a3687b28d842ad45ee3b210d176dfe98326d2a7a9bef7eceba5f65d06cef986e2bae77084ae7f23ff869656b15fceb10ade13bb7bcda1c1b5bf4c17cc67ade4e4eadecf748c72a3f6b6a1f4ace3398a103556f1dbf7feceb526541cae21ce6a15b7362478d9e0420d656c91da0cb2ec4de6e078180db887f92eb49f3b8fccf612fb1e9143c35626294f4625ab0863767c96b6b93a5c525740b4032e0468d284579cf46969ac8166db80941d7beea7858d86687c11bfc6b773e81dd8bd58bf893e34c54b4c7ed3872161505c01525061b9c47c3e40bb49a72a925cf34409c93e2c2bfda77bfab0685683d6752fe1a12ef3eae656e98946a007d81a11dfd0f758dde0badf8d7790746f34c936d6078dac102661ab705aceded833f0558a5bff22b9f36166a0851f50b955cb2567e7093a492ad86675aa86fb523f33b6d65fa4268401bae136d90273dc6c51cc4ca1433529e12f86fc2183b9684274e268791bc44bc9faa2740fe55b816348529e1c867827f244c0ef340434eed0b3afe9f6eca2629e164ad1137a73d1bbbb62e7bcea5951ab4cdc34971d32fea692327fc62b369fc5f7f98f4b1f47c08c723978547f7b39067cb978e93952b5454ac568878ff80c726cc8892b4c7f25279d6670f03b3fe91308f52923b1cc320287c8a5c268c3a1509906993cdb8cc8cd6e3fa598336fadcc07e20ffa848986533413e4310e60f3413442032bf97c80042f144fe905b3cd28d76ddc1cf03bf022b52fe07989d0433bd07f6c0cc8fd139f2a0739a44f99643f8a98d0a9383116e89901f7a5ff32adcfaceb97d61c067522e5069f57d03683e6285ff848573b8b066a539fd0d4cd6ba1a3bd0b2705d2ad1a63465948629efb2e6194517becc10177c05f11979369231f72c97f6e5803bb8527650fb8b7f7808649920872d530331dd377da85a"}) mount$9p_rdma(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000500)={'trans=rdma,', {'port'}}) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/loop-control\x00', 0x0, 0x0) keyctl$get_security(0x11, 0x0, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) removexattr(0x0, &(0x7f00000000c0)=@random={'osx.', 'self($vboxnet0-vboxnet0lo^)\x00'}) connect$unix(0xffffffffffffffff, &(0x7f0000000140)=@abs, 0x6e) semget$private(0x0, 0x0, 0x100) creat(&(0x7f0000000000)='./file0\x00', 0x10) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) syncfs(r0) 14:48:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2696.555732] binder: 30610:30611 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2696.593865] binder: 30610:30611 unknown command 40968 14:48:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd0") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2696.605672] binder: 30610:30611 ioctl c0306201 200002c0 returned -22 [ 2696.624476] binder: 30610:30660 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2696.637787] binder: 30610:30660 unknown command 40968 14:48:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000008010a00000e0"], 0x0, 0x0, 0x0}) [ 2696.654748] binder: 30610:30660 ioctl c0306201 200002c0 returned -22 14:48:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x22a0) [ 2696.789017] binder: 30825:30827 unknown command 40976 [ 2696.830488] binder: 30825:30827 ioctl c0306201 200002c0 returned -22 14:48:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2696.882966] binder: 30825:30832 unknown command 40976 14:48:13 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 2696.904172] binder: 30825:30832 ioctl c0306201 200002c0 returned -22 14:48:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000022a00000e0"], 0x0, 0x0, 0x0}) [ 2697.155340] binder: 31029:31034 unknown command 40994 [ 2697.180390] binder: 31029:31034 ioctl c0306201 200002c0 returned -22 [ 2697.211304] binder: 31029:31052 unknown command 40994 [ 2697.223329] binder: 31029:31052 ioctl c0306201 200002c0 returned -22 14:48:13 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x4000) 14:48:13 executing program 1: 14:48:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0463044000007fffffff0000e0"], 0x0, 0x0, 0x0}) 14:48:13 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:13 executing program 1: 14:48:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2697.557033] binder: 31056:31065 unknown command 65535 [ 2697.576345] binder: 31056:31065 ioctl c0306201 200002c0 returned -22 [ 2697.638628] binder: 31056:31136 unknown command 65535 14:48:13 executing program 1: [ 2697.667236] binder: 31056:31136 ioctl c0306201 200002c0 returned -22 14:48:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x5865) 14:48:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000200000000e0"], 