00080), &(0x7f00000000c0)=0x4) [ 647.915322] binder: 20608:20609 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 647.964437] binder: 20608:20609 BC_INCREFS_DONE u0000000000000000 no match 04:50:31 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x9, 0x8000) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0xc88e}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000140)={r2, 0x20}, &(0x7f0000000180)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280), 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="00000000000100000e630c40000000000021000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:32 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 648.343305] binder: 20622:20623 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 648.407450] binder: 20622:20623 BC_INCREFS_DONE u0000000000000000 no match [ 648.442171] binder_thread_write: 6 callbacks suppressed [ 648.442184] binder: 20622:20623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x10000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000240)={0x0, 0x4}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000300)={r2, 0x7}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=0x0, &(0x7f0000000180)=0x4) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000001c0)={r3}, &(0x7f0000000200)=0x8) r4 = syz_open_dev$rtc(&(0x7f0000000040)='/dev/rtc#\x00', 0x1, 0x400002) ioctl$RTC_PLL_GET(r4, 0x80207011, &(0x7f0000000080)) [ 648.598322] binder: 20630:20631 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 648.645101] binder: 20630:20631 BC_INCREFS_DONE u0000000000000000 no match [ 648.652197] binder: 20630:20631 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:32 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:32 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 648.713780] binder: 20630:20631 BC_INCREFS_DONE u0000000000000000 no match 04:50:32 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 648.787653] binder: 20630:20631 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="ddff0000000000000e630c400000ef0f77c20000000000004471dcf33c8f75ff03556521d960759d0c3281cb6ce741674bdb9e27dc43e6971736fde824d98135ca1acc050e65e0f2d1cc0ee2f68e34d736c048e53b2026916d44e1a666525de3787dd25b7f88460217e0ca9d8d5fd76527bb40743e8ae8a62251083b58214d7ed50712bee4a448314dc6198af2afdc5211d5"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:32 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 648.963927] binder: 20646:20647 BC_REQUEST_DEATH_NOTIFICATION invalid ref 267321344 [ 649.009770] binder: 20646:20647 BC_REQUEST_DEATH_NOTIFICATION invalid ref 267321344 04:50:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x803) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0763044012fffffffe6310406efe46f9a38f0dde16a89580b13a4661082f543542ad0513a5451ff34094cca55aee2cb263e4aa3c35e8b3289ed888c26aa75ab04b156a2e91ad91953d6f1a6ed24144a6cf524935eaf122900da50e3dc034196c6e79e22c38ee9752bca44cc84ee0d9a454a3cdc8b9149d21c9bd1df7c18cf44a8e07c10bc3047a8c8d475209b91f5ac16283ff26cac5437bc202c4608de893202707053c73b4ce6eb346d024cac18e308c484d1ea0002714878c9d524a456e7c889980b00552cac86de269aa622904fcc885989e75a987d6c156e78e895731b0bdfb9943fb9d002816e3", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = dup(r0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)=0x0) fcntl$lock(r0, 0x6, &(0x7f00000000c0)={0x2, 0x0, 0x0, 0x0, r2}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000000)) [ 649.178260] binder: 20654:20655 unknown command 1074815998 04:50:33 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 649.219661] binder: 20654:20655 ioctl c0306201 20000100 returned -22 [ 649.266276] binder: 20654:20655 ioctl 8903 20000040 returned -22 [ 649.303771] binder: 20654:20655 ioctl 40086200 20000000 returned -22 [ 649.345770] binder: 20654:20656 ioctl 8903 20000040 returned -22 [ 649.372674] binder: 20654:20655 unknown command 1074815998 [ 649.400591] binder: 20654:20655 ioctl c0306201 20000100 returned -22 04:50:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x8000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="00000000200000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x80, 0x8a100) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000180)=ANY=[@ANYBLOB="000000002e95b22e470d3a1631321e86f2214cc204a5af13", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f00000000c0)=0x10) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000140)=ANY=[@ANYRES32=r2, @ANYBLOB='\x00\x00\x00'], 0x12) [ 649.532036] binder: 20664:20665 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.576384] binder: 20664:20665 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)=ANY=[], 0xfffffffffffffeb9, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e68f582ea2cc69b725ca79aa3ae376e255acf515601cfb3f8238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7"}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x80, 0x0) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) 04:50:33 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:33 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:33 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioperm(0x8, 0x1000000000, 0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:33 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 649.908832] binder: 20682:20684 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 649.949726] binder: 20682:20685 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x2) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x80000) r2 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$update(0x2, r2, &(0x7f0000000340)="8fbb5d01a781c7670e89ba84375b1e645c5ec867f708ecd4ba6b69403874dc5d51fac10dbc4ec9a1793bc8685f968661bac6ab0352c21cc6db539a23193e1303d8844e04380339d77ba3de8d3d50fdeedcde656ee9b5f915d06e9921d3cc704931bd27d79507f209c8617ca6cb57bb52c1aaa4aa6b5a572ceba3f67f9af94e9f3b68f8", 0x83) getsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000100)=0x1, &(0x7f0000000180)=0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x9b, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07010000007f73f089b9b3890000002863104019a3797181d00d2f2f0909b0690fc77ec5b23cb60b4f5b17d9d488461abc8e327206df188b2f0a708829c9569c1b3c0832704afbbfd7c93a0c2b3aaf9f30648095b05aa01b4d449337c5c044b21a55600e9dc7a3265d393b8f8a3b7cd87f67dd37fade06d8b9d147", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xffffffffffffff88, 0x0, &(0x7f0000000240)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 650.085944] binder: 20691:20692 unknown command 263 [ 650.099169] binder: 20691:20692 ioctl c0306201 20000000 returned -22 04:50:33 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = dup2(r0, r0) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000140)) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x191000, 0x0) getsockname$llc(r2, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000000c0)=0x10) [ 650.211441] binder: 20697:20698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 650.250641] binder: 20697:20698 ioctl 80044584 20000140 returned -22 [ 650.279780] binder: 20697:20698 ioctl 80044584 20000140 returned -22 04:50:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xffffffea, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 650.415056] binder: 20703:20704 unknown command 0 [ 650.430366] binder: 20703:20704 ioctl c0306201 20000100 returned -22 [ 650.451240] binder: 20703:20704 unknown command 0 04:50:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x90, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="12634840040000000000000003000000000000000000000011000000000000000000000000000000000000001800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="030000000000000000634040020000000000000003000000000000000000000011000000000000000000000040000000000000002000000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="0000000100000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="00f89ca7fbab35ab857b4a3289d6fb60c4022bb96b03000000e2f6f29f812f954e65b832570539f1529674ced7e655244c63cd84c424f89e177dfdbed35c65e582b4a28a5a33"], @ANYBLOB="010000000000000000000000000000003800000000000000852a646600000000", @ANYRES32=r0, @ANYBLOB="000000000200000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='x\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00X\x00\x00\x00\x00\x00\x00\x00']], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000080)) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x6) [ 650.464847] binder: 20703:20704 ioctl c0306201 20000100 returned -22 04:50:34 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 650.566092] binder: 20707:20708 got reply transaction with no transaction stack [ 650.602225] binder: 20707:20708 transaction failed 29201/-71, size 0-24 line 2762 04:50:34 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 650.643994] binder: 20707:20708 got reply transaction with no transaction stack [ 650.683610] binder: 20707:20708 transaction failed 29201/-71, size 0-24 line 2762 04:50:34 executing program 3: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xf764, 0xd5d9fb4a45667d3a) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x1b9, 0x800) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x200000, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x100, 0x0) 04:50:34 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:34 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x200000, 0x80) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 650.986534] binder_thread_write: 13 callbacks suppressed [ 650.986549] binder: 20726:20727 DecRefs 0 refcount change on invalid ref 4 ret -22 04:50:34 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="4915a476c136c40ad176950e630c40000000b9494ec94c00000000"], 0xa5, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05d000000000000000046fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058300040000dd7538aabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x5}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e21, @multicast1}}, 0xaa, 0x1}, &(0x7f0000000200)=0x90) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f00000002c0)={r2, 0x9, 0x10000, 0x4, 0x68b, 0x4, 0x1, 0x1, {r3, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x6}}, 0xffff, 0x4720, 0x4, 0x101, 0x7}}, &(0x7f0000000240)=0xb0) [ 651.235403] binder: 20737:20738 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 651.260157] binder: 20737:20738 unknown command 244676305 [ 651.287493] binder: 20737:20738 ioctl c0306201 20000100 returned -22 [ 651.316257] binder: 20737:20738 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 651.343992] binder: 20737:20738 unknown command 244676305 [ 651.363117] binder: 20737:20738 ioctl c0306201 20000100 returned -22 04:50:35 executing program 3: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$KVM_GET_TSC_KHZ(r0, 0xaea3) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = accept(0xffffffffffffff9c, &(0x7f0000000040)=@alg, &(0x7f00000000c0)=0x80) connect$bt_l2cap(r2, &(0x7f0000000140)={0x1f, 0x3, {0x2, 0x90, 0xff, 0xfffffffffffffffd, 0x31b2, 0xffff}, 0x1, 0x1}, 0xe) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="0b00eaffffff0000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) fstat(r0, &(0x7f0000000180)) [ 