0x0, 0x0, 0x0}) [ 2697.862222] binder: 31193:31194 unknown command 0 [ 2697.893207] binder: 31193:31194 ioctl c0306201 200002c0 returned -22 [ 2697.926772] binder: 31193:31256 unknown command 0 [ 2697.931702] binder: 31193:31256 ioctl c0306201 200002c0 returned -22 14:48:14 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:14 executing program 1: 14:48:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000300000000e0"], 0x0, 0x0, 0x0}) 14:48:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x6000) 14:48:14 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2698.386815] binder: 31309:31310 unknown command 0 [ 2698.391733] binder: 31309:31310 ioctl c0306201 200002c0 returned -22 14:48:14 executing program 1: 14:48:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2698.438132] binder: 31309:31317 unknown command 0 [ 2698.449436] binder: 31309:31317 ioctl c0306201 200002c0 returned -22 14:48:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000400000000e0"], 0x0, 0x0, 0x0}) 14:48:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x6558) 14:48:14 executing program 1: [ 2698.654482] binder: 31435:31436 unknown command 0 [ 2698.672698] binder: 31435:31436 ioctl c0306201 200002c0 returned -22 [ 2698.712555] binder: 31435:31443 unknown command 0 [ 2698.729813] binder: 31435:31443 ioctl c0306201 200002c0 returned -22 14:48:15 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:15 executing program 1: 14:48:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000500000000e0"], 0x0, 0x0, 0x0}) 14:48:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x8100) 14:48:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2699.263441] binder: 31554:31555 unknown command 0 [ 2699.275387] binder: 31554:31555 ioctl c0306201 200002c0 returned -22 14:48:15 executing program 1: 14:48:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2699.323007] binder: 31554:31576 unknown command 0 [ 2699.377352] binder: 31554:31576 ioctl c0306201 200002c0 returned -22 14:48:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xff0f) 14:48:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x0, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000600000000e0"], 0x0, 0x0, 0x0}) 14:48:15 executing program 1: [ 2699.630617] binder: 31676:31720 unknown command 0 [ 2699.656051] binder: 31676:31720 ioctl c0306201 200002c0 returned -22 [ 2699.693148] binder_thread_write: 15 callbacks suppressed [ 2699.693169] binder: 31676:31780 IncRefs 0 refcount change on invalid ref 100663296 ret -22 [ 2699.744652] binder: 31676:31780 unknown command 0 [ 2699.759036] binder: 31676:31780 ioctl c0306201 200002c0 returned -22 14:48:16 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x0, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:16 executing program 1: 14:48:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x1a000) 14:48:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000700000000e0"], 0x0, 0x0, 0x0}) 14:48:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:16 executing program 1: [ 2700.139171] binder: 31786:31791 IncRefs 0 refcount change on invalid ref 117440512 ret -22 14:48:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x0, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2700.206043] binder: 31786:31791 unknown command 0 [ 2700.225106] binder: 31786:31791 ioctl c0306201 200002c0 returned -22 14:48:16 executing program 1: [ 2700.274850] binder: 31786:31878 IncRefs 0 refcount change on invalid ref 117440512 ret -22 14:48:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x34000) [ 2700.330299] binder: 31786:31878 unknown command 0 [ 2700.335215] binder: 31786:31878 ioctl c0306201 200002c0 returned -22 14:48:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x0, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:16 executing program 1: 14:48:17 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000a00000000e0"], 0x0, 0x0, 0x0}) 14:48:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x730f2) 14:48:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x0, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:17 executing program 1: 14:48:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2700.978827] binder: 32019:32022 IncRefs 0 refcount change on invalid ref 167772160 ret -22 [ 2701.017994] binder: 32019:32022 unknown command 0 14:48:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x0, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:17 executing program 1: [ 2701.025180] binder: 32019:32022 ioctl c0306201 200002c0 returned -22 [ 2701.084431] binder: 32019:32111 IncRefs 0 refcount change on invalid ref 167772160 ret -22 14:48:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x100000) [ 2701.134785] binder: 32019:32111 unknown command 0 [ 2701.148530] binder: 32019:32111 ioctl c0306201 200002c0 returned -22 14:48:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000001200000000e0"], 0x0, 0x0, 0x0}) 14:48:17 executing program 1: [ 2701.392606] binder: 32220:32245 IncRefs 0 refcount change on invalid ref 301989888 ret -22 [ 2701.440050] binder: 32220:32245 unknown command 0 [ 2701.454486] binder: 32220:32245 ioctl c0306201 200002c0 returned -22 [ 2701.494704] binder: 32220:32249 IncRefs 0 refcount change on invalid ref 301989888 ret -22 [ 2701.536481] binder: 32220:32249 unknown command 0 [ 2701.541476] binder: 32220:32249 ioctl c0306201 200002c0 returned -22 14:48:17 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[]}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x400300) 14:48:17 executing program 1: 14:48:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000004800000000e0"], 0x0, 0x0, 0x0}) 14:48:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:18 executing program 1: [ 2701.903142] binder: 32255:32259 IncRefs 0 refcount change on invalid ref 1207959552 ret -22 [ 2701.927442] binder: 32255:32259 unknown command 0 [ 2701.935421] binder: 32255:32259 ioctl c0306201 200002c0 returned -22 14:48:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2701.955253] binder: 32255:32268 IncRefs 0 refcount change on invalid ref 1207959552 ret -22 [ 2701.994442] binder: 32255:32268 unknown command 0 14:48:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000004c00000000e0"], 0x0, 0x0, 0x0}) [ 2702.011782] binder: 32255:32268 ioctl c0306201 200002c0 returned -22 14:48:18 executing program 1: 14:48:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x8000a0) 14:48:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, 0x0) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2702.141345] binder: 32371:32372 IncRefs 0 refcount change on invalid ref 1275068416 ret -22 [ 2702.246790] binder: 32371:32372 unknown command 0 [ 2702.251825] binder: 32371:32372 ioctl c0306201 200002c0 returned -22 [ 2702.281655] binder: 32371:32392 unknown command 0 [ 2702.310979] binder: 32371:32392 ioctl c0306201 200002c0 returned -22 14:48:18 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:18 executing program 1: 14:48:18 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, 0x0) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000006000000000e0"], 0x0, 0x0, 0x0}) 14:48:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x8010a0) 14:48:18 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000"], 0x40}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2702.789946] binder: 32487:32494 unknown command 0 [ 2702.794856] binder: 32487:32494 ioctl c0306201 200002c0 returned -22 [ 2702.827758] binder: 32487:32499 unknown command 0 14:48:18 executing program 1: 14:48:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, 0x0) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2702.838485] binder: 32487:32499 ioctl c0306201 200002c0 returned -22 14:48:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000006800000000e0"], 0x0, 0x0, 0x0}) 14:48:19 executing program 1: 14:48:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xa00100) 14:48:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2703.047390] binder: 32606:32609 unknown command 0 [ 2703.076574] binder: 32606:32609 ioctl c0306201 200002c0 returned -22 [ 2703.110363] binder: 32606:32614 unknown command 0 [ 2703.144815] binder: 32606:32614 ioctl c0306201 200002c0 returned -22 14:48:19 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:19 