651.499903] binder: 20742:20743 DecRefs 0 refcount change on invalid ref 4 ret -22 04:50:35 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:35 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 651.543133] binder: 20742:20743 unknown command 0 [ 651.556146] binder: 20742:20743 ioctl c0306201 20000100 returned -22 [ 651.598393] binder: 20742:20743 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 651.630915] binder: 20742:20743 unknown command 0 04:50:35 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 651.657757] binder: 20742:20743 ioctl c0306201 20000100 returned -22 04:50:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getrandom(&(0x7f0000000040)=""/64, 0x40, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:35 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 651.802157] binder: 20756:20757 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 651.833325] binder_thread_write: 15 callbacks suppressed [ 651.833340] binder: 20756:20757 BC_INCREFS_DONE u0000000000000000 no match [ 651.884199] binder: 20756:20759 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 651.891961] binder: 20756:20759 BC_INCREFS_DONE u0000000000000000 no match 04:50:35 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f0000000140)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 652.157040] binder: 20768:20769 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 652.209802] binder: 20768:20769 BC_INCREFS_DONE u0000000000000000 no match [ 652.246765] binder: 20768:20769 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 652.265067] binder: 20768:20769 BC_INCREFS_DONE u0000000000000000 no match 04:50:36 executing program 3: sysinfo(&(0x7f0000000080)=""/64) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x80800) ioctl$KVM_SET_TSC_KHZ(r1, 0xaea2, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 652.391081] binder: 20772:20773 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 652.413262] binder: 20772:20773 BC_INCREFS_DONE u0000000000000000 no match 04:50:36 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 652.444058] binder: 20772:20774 BC_INCREFS_DONE u0000000000000000 no match 04:50:36 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040), 0xa1, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88be813d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854c97538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93b54877c79346de27"}) 04:50:36 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="000000000000000ce0563793b82161e8ca7416223eb5000e"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:36 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 652.743761] binder: 20789:20790 BC_INCREFS_DONE u0000000000000000 no match [ 652.791248] binder: 20789:20790 unknown command -1825089824 [ 652.813249] binder: 20789:20790 ioctl c0306201 20000100 returned -22 04:50:36 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 652.837199] binder: 20789:20790 BC_INCREFS_DONE u0000000000000000 no match [ 652.883279] binder: 20789:20790 unknown command -1825089824 [ 652.889292] binder: 20789:20790 ioctl c0306201 20000100 returned -22 04:50:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000240)='/dev/snd/pcmC#D#p\x00', 0x2, 0x40000) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x70, r2, 0x0, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x10) [ 653.017420] binder: 20800:20801 BC_INCREFS_DONE u0000000000000000 no match [ 653.049541] binder: 20800:20801 BC_INCREFS_DONE u0000000000000000 no match 04:50:36 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x22000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0xfffffffffffffdfc, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x1000, 0x0, &(0x7f00000022c0)="f1f54bebb3747bbd55e70cb1eec70f4fdb2b9aee0ef65aa5c6be4431b4999107151abe6fa34db77886ddf7f99ce8719ac0705d7630b130529c639a8518e3f45e83921d910cc94fe555b7903e87398af65ca1d072cae953f7c6057f6278a23f1545ff37db0c50ae2cb4902d6a1df6673f23700a0a7f920d8d07fa947f9b78daa83dbff30b8c857c2153685ef43a8a51a3521a9294f72190285cea30a59f00b49d53ba148a00f3ca94d01863bce9750f458c6f5b08b60f91587f2c18bda85efd8ac1d515dcc88bee840fef382d61dd922ef9c658b2000bdfe000813135b824650f23dcbf7888758ef97b2bb978eb898464cc83eea647cd8ac64968d07ffff474a67efbe2b35bd6f0f97464f4e4016663b91379fc90ecf2c955bafc0fdb79723dd52ccda05d43f0c370de15efd727d03a8e780d90ec71056af11b209b80f4f7808cd1b4393d2405d3787fc55aa7bcfa8c9ce0229b00e1e816eddd6197e6751bf1ab58456c4489ed2808ea68afd94e7f62602dfcb5cc7679b86069273551ea0b7d59ddf2fa4c15d97c07279bce94c6eccb719fdd6da46dde89ee59cc0e61948a0b7b12c1b41e575a2b7c7ad1d29f7b4f20df4c571ae3473aba4c2aec2dfc4efdbcbc70f09beb50ca95c0c47fd01338b7bc5ef311534a78d1c20dfbee877162c3040a1fb1d78a62679d59492da56a1c3111667459a5729befa57c5f57c4bba83f607f8b54f4c528d601749a6f8bbaca01b4608d6b487dd0ef57e820ce3aac6fd4f01cd70481aaf25d68bac0b3da4c2c2ef0632a8a050a2a169d4935201ca2320d3a60b35db933b82298d23ce9cd7468a42a9725b83b88dfa239b983dd15b48883957d912c0e4e755ca66cd5ea1385ad856acdd7f2337a3ae392eec62e996473df87787aec6c581a2ef13f3d6020d13a5ba63eca3a682bfd452b196ac121e777bb4a4e03bd6e7a6dbcc4dea5e90a969b1f81671ce2347e07ab51f181f9334a41ba6465df84322633f6666fdc57574bf2b63cdf2d7bfb1a7d5e589cba59fe6c8c125ffa1de71ddfcff4f316765ae3c2fcb4665625b245cfacf28ff9437ad2446ad0ce642188e3a56565847594c213ae30b784ecefe75dabd5ba2f80a1b32c3418c88c7536a3471009be7466d858fc9c890103eae330b682b6d13e683bf1e99371923d133fea038e7fb90f1875ef98082bb67106e3a203000043e9e13b0c69cd69dd4aa993086c975fd09cad1d78c1161bec3ca9f78dbcfa413eb16069e5c58cf7ea5b979a7750776bfe537103b606c134ad6dff850bd8de5e85200c5fd9e015c9bbe878f304788c30d1bdabdec568dde103572b709fbd4f6384aaa1403ccf7fb18ccadaad8926be6b30b33c5a31d381caa41a92629451a9a0ec56cf9612a941576f1019d127c810f4fa657f3889edc5585783ffd78b8b8abe58e24de284bb784c072f7818d9d09c29d76e0acb15194e948baf1bbb3c6b2bdf20b1ae62c1be62abed74f5dd8ad2ad766a7af30071c764ebd5267f8789edbfe2cbcc705560ca5e5f8e0c229bbbbb18ea532a8895e15c05c482f9b16ce45c9e7d25356e6f39ab41478b36fd5bd8672cd702b88451c6c734ce1e3dd814db853d87b6b8bc7c582431ea0b0914ad7938ae58a9f871144331f2bae74e8622a0817b8e09488992205839ce6e0d205d3e3e9100f6575cf62d4d49b9f4520d302f8c582f6a8b4088f479f1617781e9577eee33ab09f1808b53c27d051c5aa2cce10361a1fe1e7a6af4954661521c957ecfed6bd8922b9430b7e3e39dfdaedb543a53c5551f13d04159706580a3a587bc4605f94782378736ec1a5697cd6f4c5b4d58d8477bc9f003fe605b08f8f08ea0ee639f21468f8e06b90db119e8cda271d8a5500cce07354cfede54774bcf4466a569bcb4d6e142ca3822c612c6e431d5e18a670a794d6e026826c7d592e61b39508ac103029bc93183e8dcf9cc7825e4b8833de6068259377efbdffc5a94747b5ceb8efcfc1d911578f5ad32eef5ec4464fbee8096123463fdd6a284f7fb8d70252e01349d22bd792b2983ef4075f1c3613f3fd5e9d8936960fab726049ee6159dc6eb28cb17a8b84a0b95de9d20797714792f715d6a5a6550dfba6860b3f5191d596f5ff570223171b5c9f4ce51a2a157ad4bf0f89f8a6d11ccad9e8575a1dfccc7839713caf295aa375269d8cf16277a96687ef22378c4066ccce362a71cd5820bc308fbb72421d7802bff238b5322f198048b771625a0affb64212a019fc939e9994a724e3fbe3ac436abfa4aa7cff22f27159623c3c785b06fcd423ffd0ba57db43f798418841cb6ba5285aea257a57b6ae1b5b0fd8bf0e694c96ec155b0b766faa761f983caffe3e6b423d91cfe681ccd5ac96c72f1dfd7543b3e1091a8ff7de542ab1ea715bf029b247ea96872cdc4ac276a0c92f7246c700f263dd1ca2b8e16418d6d2a5a3095c8d564dcb3c19bdb4da2e1889401dd7bf6a0e7b1cef2b0c3d2d869cf7e9e96429aa2b6e6d6969b99e779a77f034389aa843702efafe1e0e8ad41485495b7bb5a86a2f193a6d16b25f7ee225453e60f9c98caeac1279515ad42726f72afcc868371e83e0474fdd9e3adc227762218b71ee27d1cb909220f5c7096b60b46dd84939961cf0555d91dff3fb95d4290992f9f44da518207edd5eb77a94d1e59b0e2dc483c3c8f9a4b637dc52f09698717e477bfb343134e91bb449db07143b7b798a1007c9610332e560773c8ae964681a8535a32846740c16725d1a33c0c37aa14a6ea1a2070e5723367885f901921103c86d82e0b99e3b8fc8fc7aec2333d16df01663c874b218a4e68741cc4e6a5a8550f91226ad8580fad29d749bf739d0df68bade496d4f632ee9e4369eb9d327c7539c7929d4457fbc49dce859b65f82e6c0d9ac4adf4b310201fbe971adbbef6b172818b40d7a94397574ec205cb0d9df2a47a36ea64393b0f441e9fdcc9d700ac40ebd29c331e92564942a3334aa793ce8012b0cfbe5a60cf5a4d6935407957aa32321ed671e422a1a096528350d73ad082081da967a981833e6a69cdc5e2601caebfaae459651c572786c1e72d8a5f971077e23e96363f29bfd015c797e366b2fdc22a7d36da6c18ef51e517ee558046dfff557c2b3733f08e3b67c700d3bd5b83732c5a1e7b8bf0e7a701e3a89e3dc7f6d95ddcaef1883466717d5fc0bf2dfc73cbd5feddfcd8f0480fd61647b1a58b3cc4b5fc86d7c02c7b83a0b631647de44bc7ecf5287cf5afd4e1ef8893b3f27f105e463b06b625bf70c438912d5c1d9bdd1cc0017ebede9e36614b054435ee8b7a48e568f499441ee5f9304a9accea19e84561e8b956e9ffe11d886e5a676e4346e2a2b972caba2c3dc2ea22368d313d52b815a07ea03a497d9c95becbf834b231d424b27c425048988eb8a7d637e7d6694cf3dfd0fcbe2ec5b0d9db7d9269e38d96fdae59563eff05eaad380945417d798d949b48b8459c9a5586200d7467f94b5f912fd30ff76b57a8af27a78884208bba50d783180d1e6838888520b0b599a3c0b0bcf46ade09b617b06a6bbf83b586aa1c712b3faccdd217e2c0167758cefcef62e5310c52df6411be6d5dc959f9e66e481c3d473ee5fd1ebfaceedc7923ce66e85cdb9aaf5d37347109a9a3ef79573e6ae01ebfb3b4871f876ccf443c1f0119a30c23080c4613532631abed8bfe1d9cb2bec003466ef62eb9a3e8a7c275c6ccdb36deeb4588434a0826a1d7dca80bd880e6106e8e57fac35d4f1b64fa3ed7176509548fc05a0715b7717cc1aaa634bc15fb5bc0d9a7965a9483b474298b50a03757180c0b034d658ca3b37d3eaacf5f3331cdecac8842a81df8e09c14c2902a5d53f6a988a0ea038bc79a651e992c6a360214f6b09801aa2cffffe1590728a863b780059c4b89d2064e6880cc64594da5092111c1058f78ffddf5cb57932d69e8b3a76b686c9de7de79a37d2a5591276d98c09d2442314928adc2de0f39f83bea73547038cd2165e6c080ab38fc96fbc007d7668b970439181aa7e76be652b51b18d1a7f31a26047e472bfd40afead6188108fcf95556ea696de25079c7c3d29939968130c1f296e5eb08658c0d3db3c104b3d49b1a6932d39bd99356ed065114869d352efe1c33548bab39ffd75a9719e4c7322ef7bb531afca76b4d24ef1a250995a0dfbea1c7a52f509f8d11d0b288f0ae010bed20d5d4e70a22c1848c7218a5fb8719ea4a2ccb548511da677ba6cbdbf330f2053d7fc156c0ce18506e501db245643e4827ba510336e6b8c2531c8734b43f3361fc62ae83e0d1645afb57fcff606010c6ef3db008233749d121c105306ced0702c12408ecee0b7776b4225641a7b8097bebe071cf3547fe9af348126e8c628fa006a9eb06703645dbbc47b7b471b66f41afb4a484da2a9cf2906f2646577e74c63208c595be83cc3d9f4cbc4a8d5bdb5d661557c7373c495f350cefd780d5662ee0b243d3c781885a7425109d9e6331d34edb3b7c3fc90cad2b7131334551eab61ea39f24cfe75801f1fea33cecd478424ae184c5e932696ac1a1d8e50ddb0ed5ed5a6a8ed7121554ddace967dcf38a4e3829fb75bee7cacc5d0d5929148adf13ada87ce7b9804fb17ee1af1f6bb38afa1af5f03d186a744c0c844c79731e0bd5a3bc3e05785f7209628b739f40bf4280c7890561011e7b34ba2e89c9eb0ce8536f0d3591a537fad9fc7e14fbd9f48df2064ceba2520da4a3e1ea256a3758500a2517e070b18e4e27435700937328ad18730df854873c9a9e296151d8c632bbffbaae92994f31bec95b7822cdb1c0ea11ad11826812e9d95d640de57de8b29d0da68ec219a54776419a20804348b9a38794c672c37f007e1f55342ce7032afa360c67f5e363aaaf5f63468903da396b10ba9ceaca21109742d8097fac38e529cf2cb44f671662f92d3c5adb6f663e9c016bd34573f3632052089fb09c3b770ef4800bc4d50915d5d11e7193f75f4289fb4702342720b958a94997c5775299ab464d35f198a8658e6466318ee11952ddad9c49ec8ea4057143bceb7b22a14cad63569b711083c2a308a6d2d4845104f7327f3b61bba27f9e7580c75a082bccfacb71c7a3ac706a5d13f3fe9d6acf76a178c5761b16576951a243ca8cb4d2a78aaa7b2190d926ec9695f52660b139d6f9aa3c6bb6b5d19803df8b61a98fbbb9c3ac36b5fe7174895f8d80bb4e8d35f12d88ed185ef861a3e2698aad8f0ca5d85aa9317fcde2f9c4db3a670de99d9d736ba9eab0ebd00d009d3fcf898ce1814eff9e198032a94ded4d378f95540d07144390e4837b87a360c22e392c325b44cd6d7db3afa60df57bbe9477183c4fff6d4b5ccfbc87049e16c300424fa5d9484af8a79fe627040f78ba49a8edd4b14bcadbf628d2fbdbca12cf4f063f179cbc2828cb0707d7c3a1b95a4ff0a55258162c9be58c511130f84d8f011600fce80f3018a5dbfb221a3bf2311d572fe7c5bcb6c715c06204bb16e5b76a973f771189db4b4435037c9376ca73b42db76acc7415275133818292f8a12150c47ef04cbe212a69b871fc5cedcb72ff5da05c828348abc9f92257507e192c4078a52686e586fc53a0cd890f87afcb25c18a41023553f1cdb62ad3541f9463059cb8e5afd0597226577c4a3b01cbcaf8b8f2573ea16c60acaf9be94492264bb24474123cbfa521ea1ea79d20ce19a15c4fb96f7a14e75501432572260d739b13c9a4ff4079f9a357c4c59febaf4d762647cb537f13b45ab3448ab14814a7bb935327990d9775"}) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0xfffffffffffffeeb, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f0000000040)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdeaa58d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363dff19aa3ae376e255acf515601cfb3fa238b5f80f8265ad6b78ad38ab81ef0084acbd16bd05de729b1f2b4a0050046fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7"}) 04:50:37 executing program 3: r0 = syz_open_dev$mice(&(0x7f0000000200)='/dev/input/mice\x00', 0x0, 0x10000) mknodat(r0, &(0x7f0000000240)='./file0\x00', 0x0, 0x2) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r0, 0x80dc5521, &(0x7f0000000480)=""/216) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='limits\x00') ioctl$KVM_SET_VAPIC_ADDR(r0, 0x4008ae93, &(0x7f00000002c0)=0x2000) ioctl$SG_SCSI_RESET(r2, 0x2284, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x8, 0x20}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000140)={r3, 0x1, 0x5, 0x5}, &(0x7f0000000180)=0x10) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f00000001c0)=0x7, 0x4) 04:50:37 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:37 executing program 3: sigaltstack(&(0x7f0000fee000/0xf000)=nil, &(0x7f0000000040)) r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x8001, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="c5464f5aabec8d7fc75a63044006eed81c4a2740b033bc218d0400000008631040", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000b4cb6d9201482ded2d0f027d9ffec4b08322af7d643e1694d47f962c94f19f088a500dcd8110076ceae9ae0221b2429db3e5a38e08af95adeb4c8d451b1c247fcd135273337634fe3662de4b28a735a121da057e8b26ffdc7200f27938dc3cf34b48d6dd43455a6f46e457837a2bf140fb1b81f0d87855c53108ce60fd18833fa6233f1333bb8fdc44678acef3043b5d25e7468cc5c0f0f44f5db3c2ddba8c3290ef65e434d9000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = msgget$private(0x0, 0x244) msgctl$IPC_STAT(r1, 0x2, &(0x7f0000000340)=""/84) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x24000, 0x0) getsockopt$netlink(r2, 0x10e, 0x5, &(0x7f0000001480)=""/4096, &(0x7f00000001c0)=0x1000) 04:50:37 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 653.457961] binder: 20818:20819 unknown command 1515144901 [ 653.480244] binder: 20818:20819 ioctl c0306201 20000100 returned -22 04:50:37 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 653.520678] binder: 20818:20823 unknown command 1515144901 [ 653.548315] binder: 20818:20823 ioctl c0306201 20000100 returned -22 04:50:37 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/anycast6\x00') ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r0, 0x40045731, &(0x7f0000000080)=0x9) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:37 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 653.734494] binder_thread_write: 14 callbacks suppressed [ 653.734507] binder: 20832:20833 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 653.837128] binder: 20832:20833 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xfffffffffffffe76, 0x0, &(0x7f0000000280), 0xffffffffffffff27, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:37 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x8000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 654.070103] binder: 20845:20846 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:37 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:38 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:38 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 654.310708] binder: 20850:20853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:38 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:38 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:38 executing program 3: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0xc1, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000200)) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000240)={0x0, @aes256}) r2 = memfd_create(&(0x7f0000000040)='/dev/binder#\x00', 0x2) ioctl$KDGKBMETA(r2, 0x4b62, &(0x7f0000000080)) r3 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="000000000d0000000000000004000000000000000000000068b12a8fb44ea7dc2aa71a492426e7dd9ea7b81a09b45ac422af1d7a88b9da4c82b5c18210e27452c7a1c5280c7d79406720f9beaac06c28ca2b0a215650910000000000001400000000740bfa8af64e8ab9"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x7, 0x0) fcntl$addseals(r3, 0x409, 0xe) 04:50:39 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 655.183806] binder: 20873:20873 unknown command 0 04:50:39 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 655.212130] binder: 20873:20872 unknown command 0 [ 655.224093] binder: 20873:20872 ioctl c0306201 20000100 returned -22 [ 655.246375] binder: 20873:20873 ioctl c0306201 20000100 returned -22 04:50:39 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x103440, 0x0) fsetxattr$trusted_overlay_nlink(r0, &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L+', 0x8}, 0x28, 0x1) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000080)=0x8, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:39 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:39 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:39 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 655.389361] binder: 20885:20886 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 655.446608] binder: 20885:20892 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:39 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) readahead(r0, 0x7, 0x100000001) 04:50:39 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 655.586494] binder: 20898:20901 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:39 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="00002f522eeb0000000000000e630c400000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000140)=ANY=[@ANYBLOB="01000000000000000900000000000000010000007f00000004000000000000000400000000000000070000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff7f0000000000007403000000000000000000000000000000000000000000000004000000000000000000000000000003000000000000006cba0000000000000080000000000000000000000000000000000000000000000003000000000000000000000000000002000000000000000600000000000000fffbffffffffffff00000000000000000000000000000000000800000000000000000000000000000000000000"]) r1 = syz_open_dev$sndpcmp(&(0x7f0000000240)='/dev/snd/pcmC#D#p\x00', 0x0, 0x800) pipe2(&(0x7f0000000300), 0x80800) ioctl$BLKFRASET(r1, 0x1264, &(0x7f00000002c0)=0x9) msync(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2) r2 = open(&(0x7f0000000000)='./file0\x00', 0x8000, 0x40) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, &(0x7f00000000c0)={0x1, 0x1, 0x0, 0x6}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r3 = fcntl$getown(r0, 0x9) getpgid(r3) 04:50:39 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 655.780132] binder: 20911:20912 unknown command 0 [ 655.801168] binder: 20911:20912 ioctl c0306201 20000100 returned -22 [ 655.841173] binder: 20911:20912 unknown command 0 04:50:39 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 655.867267] binder: 20911:20912 ioctl c0306201 20000100 returned -22 04:50:39 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:39 executing program 3: r0 = semget(0x2, 0x1, 0x8) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x2, 0x0) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140), 0x10) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000040)=[0x0, 0x5, 0x20, 0x2]) r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x3f, 0x400) setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f00000000c0)=0x18, 0x4) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) gettid() 04:50:40 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:40 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x8800, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0763044004080000086310408cf7b1f0f963f71c21914308cb795d4fcd82c86e1e8edfa59d7d7f4646fa53ce3bd9f04d3e14e9fa65fc4c6d48dcd14b4722ff6ee02f24d90423303997b3684cfe390590fe05e07e94392a93a92c609c347ffaffe89d97e6f94630a2a79b1cfd641ae93d416141a7d10e56c56c", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 04:50:40 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:40 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 656.625689] binder_thread_write: 18 callbacks suppressed [ 656.625705] binder: 20934:20942 DecRefs 0 refcount change on invalid ref 2052 ret -22 04:50:40 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:40 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 656.694864] binder: 20934:20942 unknown command 1858634445 [ 656.743217] binder: 20934:20942 ioctl c0306201 20000100 returned -22 [ 656.771098] binder: 20934:20945 DecRefs 0 refcount change on invalid ref 2052 ret -22 04:50:40 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:40 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 656.795037] binder: 20934:20945 unknown command 1858634445 [ 656.814627] binder: 20934:20945 ioctl c0306201 20000100 returned -22 04:50:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="0ead67"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0xfff, 0x20000) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x1, 0x0) 04:50:40 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:40 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 656.973469] binder: 20961:20962 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 657.000261] binder_thread_write: 15 callbacks suppressed [ 657.000272] binder: 20961:20962 BC_INCREFS_DONE u0000000000000000 no match [ 657.062768] audit: type=1326 audit(1536814240.879:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20965 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 657.097106] binder: 20961:20962 unknown command 0 [ 657.110234] binder: 20961:20962 ioctl c0306201 20000100 returned -22 [ 657.135022] binder: 20961:20962 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 657.152013] binder: 20961:20962 BC_INCREFS_DONE u0000000000000000 no match [ 657.166163] binder: 20961:20962 unknown command 0 [ 657.175728] binder: 20961:20962 ioctl c0306201 20000100 returned -22 04:50:41 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:41 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:41 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) 