executing program 1: 14:48:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000006c00000000e0"], 0x0, 0x0, 0x0}) 14:48:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x1000000) 14:48:19 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000"], 0x40}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) [ 2703.660704] binder: 32726:32731 unknown command 0 14:48:19 executing program 1: 14:48:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2703.684987] binder: 32726:32731 ioctl c0306201 200002c0 returned -22 [ 2703.721307] binder: 32726:315 unknown command 0 [ 2703.738949] binder: 32726:315 ioctl c0306201 200002c0 returned -22 14:48:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000007400000000e0"], 0x0, 0x0, 0x0}) 14:48:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x2000000) 14:48:20 executing program 1: 14:48:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2703.939852] binder: 377:378 unknown command 0 [ 2703.981870] binder: 377:378 ioctl c0306201 200002c0 returned -22 [ 2704.044688] binder: 377:423 unknown command 0 [ 2704.086743] binder: 377:423 ioctl c0306201 200002c0 returned -22 14:48:20 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB]}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:20 executing program 1: 14:48:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x3000000) 14:48:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000007a00000000e0"], 0x0, 0x0, 0x0}) 14:48:20 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000"], 0x40}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:20 executing program 1: [ 2704.544416] binder: 493:500 unknown command 0 14:48:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, 0x0, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)={&(0x7f0000000200), 0x8}) [ 2704.570011] binder: 493:500 ioctl c0306201 200002c0 returned -22 14:48:20 executing program 1: [ 2704.658289] binder: 493:572 unknown command 0 [ 2704.675499] binder: 493:572 ioctl c0306201 200002c0 returned -22 14:48:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x4000000) 14:48:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000a001000000e0"], 0x0, 0x0, 0x0}) 14:48:20 executing program 1: [ 2704.869279] binder_thread_write: 11 callbacks suppressed [ 2704.869296] binder: 617:619 IncRefs 0 refcount change on invalid ref -1610612736 ret -22 [ 2704.906853] binder: 617:619 unknown command 1 [ 2704.911684] binder: 617:619 ioctl c0306201 200002c0 returned -22 [ 2704.930358] binder: 617:628 IncRefs 0 refcount change on invalid ref -1610612736 ret -22 [ 2705.004577] binder: 617:628 unknown command 1 [ 2705.039277] binder: 617:628 ioctl c0306201 200002c0 returned -22 14:48:21 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000"], 0x40}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:21 executing program 1: 14:48:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x5000000) 14:48:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000a002000000e0"], 0x0, 0x0, 0x0}) 14:48:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb00000000"], 0x60}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:21 executing program 1: connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x100, @loopback}, 0x1c) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ff2, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000), 0x0, r0}, 0x68) setsockopt$inet6_buf(r0, 0x29, 0x22, &(0x7f00000000c0), 0x235) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x39) fcntl$setstatus(r1, 0x4, 0x42803) [ 2705.420426] binder: 726:735 IncRefs 0 refcount change on invalid ref -1610612736 ret -22 [ 2705.454525] binder: 726:735 unknown command 2 [ 2705.473216] binder: 726:735 ioctl c0306201 200002c0 returned -22 [ 2705.510472] binder: 726:824 IncRefs 0 refcount change on invalid ref -1610612736 ret -22 14:48:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0x6000000) [ 2705.591097] binder: 726:824 unknown command 2 14:48:21 