04:50:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000540)) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000580)={0x9, [0x9, 0x4, 0x2230, 0x3, 0x7fff, 0x6, 0x1, 0xfffffffffffffff9, 0x229bb12e]}, 0x16) r2 = open(&(0x7f0000000040)='./file0\x00', 0x101000, 0xc) openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x80, 0x0) ioctl$SG_GET_PACK_ID(r2, 0x227c, &(0x7f0000000080)) socketpair$inet_sctp(0x2, 0x0, 0x84, &(0x7f0000000140)) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000280)={0x0, r0, 0x0, 0x9a01, 0x8001, 0x27e}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0763244004000000086310407423a94682aab22fe6279453051620016cb69a811cdc1d9e1b09a46c818a9b157e363027eb25d6062927d003287c6aa5d46560ca6bb59f9d21c11d412053abe5eb354919418314569f5839c1131129e7a40c2ef39ae9f9d09ca8649537bf1de405df91281ac19bbcc3a05290e7a4f44aed594755603944d6191fd673e10378cc411f8127cde1e6e2891f50bdaad9215ee4d3069cc3bb2eaaaffdf011b8be4f4870cb8150f565", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:41 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:41 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 657.696433] audit: type=1326 audit(1536814241.519:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20976 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:50:41 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 657.795561] binder: 20981:20992 ioctl c028660f 20000280 returned -22 [ 657.802727] binder: 20981:20992 unknown command 1076126471 [ 657.842564] binder: 20981:20992 ioctl c0306201 20000100 returned -22 04:50:41 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 657.874688] audit: type=1326 audit(1536814241.689:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20995 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:50:41 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 657.944741] binder: 20981:20983 ioctl c028660f 20000280 returned -22 [ 657.957840] binder: 20981:21001 unknown command 1076126471 04:50:41 executing program 0: getpgid(0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip6_flowlabel\x00') dup2(0xffffffffffffffff, 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f00000001c0)='/proc/self/net/pfkey\x00'}, 0xfffffffffffffda8) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000003c0)=ANY=[], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000240), &(0x7f00000003c0)=0xffffffe7) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000280)) getuid() getegid() getpgid(0xffffffffffffffff) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000500), &(0x7f0000000540)=0xc3) getresgid(&(0x7f0000000880), &(0x7f0000000080), &(0x7f0000000900)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000940)) fstat(0xffffffffffffffff, &(0x7f0000000980)) getgroups(0x0, &(0x7f0000000a00)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000040)="428055a0876969ef69dc00d9ce41ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175450f2e1ac4010d64ac1e5d31a3b706e2989f7f") [ 657.997547] binder: 20981:21001 ioctl c0306201 20000100 returned -22 04:50:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000040)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:41 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 658.112163] binder: 21011:21013 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 658.139596] binder: 21011:21013 BC_INCREFS_DONE u0000000000000000 no match [ 658.167265] binder: 21011:21013 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:42 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x4}, @increfs_done, @increfs_done={0x40106308, r1, 0x3}], 0x3ce, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:42 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:42 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:42 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x3) r1 = dup3(r0, r0, 0x80000) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000140)={'team0\x00', {0x2, 0x4e23, @loopback}}) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000000)={0x1000, 0x6}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f0000000040)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e21, 0x401, @ipv4={[], [], @loopback}, 0x8}}, 0x7, 0x2, 0x6, 0x3, 0x9cb1}, &(0x7f00000002c0)=0x98) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000300)={r2, 0x1, 0x1, [0x7fff]}, 0xa) syz_open_dev$mouse(&(0x7f0000000340)='/dev/input/mouse#\x00', 0x9, 0x8000) 04:50:42 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 658.758219] binder: 21035:21036 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 658.788833] binder: 21035:21036 BC_INCREFS_DONE u0000000000000000 no match 04:50:42 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 658.828949] binder: 21035:21036 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 658.888163] binder: 21035:21040 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 658.918556] audit: type=1326 audit(1536814242.739:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21041 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 658.923278] binder: 21035:21040 BC_INCREFS_DONE u0000000000000000 no match 04:50:42 executing program 0: 04:50:42 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) [ 659.004595] binder: 21035:21040 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000759656c1021fa3b87de08e51e2b2123785998807288d6444ff9b12d543be6c767b0d545f251d2b550890058a174a0a3dcc55c37a63857c2ef319ad0beb767082cfadef75553712e2867ee55df68b1eaaaf3c34736ad4fe14ba43f1e7bff18e8faf3f97a989dd667cfa6fcf5aeaf401acba5627653a74f45b1cd1a0b2669af9e874fc59c50bd27b415bf432b3376444537bfd1f45f6c148e87fac8e61abec7dc9f9b7ef6d5c0000888b892d6d49afeae7944120962bccb011d8d67d3dd22e15623f96ec88795aae143c1d672800000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000040)) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x80801, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r1, 0xc1105518, &(0x7f0000000480)={{0x3, 0x2, 0x1d, 0x7, '\x00', 0x8000}, 0x1, 0x10000000, 0x3f, r2, 0x1, 0x7aa7, 'syz1\x00', &(0x7f0000000140)=['cgroupem0posix_acl_accessvmnet1user\x00'], 0x24, [], [0x100000001, 0xea2, 0x4, 0x9]}) 04:50:42 executing program 0: [ 659.133360] audit: type=1326 audit(1536814242.949:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21053 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 659.151456] binder: 21058:21059 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 659.197005] binder: 21058:21059 BC_INCREFS_DONE u0000000000000000 no match [ 659.243085] binder: 21058:21059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 659.278018] binder: 21058:21059 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 659.316832] binder: 21058:21059 BC_INCREFS_DONE u0000000000000000 no match [ 659.341762] binder: 21058:21059 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:43 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:43 executing program 0: 04:50:43 executing program 5: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) 04:50:43 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:43 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 659.814218] binder: 21069:21071 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 659.847232] binder: 21069:21071 BC_INCREFS_DONE u0000000000000000 no match [ 659.856346] binder: 21069:21071 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:43 executing program 0: [ 659.866009] audit: type=1326 audit(1536814243.689:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21077 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:50:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x40000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000080)=0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:43 executing program 0: 04:50:43 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:43 executing program 5: [ 659.989960] binder: 21086:21087 BC_INCREFS_DONE u0000000000000000 no match [ 660.026713] binder: 21086:21087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:43 executing program 0: 04:50:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x80, 0x50eae450d5f5748c) ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000200)={0x5, 0x3ff, 0xffff, 0x5, 0xfc000000000000}) getrlimit(0x0, &(0x7f0000000140)) socketpair$inet(0x2, 0x2, 0x0, &(0x7f0000000080)) r2 = gettid() ioctl$TIOCGSID(r1, 0x5429, &(0x7f00000002c0)=0x0) setpgid(r2, r3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000300)="428055a06b6969ef69dc00d99069203637c3397c2a060f38211a40a564a741dfe0400f01efe5e57d0f2e1a1a01460f36660fd3600931a3b786e2989f67430f18d3") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="07630440040000000863104047c64a8caa7b1440bc4347f620ebe3130cc11beebc222ba3bc6a7cb230b3bc123ae313185712a4b1e6007dae7874e2f92a393540254cae50ed422e7da3fd169616a5d0", @ANYRES64=0x0, @ANYBLOB="4b54040037f228742c05ccbee2db5ce3894e9f7158c32acf100000000000ffffffff00"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) fstat(r0, &(0x7f0000000180)) 04:50:44 executing program 5: 04:50:44 executing program 0: 04:50:44 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:44 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:44 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:44 executing program 5: 04:50:44 executing program 0: 04:50:44 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:45 executing program 0: 04:50:45 executing program 5: [ 661.129464] binder: 21105:21121 BC_INCREFS_DONE u40147baa8c4ac647 no match [ 661.164234] binder: 21105:21121 unknown command -300170996 04:50:45 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 661.197891] binder: 21105:21121 ioctl c0306201 20000100 returned -22 04:50:45 executing program 5: 04:50:45 executing program 0: 04:50:45 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000280)=[@acquire, @increfs_done, @request_death], 0xac, 0x0, &(0x7f0000000040)="38b72d52c56c5442f86cd85c8dedfee5096deaa474333adfb7de510bedc23f6d0c88cd59f60dc063f03f71c1648fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389ad8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7"}) [ 661.833123] binder_thread_write: 2 callbacks suppressed [ 661.833141] binder: 21105:21124 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 661.849797] binder: 21105:21124 unknown command -300170996 [ 661.855530] binder: 21105:21124 ioctl c0306201 20000100 returned -22 [ 661.955195] binder: 21143:21144 Acquire 1 refcount change on invalid ref 0 ret -22 [ 661.970744] binder: 21143:21144 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:45 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:45 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:45 executing program 0: 04:50:45 executing program 5: 04:50:45 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:45 executing program 3: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x4, 0x800) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000080)) kexec_load(0x4, 0x4, &(0x7f00000001c0)=[{&(0x7f0000000140)="852874243aa32ac7a8ccd9aa8103d8773a59f8d0829558f03ed2c356ba25e7fdc2f9aed49a04e8d5deea628116bd1d6629bb52695fe416ea5e0a2dea7df937d483a4328c8a907cd96cce311912e859c23c3b429299b715ec4b3bac24a3771eb33c7b87083f7a7ae335e894f38c", 