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb000000000000000000000000030005000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000020000002000000e0000001000000000000000008001200000002000000000000000000300000000000000000000000000000000000000000000000000000000000000121f7d8e7000000000000000000000000030005000020000002000000e0000001000000000000000013df862ac2b9f4550c4550e1c34b56"], 0x8f}}, 0x0) [ 2705.655217] binder: 726:824 ioctl c0306201 200002c0 returned -22 14:48:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xa000000) 14:48:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="046304400000000003000000e0"], 0x0, 0x0, 0x0}) [ 2705.905884] binder: 1070:1072 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 2705.935295] binder: 1070:1072 unknown command 3 [ 2705.964402] binder: 1070:1072 ioctl c0306201 200002c0 returned -22 [ 2706.010224] binder: 1070:1172 IncRefs 0 refcount change on invalid ref 0 ret -22 14:48:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xc000000) [ 2706.058046] binder: 1070:1172 unknown command 3 [ 2706.063097] binder: 1070:1172 ioctl c0306201 200002c0 returned -22 14:48:22 executing program 2: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000"], 0x40}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="04630440000000a004000000e0"], 0x0, 0x0, 0x0}) 14:48:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0a8c9512d7703f319bd070") r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x8) timer_create(0x0, &(0x7f00000001c0)={0x0, 0x12, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x3, &(0x7f00000000c0)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200), 0x8}) 14:48:22 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="020d0000100000000000000000000000030006000000000002000000e00000010000000000000000080012000200020000010000000000003000000003030000ff3f567b0000000000000000000000000000000000000001ac1414bb00000000"], 0x60}}, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) 14:48:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003a0081aee4050cecdb4cb9040a485e510befccdf7f3e9cf0758ef900e1cf3aebb1cb4c100c0003720000", 0x2e}], 0x1}, 0x0) recvmsg(r3, &(0x7f0000006600)={0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005080)=""/251, 0xfb}], 0x1}, 0xe000000) 14:48:22 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mkdir(&(0x7f0000000100)='./file0\x00', 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chroot(&(0x7f00000000c0)='./file0/../file0\x00') chdir(&(0x7f0000000340)='./file0\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000380)='sysfs\x00*\x86OK\xc0\v\xce\x1b\xdb cr\x13\xb1\xe8\x94\xd1 q_\x9d\xc1\x12[\x04,r&\xeb\x016\xd9bN\xa1\xd23t\xa6`\xfeZ\xc1sr/\xd3g\xad\"\xe8U0%\xa2\xe8\xbe\v\xc5QCy\xafr\x13\xd3+\x8d]\x06\xdc\x8f\xbf,\x84\x9e\xd9\xcd\xef\xc7K\x03\xdf\xa9\xcbZ\x90\xb2\x8bK$\xd7\x86,=f\xfc\xa51g\xd5BB5CZ=\xbbv\xbc} 0b e9 52 fe ff ff e8 ac 90 b2 fb e9 75 fe ff ff e8 c2 90 b2 fb [ 2729.005803] RSP: 0018:ffff88805e5efbd0 EFLAGS: 00010293 [ 2729.011550] RAX: ffff888085f9c3c0 RBX: ffff8880934c0040 RCX: ffffffff85ee0ec9 [ 2729.020124] RDX: 0000000000000000 RSI: ffffffff85ef15a8 RDI: 0000000000000005 [ 2729.028494] RBP: ffff88805e5efbf0 R08: ffff888085f9c3c0 R09: ffff888085f9ccb0 [ 2729.036575] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880934c1b80 [ 2729.044488] R13: ffff88805e5efcc8 R14: ffffffff891b6e38 R15: dffffc0000000000 [ 2729.052253] ? xfrm_state_flush+0x5a9/0x660 [ 2729.057272] ? xfrm_state_fini+0x218/0x280 [ 2729.062241] ? xfrm_policy_fini+0x2b0/0x2b0 [ 2729.067512] xfrm_net_exit+0x25/0x70 [ 2729.071390] ops_exit_list.isra.0+0xb0/0x160 [ 2729.076464] cleanup_net+0x3fb/0x960 [ 2729.080210] ? unregister_pernet_device+0x80/0x80 [ 2729.085119] ? __lock_is_held+0xb6/0x140 [ 2729.089337] process_one_work+0x98e/0x1760 [ 2729.094150] ? pwq_dec_nr_in_flight+0x320/0x320 [ 2729.099417] ? lock_acquire+0x16f/0x3f0 [ 2729.103624] ? kasan_check_write+0x14/0x20 [ 2729.108115] ? do_raw_spin_lock+0xc8/0x240 [ 2729.112470] worker_thread+0x98/0xe40 [ 2729.116398] ? trace_hardirqs_on+0x67/0x230 [ 2729.120834] kthread+0x357/0x430 [ 2729.124406] ? process_one_work+0x1760/0x1760 [ 2729.129333] ? kthread_delayed_work_timer_fn+0x290/0x290 [ 2729.135687] ret_from_fork+0x3a/0x50 [ 2729.142556] Kernel Offset: disabled [ 2729.146664] Rebooting in 86400 seconds..