0x6d, 0x8, 0x2}, {&(0x7f00000000c0)="f99f3b4337", 0x5, 0x1}, {&(0x7f00000003c0)="c59bdc3c77f397ab5494f2f64ea15295218cff2814bb8880b3cadcb06ae072e94591de13abb954dd1fc90e7e0850329fd45578f90c72ad57e82737fe891a68d19bf4a0f9fb107aab6d7c5807ddf89b3989c63cdba9e957eca9fd348041eeb0f9d9b46c9d15b8f47dde7dfb323e5ff213f8f4ddc32f711dddb5cf37b3dbb2ce0b4eecff35ebf42ac86f6a4526873ed469e8c767a32e7c34a5d6ab0135526b2a21e5dbadccca98e4c2775d4d0fe6e1001720a3a7626b6e536be9d00d5cfaad0104da1d0909da182224afa40130d96b455f1c8b527e17f7c655901f14c9abfd8c5baeffe8fafb0e95f85ec6031f2b737225251560e097cedf1329dd9a2fbc9073d0409e61bce9c339329269f920e49f09840fad6fadbba6284bff3506f901a6787e7bbc3cde3aaed19d6f9f1e155f23906db8ad2fe895bf3490f19f9789531961dcec50a98c8da3ef432e4a0dacdcd26dabebac9c83107ed9a5285efe3b7796bd44ae643c46d3b8dfc2a857bb506dcc4d737b59c200ecf23a768f6cd33246b06240cf021ec4f1cea69ad44a79d3d8a8f75eba18243712ab2063d6b0175580c6e8956c254c4e910b31c9e6d09b041724e0a39ae57c7e391d5e07e05c357d2e7f2dbe40686b4746a70a7727bed63ce43fb1615994f4bd765f419748ea482bf882381f0a9e8f2bf55251bf2612b56db9e9cf4fb26825d0f7bd0844ccf9cbecf5095ed5a73bd27d46c189327d88c2b01a1b9aa1babd9798906c676bbe1cf976fa506e3b9e2195c96ff7e26add98ed1ce64ce124a31e345a91762a58a6ae1998f9950b24604402055bd18c843d22771d8e4db89c1f24bf319f2985c00cdce5e54a2e493246c7e81476a7292d3a1a544ddcc92bdfd0ad8c50015c39938c84082630dfb693055a6c6dba41cf5a409eebdc837950369647fb2a379e268fc20b4802ed407992535b1120488c578ee02fb8f54d1bff725ba900f638e9f7dbc61a51dcf3c71db958078392372e9b3c84dc8f73dd219325b31e2b9bb96485c0475f71b2eeb34aff4e58cae0b1a028b1018d11cf6acceb20e77141bea72af7276a274807d8e30bb42b5f34ef68dc8080a21a09b2cef5217e784e9e3eeb9a2d73028be5bd5e1b2075bec4c672b1b390160fc04cd3e140af8bc7f09fadc0364d7289f262991972a890248c182f69276f881faace440c6bba3139c0259ad33be4b661d75133ad021df83a80e1a9f4d85b172905fdc98453b358dfb674a3bb9ff32863401356f45448a69b0c8cc6ffd3f9a932ab9a6849c04c6e413442022deed2c0fad7273ef5e4553c8740d488ce27e255dacfb825d55bec643ff0de219e21327fecde6a2f8b0a5faed697efd4af18ac9f33816abea9413b98121a086f8472a52ba9580ed6233f616227d1e31d6960ff590ac032495ae51204177290dd8bd204ff6119e291965261584534c0d3c9d9f3ddf8052c5f2bb987a59aa8de6e0dc6e361ddd7973731fbb462e7e496e5e5f6115531d8c7cafc0f7d790ab2813dd2f24bd90157ec44551a5fba29561c95ff12f573853e601b83e8c25bf8495c10ec716b3c82ea96c44e6a41616d0b3e6b5c5d6e623f24886b4f47a3d7b5d21971155c431a34237cf819f38f5179757fe49b9d0ad0c1515df9a2d578ecc5cf671d3d292b9f574b4393fd55e4adb3433a9ed3b9720fe371f4b68bad807460477173b254e7ee31bfb503531f8d332c270555c9c84f6c99412c46f8b7e9305c62e8f130e9ab38243ba89a9d5fd441f27f88c2b053cde5c99434914f7376f8aa23fc1abb90efc16453c3208ad477665f2993d96ae360e42e190e2fac96c4bd01462af8bdc0b4b9f849e21f274872dfad1d3a159ca803683d6d4a7559c5216880137f4f496ab658b4a38ab57d460ecbd2d49333defaa34c6612275611413a472b6a14c3bff73a609acd4639ff8e9deebb2d38c5ec6df20d568b9c65b970e9b9b00b4a290689d070ed24e1e6876fbd619b7c44cb25a67353da80f65d38c97e56421922401be81094c323ea766c4b669d78defed045acb24a49259050ffb8861d6ed8de0ddab86fd4e734a5a1b8a9a6bbf541f0664b0d6c11f42f883a5706776de9a1cbc0f5bcf1b3adad97209b405e843de829e7c42a92dee4bea4f25beace15763581b5b08214c7bcf1d32975a5b0fd387eaccb429de5c9911d78997c7638b6573e4b32fa9c624dc398489a3a0c449b54f01bda106960e73b63088b6063e085fab58dbf8741d3adc04b446db4ba2749396330e9af48c3c019e7ece59a8f4b263e63b21f06e3f9056649a3bda97299807beb3edd9cb3d53266c72c71f286333796999c468bd0cecfe4edc3ce606ed2d09e46f12f1f17de0149b4eedef605e9c7141dba16be707f74abc6c44c779883a7ac5eaf2252115b95d3233f6d5e2ea65fe6d5efeb42b0e83435e0e9dfbb401af429ac443a6a481aaef870a0f5e95b815c8d0fb306c28f27a0347027a12de658f1e26885675eff8db2040aa73af6142d2454a4066711f0caea292852a1473f988259b0d3556f2392f739b0a75fd7f61a1144aaf25e1f298b17884620ccb809a965de5c9414fa4a09fc8fefdf4151243ca1fd3ce14cc4bba28522e3fea6eb35a4d30583783e1354279d42f5dd93e12ab3d26d357eeb7a9e092813dd0877b912f5ab4fd23c1c0266c8271f747950536d309ac7a6e4fb9e516ccd7c48e654b96466e154d1af38ef8e380b3c2f631c9382d652e31e953a99d67093a4d36a6c2404d1bb9ca751991161bde587d21dd68db2dfaf12c0226f198c71f663195c3efbfc1d618c1f9adc5934be3ebfd245a34fa4facaff73d64ac43bb808d3da572865a6bc1cd9d1dad9ac36e301212bcd606bab3c9a0a04a8a14f6e9351d6ef8013865cb1a50253754b14c33b1410ba78515ace5c065b38beae0ddef77a2cdf515f087db1105334113e6b8c3a7f47108077d230779306aa1c89d1ebfdb6aa26107a82b0a97a8a2724a67656998643c6d65990ba4a1a09873928c0271ce38e151f53399128eb501900c0895f679a458c7784eef1c94ce99a0437b965b48bc0670fb35d9808848be281f465fe38a83084d446b79aea6197e190367ac23cf957809d17d7bbcb10b6140844835c96897a91b804fc6f2b101f4ec6577c0a67232f2a8fc64826335a9b509ebf22eebfd7bd908a4fc52f33b3fb296526ac2703a32c82a0a61221759810f1a2f662a33c02bdc2b84d2d4e6dd13a93e7984a2baa8ec8e67845f8ee53e8f8ba27fbb2ab046674155cdf422dbb977bf23fb7fcfcf870f5fa99349174c286b39f7228f6288df0eacdd53aba89da3e1f063ad4cd932d6fef6eb2ad5d2a2159fb8c117b885f9e02c05161068fafd4fd1e908e36964141c3af96681d98293da4cadcdca84c531f56933574f64a53a26c95427720ea1577f0e16658308e9857a8a97eaffe81c261437b9fa961d7993906c16d2e45b007835b8c2e2abf7b5b6eefe40f1fa38ba1607eee35147e428a8d3845340082e38d85aa6782097117f11a7ae25b6ac9be44328698a87be33378c1fa007f4c3c108fbc3b20a4e444b42b108884aa6154b5e53340d28f9e3428e97459b6a62b3cccd236e1d5272fdd51fe0a09788c2df9fa07113161e5bc05f8d79e65a91a29408823a1687fd15458db5f8f48b716ce98ebba3bb8423a9ee9d88b3fc2fa8aea3764af3061cb41f53ae177a6b310fae0e70ab1954f9bbdce1e5999c52c5ea42d60e91cb074f14165e7624055d75193dca3fad155517e27e7c3ebf53098dc898be98743cd4c36e5947c74fb63f5a1a680e3ad2595be0061de2b60052b5d52c50781ea7f790c6a8b192b118014c32ee613a59c4a8ec7216287bb7ac67677761d37e0cba884ee940d894e106a75dd5246f589e24b27cb36df06f763e03e0415e692242e72d0f2eea85bd87c3cfd4cdc8173b23b4837ecc0f4eb9bdf9e8da76915e1dc17f1df8bc16fa775eff4f92a6dbeeaaf99635cb1728e2c2b4d7d0e29573fe4aa04612b405cf0ab052c2b3139b647d94c2f47fb5ff80a2019880e138a711d3c7bbfef5e683ae3e1b00b4d244fb39d804cdba0b1ee24838e22894e48e146f8932a12b43f5d351303c60dac82bee785a0df0cee82258a4e20a8151ed8d0c9904bd89ff2414a4b185b7838ae7be4384fb181121534b8190b204f064e3a83fcdc7a4e77db94852db30f3b56825e27ea634190e08881395dcb91a9dbe57e3254bd1caae6dd0d3d5d8a7f1fe5b76b415453c68434ebff18240804d3a1b3d70b20ca67e09e593b08318e0f948fbb88e782c5e514e690b64b9297093372b543bfb90bc724babfa3c31bebb467f74d8e72b789b96d7e786fcec0d6eee9007c2d3f5e6d41ce3c1e0dc4337b00431d67f8f185c208a2ef36e8c4e8d7d4df7eee2532b80384eadbec831b03dc4ed54599969835d371f161f33030f8d917099a7fa7dbf5dfd94d1f118187155361e0219458c16d74f18e3224e6a043f219fc9eab122bd910c52803ae5602f7dea7fc07a4668fe697283793dbaa8485e90134047770756e228715304376fff90e4601c6ac014b7eddc385ff0c2a3043fcd168d51bafbccb17c42aac91fd727ac3b3f4e930bccfc63160177b3c2e8b65454d6b14154f47cadf3c4dc8023735feb98579ce05a978b2a1ae150534183c6a0fba709abb18daad8a46cf935f9c20d6acc31ab3867971a5cdb1636e4887c525a2a62f2d6dc40590ef6a8415036703dc4924fe54755a808654f7231963e944a33a7364235b6c0ed818e63615bf29d66c44b0501c7c3a02b42cb5c03212d84410ee772d73d24100ad16b089e2407ef1a0a04f06fe94a9149ae08e72b07cc3f415417eae5d30beb000511ef5f05e644291eef74527d0e4c873b35cf570ff0d4e0c18f72f0a1b2fd8ac2213e826f144e567679a0c8228c72312ee6f62b6e2319b838830d0500f8d48431208d6393f6a604346c2df1558d996416cf7d0192fb787c19a6bc812c101855f110a0009bd877aa4c1be851990f987977c604f62fcba50411e088bc70989a6552df025f09ab945f0794b10f3f8e2033eee1b27581499faeb68559e0031b9ce2fc27797407c86e54fa5c28ce698af195856739f70151b8b0ce01cc6b12b817b4aee34967d556c1bd2b2cf031fac43efd3bd2ccdc7cb0abc6d757722065f3bf40e7b506f7fd5d5f42fc5556e7b0244f88a66842e01520e3fc88e8a4f832cd40882dbafca91bd40f67016849b165521437209f40d2cd8234d1a66ce76334d029dccf89d38e1f31b112b5bed3cc8a1b364ab1e1474dc57223dbe7e70348b2904bd03ec3c8e74386947eee4685264a8d0fabd35a03bfa20e0ad525d42618a2884b2a70794fb7e7032ae656897736d7951e81d88499ddcb4410d63a5f5c2fd8a0667aa1e929192d9fcb45f8820cf37c955088319b2ef321acafc41c2e2202ba2b5ae1a0319c7b9558713be9e5d3ecfbc017fff8fd9f3d46f08eb2a9d10d7a136e079f895a33ba1a74a19449159ebcc5aa4331cf80339ca9591d72a8c2369be3887f1791a8dc02d63ebe16831902ba980d1e1c2bfdfbfb8069bfb97d6f483dc4007d4e7f4eb9a316855ea88ed8cdec5ddac5a5c79ffc92e7a02e331e47ba8f78263f95c59400acc56ae8f91cab6eaf26e50b7c981b8cf4aba372b00a289610f09a2607b5ba8f6b45a49c2dd0e856fc9353e9e9e915eec0b372d7f886d93c6822258d14cdb2b90995f62719c4aa26a316ff1f76504fd04fa8cbf3ec65d97a18e9c51fe0b3071708f209aa974feb278ebc4ae18", 0x1000, 0xa42, 0x1}, {&(0x7f00000013c0)="12981a8bf0ec2f9c7a0e4304a1f8790439f71a12d433f770dd48ae29676f00d14260910990e3b05ce9acace8232a689bbe78f559e406385bf88c384d1d21f55601fa610c1ef3d483db8150759d1662a03bc5e09542e6d4c65ed74abdd0905d624e01a439571f3b3eeceaa05962db1c8b595f2b5a935baf4cf462cba5b33e0a4758f649910f7c1e9b95d59600e79a543b7237b7882607d5d7121c0509edbd4a2e635f331af138a520ae66f05611046354012cc70089a948c3991150675d089b9d3dc07a4d5c", 0xc5, 0x5, 0x4}], 0x3e0000) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="07bc0a59a5d6a6ba0f631040", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c4000000000000000000000000069bcac7dd86bc0"], 0xe4, 0x0, &(0x7f00000002c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356a3c147fcde50e8939c1a8233ab62363c35e9aa3ae376e255acf5156dcb59540faf003e101cfb3fa238b5f4acbd16bd05de729b1f2b4a0a57df694a99b24cc4590afc93838ddbf2c46fd7bba95c4ece4ae2b72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e20300000036989bf3c1e408a7c7aac7dc93bd4877c7aa4c7c531493967c96d662e575dd4953421911a8e21782c82b04f082e26fb9c5a8000000000000000000000000"}) 04:50:45 executing program 5: 04:50:45 executing program 0: 04:50:46 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:46 executing program 0: [ 662.130687] binder: 21158:21159 unknown command 1493875719 [ 662.159860] binder: 21158:21159 ioctl c0306201 20000100 returned -22 04:50:46 executing program 5: [ 662.211540] binder: 21158:21164 unknown command 1493875719 04:50:46 executing program 0: [ 662.283019] binder: 21158:21164 ioctl c0306201 20000100 returned -22 04:50:46 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:46 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:46 executing program 5: 04:50:46 executing program 0: 04:50:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="00ff0000000000000e630c36002000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:46 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:46 executing program 0: pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000940)) getpid() getpgid(0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000900)='setgroups\x00') syz_open_dev$binder(&(0x7f0000000700)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) accept4$inet6(0xffffffffffffff9c, &(0x7f00000009c0), &(0x7f0000000780)=0x1c, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000540)=ANY=[], 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000008c0)={&(0x7f0000000880)='trusted.overlay.upper\x00'}, 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000a00)={{{@in6=@dev, @in=@rand_addr}}, {{}, 0x0, @in6}}, &(0x7f00000000c0)=0xffffffffffffffd5) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000140)="428055a06b6969ef69dc00d99069203637c3397c2aaf200f38211a40a564a741dfe0400f01efe5e57d0fecec1a1a01460f01ee31a3b786e2989f") timerfd_create(0x0, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000440)="42805da0c60fef69dc0f01eece73fe550fc60079380f38211af3c46178138cd466d12b24c481b5e5bc2b0000002167f00fbab204000000ca6b2179da5ce5417545bde02e1a1a010d64ac1e5d31a3b744dbe271fb0703") timerfd_create(0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f00000004c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @dev}}, 0x5c) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)) getpgrp(0x0) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x0) mlockall(0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, &(0x7f0000000280)='trusted.overlay.upper\x00', &(0x7f00000002c0)={0x0, 0xfb, 0x15, 0x0, 0x0, "cdbeecfc13b7a35210f33d193e50daac"}, 0x15, 0x0) request_key(&(0x7f0000000380)='cifs.idmap\x00', &(0x7f00000003c0), &(0x7f0000000400)='/dev/binder#\x00', 0xfffffffffffffffe) request_key(&(0x7f0000000540)='rxrpc\x00', &(0x7f0000000580), &(0x7f00000007c0)='/dev/binder#\x00', 0xfffffffffffffffa) keyctl$unlink(0x9, 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000800)) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40106614, &(0x7f0000000840)={0x0, @speck128}) recvmsg(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000300)=@rc, 0x80, &(0x7f0000000400), 0x0, &(0x7f00000005c0)=""/149, 0x95}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001740), 0x0, 0x0, &(0x7f0000001800)={0x0, 0x989680}) 04:50:46 executing program 5: openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ashmem\x00', 0x101080, 0x0) dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x0) getsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000040), &(0x7f0000000080)=0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000740)="42805da0c60fef69dc0f01eecec273fefefa380f387c366766460f38286200f081768cc8000000c481b5e5bc2b0000002167f00fbab204000000ca6b2179dae5e56b6a410febbd09000000800f2e1ac4010d64ac1e5d31a3b744dbe271fb3e3636f7c02c33ffff") gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000380)={{{@in=@broadcast, @in6}}, {{@in=@multicast2}, 0x0, @in6=@dev}}, &(0x7f0000000480)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000004c0), &(0x7f0000000500)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000029c0)) geteuid() getgid() fcntl$getown(0xffffffffffffffff, 0x9) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002b40), &(0x7f0000002b80)=0xc) stat(&(0x7f0000000340)='./file1/file0\x00', &(0x7f00000005c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000002c80)) geteuid() lstat(&(0x7f0000002cc0)='./file0\x00', &(0x7f0000006700)) fcntl$getown(0xffffffffffffffff, 0x9) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002d80)={{{@in=@dev, @in=@multicast1}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in6=@remote}}, &(0x7f0000002e80)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002ec0), &(0x7f0000002f00)=0xc) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000002f40)) fstat(0xffffffffffffffff, &(0x7f0000002f80)) getpgrp(0x0) geteuid() lstat(&(0x7f00000030c0)='./file0\x00', &(0x7f0000003100)) gettid() getresuid(&(0x7f0000003180), &(0x7f00000031c0), &(0x7f0000003200)) fstat(0xffffffffffffffff, &(0x7f00000001c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000003580)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000035c0)) fstat(0xffffffffffffffff, &(0x7f0000003600)) stat(&(0x7f0000003680)='./file0\x00', &(0x7f00000036c0)) getpid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000003740)={{{@in6=@dev, @in6=@ipv4={[], [], @rand_addr}}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@dev}}, &(0x7f0000003840)=0xe8) lstat(&(0x7f0000000180)='./file1\x00', &(0x7f00000038c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000003b00)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000003b40)={{{@in=@local, @in6=@ipv4={[], [], @multicast1}}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000003c40)=0xe8) lstat(&(0x7f0000000000)='./file1\x00', &(0x7f0000000240)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000003d40)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000003d80)={{{@in6, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@rand_addr}}, &(0x7f0000003e80)=0xe8) 04:50:46 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 663.091216] binder: 21184:21186 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 663.121860] binder_thread_write: 2 callbacks suppressed [ 663.121873] binder: 21184:21186 BC_INCREFS_DONE u0000000000000000 no match 04:50:47 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 663.228917] binder: 21184:21186 unknown command 906781454 [ 663.252483] binder: 21184:21186 ioctl c0306201 20000100 returned -22 04:50:47 executing program 3: exit(0x1) r0 = openat$userio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/userio\x00', 0x100, 0x0) dup(r0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="00000000005b19fbea630c400000000500000001000000004acd6b85652b20fdb7e0feae0d53a4291e42b1459deae952b960e9daa76c98f2694d52a2ab20b45290fe4c566e389f34105714581d55ea4a5e841313fc500e9e7f1c433396"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 663.294278] audit: type=1326 audit(1536814247.119:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21193 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:50:47 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) [ 663.424431] binder: 21206:21212 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 663.439962] audit: type=1326 audit(1536814247.259:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21210 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 663.465394] binder: 21206:21212 BC_INCREFS_DONE u0000000000000000 no match [ 663.483573] binder: 21206:21212 unknown command 1074553834 [ 663.498318] binder: 21206:21212 ioctl c0306201 20000100 returned -22 04:50:48 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:48 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:48 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:48 executing program 3: socket$inet6_dccp(0xa, 0x6, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x8c442, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) truncate(&(0x7f0000000080)='./file0\x00', 0x400bebf) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x40086602, &(0x7f0000000000)=r1) socket$rds(0x15, 0x5, 0x0) write$FUSE_LK(r0, &(0x7f0000000180)={0x28}, 0x28) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:48 executing program 0: keyctl$set_reqkey_keyring(0x14, 0x0) pipe(&(0x7f0000000080)) ioctl$RTC_VL_READ(0xffffffffffffffff, 0x80047013, &(0x7f0000000200)) clock_getres(0x0, &(0x7f00000000c0)) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$key(0xf, 0x3, 0x2) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f0000000180)={'veth0_to_bridge\x00', {0x2, 0x0, @remote}}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000280)={@loopback}, &(0x7f00000002c0)=0x14) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000480)) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @local, @multicast1}, &(0x7f0000000100)=0xc) getpid() ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000005c0)) clock_gettime(0x0, &(0x7f0000000240)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f00000006c0)="428055a0376969ef69dc3641ffaa32233333c4c2958e092e2edff228523044c19086d962788f35c935c97d197a0779fbc463fd7998b400ba000079aa66daa50000000066430f55342d0a0000000f0da11b000000010d64ac1e5d31a314b706e2059cfffdfffd") 04:50:48 executing program 5: [ 664.223755] binder: 21206:21222 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 664.231665] binder: 21206:21222 BC_INCREFS_DONE u0000000000000000 no match [ 664.239463] binder: 21206:21222 unknown command 1074553834 [ 664.245572] binder: 21206:21222 ioctl c0306201 20000100 returned -22 04:50:48 executing program 5: [ 664.320649] audit: type=1326 audit(1536814248.139:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21226 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:50:48 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 664.385426] binder: 21231:21233 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 664.424753] binder: 21231:21233 BC_INCREFS_DONE u0000000000000000 no match 04:50:48 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) 04:50:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf513a01cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 664.458608] binder: 21231:21233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 664.509927] audit: type=1326 audit(1536814248.329:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21244 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 664.539608] binder: 21231:21247 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 664.558116] binder: 21249:21250 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 664.566180] binder: 21231:21247 BC_INCREFS_DONE u0000000000000000 no match [ 664.580556] binder: 21249:21250 BC_INCREFS_DONE u0000000000000000 no match [ 664.592247] binder: 21241:21251 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 664.601220] binder: 21249:21250 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 664.605339] binder: 21231:21247 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:48 executing program 2: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'team0\x00'}) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000005c0)}}, 0x20) [ 664.631273] binder: 21241:21251 BC_INCREFS_DONE u0000000000000000 no match 04:50:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x20, 0x80) write$FUSE_GETXATTR(r1, &(0x7f0000000240)={0x18, 0x0, 0x6, {0x80}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c4000000000000000000000000012d9a93f401b463de5d9ee456b29e821b29a00809eae22fedc4523e647f89a3a79168a6bac2f5f8110b6002c7f9dc1241b4bb5ad174c3d488f56b34508ecd53fa9d186992f419e8d2415a969e6a27d58c4165aa710743b67ad54fc72e08e2042637fb42cae5c94d0f86a64de71810caaf94c60496e81e7170ef0979a11f51ce4fcb308df6368"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x8002, 0x0) write$FUSE_NOTIFY_POLL(r2, &(0x7f0000000180)={0x18, 0x1, 0x0, {0xfe}}, 0x18) syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x802) [ 664.690727] binder: 21241:21251 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 664.777274] binder: 21258:21259 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 664.797612] binder: 21258:21259 BC_INCREFS_DONE u0000000000000000 no match [ 664.822929] binder: 21258:21259 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 664.852451] binder: 21258:21260 BC_INCREFS_DONE u0000000000000000 no match [ 664.877822] binder: 21258:21260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:49 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d1372b6ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYRESHEX=r0, @ANYRESHEX=r0], 0x8f, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2bca0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0xa00, 0x0) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000480)="3b9fef810299361a2c6bcf12469241b1f28efcbd2453f78b07b7ed3c06bf9f812db5af2fbff0a94bd8eb9e2b5922dd957df4ffcd083532fb7f1e7c2cebc1322e03ae4f32d0926a293948e7415f486b42a268799e9af7a77c0dc90dc605e5e0094ea7c1363bce9680f4165cf8e25198548e88750b9dc4b1b9587b4a739f0f0dc516dca32efc64ddc34ce27e2f73d8c5070daf7b98ea2a61a588fd472bd2bc3853da76d3752576ba4fbf58f51a36af63156cbdfc50ad9abad7be00bb7b6a34496cd219d76b3f6f684ebe7192127a5129e27f247a6d74a059ae904421c8b8260816653d1df5f54397e0944c8b7b5fb4e2384b8f8a350afc36552e671571460ce1ea512de8c1d9e5779b4e84e90a3648e17d95740dd4b7a9ab1f04b82e9291884ec719061ae9e931a634d1bed1de062ea04c5bf966e407adfce4832e04e7b3696fea1a50021843f807af86db744a0f9dc28159f3569d325d8c391bff8b60ec2bd972e4dc75fc36eaabaa1d616404696c16b23f6d63b2b4991dd45dfe8a53c5aadb7de9f3f37de92d2b2aad3e8af5a85c82fca1f18bd5bb9e2635d48e96eb0016aab885ff709e71d53ca514c7f2e685057037398ea3626c487d9fe8813c75e4452e4a7ef7c795e44c299d1ef981a4f637be075ca1a009341a9020114d45a9e107bf0d09d35996841122567bf464c3b1a1c140a8af189e7a1f026e0f4e1a8ed43982e8df51f102ce53fb02be629cfd1ad13693a1cd3b76b3815b52fb6b5f10b91a5cf28e85053fce47f8ce7c2aab9faa0d3deadca05d0956ca6ba6cdab45e43a3635f37a427012653fe677a0a29c2c20d113cdedbc090ce4c1c83d95f6d813001fc0fd21497458376878b9a5ea11d1f22dddcb01e09999502e76b3610b9d6ac309ed4367ee9c23a25ee5f6c0fc2ae476a23f5871e9c1fcb31b29ab49296a76b6da8b86abf0235b6825c85f7ebcd0f5346b584c21ff9d0a961951496e218ef7cc660ebedefac5de3002c972b544791ec67d99bcd3f402655a95058119686c21b303fdd4e300cf9d6e11dddc028f7cb881a60ecdbd846c43c1e5b7aa53c2203780e9f49bb67c253d15346ec2c60468513d374fefa6dba19e9d892bba037ade0632643d08ad79397be61bd019c38d7eda61e3fcdb1708f279df27f688129ef363c5b324a227f996534cedaa00f35927a5981c6e808304777a0e9b9414dfb514e33802bc65fad57ee2f25b5d17c17e000f5ce19d56712e1d2b02e3877d71d37da35a41f5f6d21bca83cbf663477133e9a4996456493dced3a4d19e436924c5e3de4de58d5aa9740104f4bbcbb086be747a13785be579028e56b9f45fe35f0a1dbc200dde3c2997fcd3f541c36eabd325f864e2184e2c41ad7a784ed7267140973ec9a2fa83afc771eb9385bfb2c0a35d147d36009ec56fd68a3b9547b26a987b7cce2c5f94cc2e23dd18fd8acc7245a8a53cf0202d2a59de918693d3574302794d966c82cde66d7186ebc62749b3851ed53df06c9aaa4d836e95763be16609375fe121f106af709f768b027d717c7762a40587f3cd52409810724e5bba4e0ee8fbde1b044ed2740746ce0a9e53777bb32eb46e955e33364b31644ead5982218fba29b9d42bdb776dec73fab204a71c7328b1982cd2973024204d379d30f2b61723dacf58d08cade038e3b716e30cc1f103af61b37a17b281e5c6bdf860a65fd1749ad4767d2eee5bc5be31ad04cd71db10eafed9df1dc3304c026bf5247a493de9015226803dc8644fd85e4497229c240de108fb6c6c70c32507bc3009dc2b1914ee09bcac8ee9ca3eb003f5c66f3a8eafe8277981946938b9f66a47f9ed003d740c4bafff28ef380f945005899bbd2140ca302855c1e9d2cb1bf14840b220a6d2d83ac54f9b79eaf27f72533e71e2c1b906f0eeae8a1bb4605c43acd1339caee28efa22aa4a777ead45e11122beb66025322e0bab297413a4cff9c4a2ce5582e593f27742d76cb1324d356771e600fbf19d2694eb34cdf04d136982c4a39b8038dbd53b54cc2e83710ef837908a195bb03f4950dbd50427efd477cbf69921a429056cc6ae4f9595734024d4badfa66e2e56372ae8ab4c1a5da946ae1ed84a143651dff5acfbe746fc4365b3675863eed74e589c634e106d35ee1cc8695d067a72f36e63a4e06d75b8e0d26cb7c750a62d8d4aee36ae1c3f84320fe654d08cf7aebdc663a218903d2efbb9d9f2cd13f8a2572499db40d569b15e6b7677ca32fceae2c4b3d81d33d46651dba408e40f352408d9d88bbe72042687c725bdd7ec5f90e56585baddadf9cd5de70f1e17dc42ead2af274d0428090440193854243803f792b4fbf2189afaff6bf6427827ec2ac0d5ff8d21905ada47a98917ce7a1d60dd128e2c445cd3447c4f91daff3c053f85bfcfa28d94643ff6c06ab2869f72143acc44972250dc4bf5f972cb43714c4f59989bcaf9e49bc6fac1ee7d56dc6e6198e72b63055f19388d575b4b563b4b73c6ce7eb28cdc1f089434e096a51d6f87c8a7a62828112f4850ed0500d42b4e0a2ad3a6e87a5761533c75d832131799c5400204c71c240ae1feb6e014b4c6ac9ce1ad96a6806549dd3f99f0de533c0afdfaf47da4d6a4a5254210a2039913ee40ddf3dd302048e058db2282e48034fd24242dc486677489b0b4297c8d94f8659c47b75ee719241667ef37a4e1fd1e55514e3582ae503d3d389d5446a2d4124679ce27ba0abddbeb6615f0b437f498cebf03fa9b4e299b7b4d5ab9fcc788b03cd766ce013db7601033a1bffb630e9ceae7cd7fe279ed05121184d8d18c713cff984768d7efc19664811aefbe159999f431e34c10dea16696cd142f295f6357d85ffebf7c1698d350664bf7da20eef1bb844e9b0ad27ebb6091168d6b7120bf7920c712f781fd2d381f1dc8b9fb99f6d07810969954380fecd59360499311ba85c81c782cec73693f678a4564ffecffdae3eec1a242a168ac4620a54c5737b72ae24b5290e1f3e611db135ed80c60a08d60334c5682108ebe9838ae8f3aabd1da2bb26e1bfb3583b40de3c310d15e21f014590e1b00ffa9624462a91197ae1017f7a973cf5def26a7ee9608cbbd6c070e305c93db9227f0b051b8f094bd1b04cdf2c7ddd3260d9b9fa1d421dfba9f7510cdbccc53bc1a6559de9188ce1a7aebded5ba7da7307e150e17529d1126b1aa40f62afc64c9085b9063ec1132363c86c3b407e2d9326ffc40dd769d46f7da81b8b5728cecc1736b17ccb6ddd2d95cf33140441d3e9767e2fa56528140f21193d4b4ec0ba91ad2d9782e198f93fc6de6462911ab609339d3d6e69681dea070801b1db047dc324c8da1cdbfe690bb3a3872a1b16c732f1ec170407a013bf275a73ef389f17ab9f2232f61c8185fad37aeaab734d935d1d972e1fb0e11e0a35145971a2db63638203f65b3c3c4d7c4970bbdd1c1efb59c664986a1de538864d4b90e11eb2618a501954be9fe390b65d05b47eb2439c3fbdb07498c743ad515f11929f1208b633b9b974c53cb50af74b3041257851bb36ce030cc4916366acc39d03d2d0b3c2cf86dbb4eab6c9840e538f7230f1ee40621a5f3c2a654a14926cf0b45c7afa23103cdea499a977365cfa817591e8373caa321849fb88cb240e17647dbffc027972b9c7af47e2e240eb12e102b1c1cc3fb6ab0365a931ed7a52c9561182976218a02f9cfa1ea16c0e141f848e01add2c5e74059df4edc499067fadf6bdc03cbb3ff1ea7f5387cee6725cb2efc70506807378e62b424c298213f9a30827ba4ecd2e6de0c547745b57a5f25dd60db3935aa3aaa15fa7f0f828c3c4c372eeac9364325705128fa7462babbf1bff9b59647c080c8c13715f48d7456b055ebc7a387abcd48999a0823a047480e7cb45db603b8799be50a52f17db220e95a3186b66a11cb31642752ff227cd18dc50c7e6a1da9a1b1e14a9e4b33855adec46287fa2f9772d1255457a96e95e642b9cfe0ca583c93e9e6d8b1dbc762d0444b8e516ead62fe5097a6230415bccbbcc551c957c67571541ab92461c3f4abf5c6f075618808d03c6419a47a4500de2b25916200b4f53f9fe39ad18875cb7bcc3b0fe52a7c9eed1df1c6aaaca96736272de3701de7b53a6d4e5d5a5090ed883ef87a3b311af9b46525e5a5bdcbd7e81dfe9323866ae616741b7acdef639f8157378f4bdfa6f8cf037432c66d689e4fefc36139f1806945119755309a8821e20675af3254bdf35fa2fbc743a77a7857d1ab016f1546d4c95476a95ae931ba7c5c57ee672929774a7d8240369f3ef9fb9195374da5b1c3d82fc9ce453827b8ba2d2eb62b30db9809bb16afea81ebf9e260933324cb966f452355be2bab56bfe507e558e1e9808be64d6ebc0576e6ceae00857106a319e431015d5c37866ab27058b0a8227d1a85fc5d19056fedf5c2583b77f7e263b1ea232f789e7eee9ee77dcedf821c5c23c5320e347d4448cec2b5fd31dce82c6716d0f567fd5f65c0b78eaa94eddf72876a7f021c96304c917c007941ba3c0770c1a4b7cadf1783282ea14e2f812a859f0b15a37e3a2c29ed87bf05e5392d1ea58e3918d2b30f000dc0891f5b9f7505b57f87ed06cfd21ef1bded0102e60f9a6bf571b2671099ebc8ba12885416a64bf82db2d5b8edff006390d049cd23179cd364115067f15fc91b7b3632c07ff083f8e7343958b442b7f2d3ba7a16e45c62f15c50daf22c94780632ba484c6ae6ac7753b7eecd5de1cbe2aece61bc330ef591fa17db47b1ad832917b808421c3760b4d5159538b05b6a034c4045652f023026cc47eda7a750a37350911cae0ff211fb24cb4883d047ed74753a279eb04c6488b7bf28d6f6591bbb9f17017b833b959f556768ab8b0165229c7443fc5e35a5f808ce99bb30f7f4414d71c769c71bc400510e18d17f496c840649c6ef8181df8ace9af94e4fb2a1f55943fa05ca5399ad829c3aef7d6fb87743f7b6f2cbbd6cbaffecd64a5120630c79ecd58b3e272a94105a97980cde65c3a0c8112b77ad01320ea1ce4086cd62afe4f807d90902be85926795832e6eb8676b6b09a3fa7170fd3df8cb9e994ecad9d4ea202949391a56410f5ca245c41ee05e146549ab702d7130b82e98184713766f0b2640236c386cec67aa2b8e40ec8d24a94d3f9fc1e9349d04ef637df87322cd696efb806fedd820875e8d82393cad55b1345fc2db887140581106af7b9ead698d1f708099dcf07f051dd4ec6d4fea69af9c7272364589c066c4c4d3117c1792f524fc2edb503bf465d79f2b2efdc69988e9cf5c2acdbe337076a7505dd843f1d51958fbedb5a4bcdcdf7692987164bb5685c6fdf6bab07e77f4383ee3206ff5ee8c94d24e44c73a02096c7aadc1df1ce33e8fb735a7fc38d82566af80068464fef79255fd3c1c47a21ff86cb0aaea6eeadd310627a84ccebb3a48923e6c88f07ab6a9190036f0852aff9b60a84078b6d5ed1628d3950fd7f3666d3c218cc902e6688beff7685b2406610c8728aab456b8c85967b03f9c8e4cdfab7b476c57c36779bd2013bad068c65d93a625eb56dd37804357f3514a38fb797b21fa4f7f579e0d9f367f42ec293f157ee87b6e4d7bdb39428f863bc7184a4cdf727f96579261e1b8b9e2fb1aaf559f75104d24c867e85a540e5ef21c73d20d8eefce924e67b626f9b16e25e2798c0446ef4dd25d7e2973c99560767d53d5b3d5dfbe44107bccd208f293861017e7238f39a405ccd449daeada88465d95c3cd3a647eff1f40d45d05ab8b45f8fa51a99") ioctl$KVM_GET_TSC_KHZ(r1, 0xaea3) 04:50:49 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x400, 0x0) write$vnet(r1, &(0x7f0000000180)={0x1, {&(0x7f0000000080)=""/67, 0x43, &(0x7f0000000140)=""/10, 0x3, 0x3}}, 0x68) [ 665.217180] binder: 21265:21272 BC_INCREFS_DONE u0000000000000000 no match [ 665.267093] binder: 21265:21272 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:49 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:49 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 665.329207] binder: 21276:21277 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 665.359728] binder: 21276:21277 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x180, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x33f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:49 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 665.507258] binder: 21287:21289 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) getegid() 04:50:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x20000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="074004000000086d4c40", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x100, 0x0) clock_gettime(0x5, &(0x7f00000002c0)) write$UHID_GET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000040), 0xa) syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000004640)) semget$private(0x0, 0x0, 0x0) semtimedop(0x0, &(0x7f0000000200), 0x0, 0xfffffffffffffffe) futex(&(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000800), &(0x7f00000001c0), 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000004600)='cpuset.effective_cpus\x00', 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000180)) ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, &(0x7f00000003c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4000000000058fe4}]}) openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000240)={0x0, 0x0, 0x0, {0x0, 0x1c9c380}}) ioctl$NBD_SET_TIMEOUT(0xffffffffffffffff, 0xab09, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000000600)={{}, 'port1\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer2\x00', 0x0, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000400), 0x4) socket$xdp(0x2c, 0x3, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f0000000740)={{}, 'port0\x00'}) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x0, &(0x7f0000000480), 0x4) epoll_create1(0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004400), 0x0, 0x0, &(0x7f0000004580)={0x77359400}) syz_execute_func(&(0x7f00000004c0)="40805da08d0fef69dcc4a3bd79734c44cec48275ad7700f30faeda380fc4c27d0777051af3f081768cc8000000c481b5e5bc2b0000002167f00fbab204000000ca6b2179dae5e54175451a010d64ac1e5d31a3b744dbe271fb0f4fb500088041") [ 665.933259] binder: 21303:21304 unknown command 278535 [ 665.954153] binder: 21303:21304 ioctl c0306201 20000100 returned -22 04:50:50 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:50 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:50 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:50 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:50:50 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 666.848528] binder: 21303:21324 unknown command 278535 [ 666.877738] binder: 21303:21324 ioctl c0306201 20000100 returned -22 04:50:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x60) sendmsg$nfc_llcp(r1, &(0x7f0000000600)={&(0x7f0000000140)={0x27, 0x1, 0x2, 0x7, 0x8, 0x8000, "daa04636250e57261aaa0431f98adc0184f543f482d4676dcabf6a0a5bba8b20945f9c62ab43ab36d52e859524588983aa3a9306939897960f909f2985005e", 0x39}, 0x60, &(0x7f0000000380)=[{&(0x7f00000001c0)="c73615ab43ffe9e5f4043a2dd31e99ad8babb8f0d4c4fd0ab4cf538e6c7effe7db2c1ada42c1860e53fa07d9fe64af342365a2c98b657ed550d61191cfac3a874e4378a89af87f8f463149d3e6c623c66bcaf427976147465a18613c8cfc59f32e9c6962e1389ad117221a5bff2d9e0cbf9ed73fc48c7a067bf149a05445e5660c0488", 0x83}, {&(0x7f00000002c0)="31cee5471550e5dd1128cb6b0127a9cc1953573805e7d226f3358ea4d29a21a3bee1526602e0d4d818a079bc385fd2b5c59182608a550097b2f20cb571713d0298a9f39692fbf312d1fd9773b1fb1d0f9473a62ccac0651bc43c56e13811c6d4458b847281cb0ec42b6fb90ad4ebf245517565ba3057db7e847c4f5de3f65b11a3aed472e1a9b5c87414c5cff2e3ccd2292147f683ac66c6b8da0959f0559e826c816f8d2b8f6112c6eed9d03a5faa9d7a3b6de39f227249", 0xb8}, {&(0x7f0000000480)="f0485fb11da9d656fb4a2197cb5d24e7912a07b214427ce1f4c1e37e614bcf2173d56b00bdc9a3f9c8ee179198ba953ed5f52f75950dd04b6dca131233e8bd5f99b0185dc61b8c9deac16f0fd1e483ef06cb707d247a962b05885250c5804c154798d2deedb62962e3cc4b36414d033192b4a8a7b8", 0x75}], 0x3, &(0x7f0000000500)={0xf0, 0x10f, 0xff, "63ab0499bca407c9dcf8710fe03f932708ef17db7781b958a518c1c94781aa1334b9c6ec2825b6513cf4fa3a79fea64f711208feadafa8c40a46f22e3904964a8f9aef6dca63d98217a763300d05bd96a148c8bc2b99fb53b9fa6e9fa1d177d810c7acf6af644d6bd1d11494957a84b53ae418c51bc301bee7a8ea476253e49a3da40dd30479afb21173ea71d40ec0ac598a4679a373b59ac74e245bfd3d6d079bf937811b229401180ed67ad963aa30fdc87d734d575a95918095c158af38f1fca361ca5346c877c1680b2201623b7edb9c6c63ae7b901b4959"}, 0xf0, 0x400c010}, 0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:51 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:50:51 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:51 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 667.291409] binder_thread_write: 10 callbacks suppressed [ 667.291438] binder: 21330:21333 DecRefs 0 refcount change on invalid ref 4 ret -22 04:50:51 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x4000, 0x62) accept4$bt_l2cap(r1, &(0x7f0000000080), &(0x7f00000000c0)=0xe, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:51 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 667.527161] binder: 21347:21348 DecRefs 0 refcount change on invalid ref 4 ret -22 04:50:51 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:51 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:51 executing program 3: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:50:51 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:51 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000140)=[@increfs={0x40046304, 0x1}, @register_looper, @request_death], 0xae, 0x0, &(0x7f0000000040)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf51d16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bf8ddc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aa4caf42000000000000000000000000000000000000"}) [ 667.873670] binder: 21369:21370 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 667.913130] binder: 21369:21370 ERROR: BC_REGISTER_LOOPER called without request 04:50:51 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:50:51 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept4$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0xffffffff}, 0x10, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x30, 0x0, &(0x7f0000000200)=[@decrefs={0x40046307, 0x1}, @clear_death={0x400c630f, 0x3, 0x1}, @request_death={0x400c630e, 0x0, 0x4}, @increfs={0x40046304, 0x3}], 0x4, 0x0, &(0x7f0000000240)="c7885bba"}) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000080), &(0x7f00000000c0)=0x8) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:52 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) 04:50:52 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 668.263338] binder: 21380:21381 DecRefs 0 refcount change on invalid ref 1 ret -22 04:50:52 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 668.305402] binder: 21380:21381 IncRefs 0 refcount change on invalid ref 3 ret -22 [ 668.325312] binder: 21380:21387 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 668.334342] binder_thread_write: 10 callbacks suppressed [ 668.334354] binder: 21380:21387 BC_INCREFS_DONE u0000000000000000 no match [ 668.365517] binder: 21380:21381 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 668.386556] binder: 21380:21381 IncRefs 0 refcount change on invalid ref 3 ret -22 [ 668.410046] binder: 21380:21389 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 668.443280] binder: 21380:21389 BC_INCREFS_DONE u0000000000000000 no match 04:50:52 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) pipe2(&(0x7f0000000200)={0xffffffffffffffff}, 0x800) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) sync_file_range(r0, 0x495, 0x3, 0x7) sysfs$1(0x1, &(0x7f0000000000)=']eth1cpusetbdev\x00') r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000080)={0x0, 0x8cf1}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000180)={0x3f, 0x3ff, 0x0, 0xfffffffffffeffff, 0x1, 0x6, 0xf62, 0x3ea1, r3}, &(0x7f00000001c0)=0x20) 04:50:52 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:52 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) [ 668.736088] binder: 21397:21402 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 668.764649] binder: 21397:21402 BC_INCREFS_DONE u0000000000000000 no match 04:50:52 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:52 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 668.789694] binder: 21397:21402 BC_INCREFS_DONE u0000000000000000 no match [ 668.858951] audit: type=1326 audit(1536814252.679:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21409 comm="syz-executor4" exe="/root/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:50:52 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:50:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@acquire={0x40046305, 0x3}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:52 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:52 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) 04:50:52 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') 04:50:52 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 669.073909] binder: 21420:21421 BC_INCREFS_DONE u0000000000000000 no match [ 669.098093] binder: 21420:21421 BC_INCREFS_DONE u0000000000000000 no match 04:50:53 executing program 3: getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@dev, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000000080)=0xe8) getgroups(0x6, &(0x7f00000000c0)=[0xee01, 0xee01, 0xee01, 0x0, 0xee00, 0xee01]) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2f, &(0x7f0000000240), &(0x7f0000000340)=0x4) r2 = open(&(0x7f0000000040)='./file0\x00', 0x2000, 0x101) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000001680)={0x0, 0x1000, "f313ca89cfec5828feef3fa0377a5d1ea816abd4e1fcd66d65a56fdcd6c70b3d8a49fc43c06fdb624814be5300b7734e9b7b1908a35c8d173d9e1b52499df43577d885791b98b7b802ae2481fde899589737df4bc67a4df3331294f84d0666769b9a26f71ecdfe7a55777e9c1dd67082840224103bb75fd9a25c877db388d6b0c97008a9088aeafa925662f5466c3cc52e191d183a326bd636baa4fdfc49b1d66145806d677a3b25a4dad2c6230869ee2de853856bdcb891b2db0192638e06a49b4efee26688d282b709254c5f976e2aff9f9c14dfba840d2cfefb4cb450082d707a662beae3624f0a94aacd4cda700b034dd0a8c46ecded0d904b185f1ace45fa3390ce901faa4b4c69b6bf81c9cfe831e576a57e6ecf1104620661cf42a7fc0d0a3a4c59cf6633fc55cb48d38b2eb937c682127a5c687a41d126ce1afc7650bc4ac7e620235159131410b6286dea271d64b7e68e631eeabb9d2dc2b7faeba286494b7c723217374b411fa25920961f6a55a6796303412d995d77771842ca898374af7f400bb7109a499f6af8d4170ad440c2d09ac0d80799e0a3487c6cff8851f5cb0fa8acf0753827afd6cfc9098ef9959d26449750fcfb3660babfbdaa2fcd8e67725272875fc67c1d54df57bb81ffb70e5057603a92b609860dab9db708f125cac80bc6363c810b237de4acdefae869451914e5d4e8ad86a8eeea5a830df5ac5db08dd9574c01b72de36cfa83b2aa7d4403c5680c1404ab1fbb09c1f32d3701046126736a8ed77fbccf2a0bba236f805d62bb398653cfbee199a8d5050624bf3bcfb08dc47b858fb8502d9d46a9eece494fc7e73b11a19da228b2e4eddd3ae8ee87d3e68c1dd9fb3d643d141894b8321e2c7848a07ddcbb1df56a645e2069679966e83e658a4157b0782f8b9065059d7d53dcce22f5aeb59ce908ed098ee25abade685278dab6be61a13016c597c03040928af69f2488cc20fddc3540a428208cbcf44211a67479d37d902f402f31f19fa329b24b29bb4efad1dcb50884f1076117da415bcce918ffcc79e862e6210e3e05fb779c6cf725081fc795833f3f69d6ad934f0a79c27f4cccf65449b0f64932c88c456b092803499172729f1f00a85faa8c97eac41d29f77f5377ebf2ccd416e41bab80978dd3cc701f33382b9dd6ac47451e8990e7798c2e7418e10854f567003d7d7bd10cd1a7176afce240dc7e9dd96e7132887a585c24f181cc1fc2b18d6df5a3f8907fdf5c0ca7e410259ef37e78fbdf7b9dd2a804f180991d95e7ec7a13c251b8a65b6726cb75a6dc4cb0cc849d772e273609be6bc456f21427f399414942873c3477e381189b1cb94ce10badb2c5a12deb65a76f791d7355aafacf99efbf366fab03ecf1ebbf5ab9c4a3e171e0afe1c2e5735bb9f3a6f3c0dcc5b4d7fcd8b349f5ac8c607c387970b3dbed1ee6b2ebedd494a6fcd8e8d0237cd4dd901b44e44b05af23390c89a183173f5dbc853b14a43186465728e92df49ed70ff9b60bc72aa0cda336a21c0a80dd17979c21aa51e701a2b050b01dfe2d2194e3f0c02d1907361790687789f725d7b5b2a5f4d995ca7c883ab51412eeae8cbd218262417a8536339a1366e5e5ae0421c712b4e06032d0103bae8718610880a6fc5639b182334b5cb441acc7859f425423bb2aa186cd3e3613b75368bb50ca1af91c4b84b23fc9d4ace71ea944cf4f0fe2201430cea4162fb548be2cb3b0727eff3826fb661e0aa7839dd9dd7c94bf129335822e25c0b102b464207650bfbe6120354daed1d7709b0f44c1e0af82a2368092404f518dffb30e2e9192fe1031e41c80a8dd520f76a0b4a3d90e28754c9c6199845d568bbf7f82a0ca3bcad0b509de01e537873d6080801734def1b2e6a53827d3f8679313b9cd70af8a7ef0a2ec559c979946bede27abcf1746a03e6d8b6a9084103793c9b6635c5fcbd2a71b20e77a323a449ff280d1cb2886b10daf351dcb0ffa2b3fa3602b1966ded1d77bd837ab2e6060f7bfa3dcacceba518ca55752449b583b131bc4e8e3b5c5a88ef337bc23f9a81c58d910dd2b224f4bfc2c48b7d38abdb73bb92131d0d89f756392009d4f16b8285f23f58cc2efa33dd84f65fc7734057703f1b2ab741e73fb117bab8ca7f8d3e6cb1c19297fd9c7539c708be5bdac7bd608e02f07d49ab3f4d6753c77cad4c78b8505e33427c9ad4b4af23d91ce454a0b3d751e0f2dc14c63d3701b365159bbcc018eac706d6024f58e74967abeb0c7fa6cb1bb3974be279ecd789a7d35ff86425c40a01949a928fb32cc8f0a3c4f83871b53852384b8e86a1d124b1b85d5695c3d42edf070e6004feae679dc6db646df762638d8fab4557b4fe5be2ed4d6d624cc0d4796ce36715eaeef127559568048619a6ff38cc9cce7722089471371b55f712aab2d5f6cadeb7f43a5ddb0fd8f7299e013c5f13d10fed7b94eca1a150543ee6f533597b6bd4e79845a13522f77eaf86f5fa413da51abbe7e4bbb3629b738c260a6f4583ba3123d669f67b6487fa0250130d17de895171db769a731425fbb9fdc8d16257ddf8343e6585d8cfaa36ca2b5bb2cf3537c5dbdc8f175b7caab6915e4f8bbe90a3de022e50351b87f7e7b7e04431091e4b1e4b4f094ccc86c829e6b08c0fffb546daa4104f82dbe84501442104fceabdca7392c17e810b31aa193fdbb0729fc92e15eb6ba74e59fe32bf41cbcc48ebaacb1d104f3c47ac2a53d843ff7a7500cd9a50762f51ee502cc3e6a3885dab74558b562009a45af0cf29c3e2788463f0bd36a0a55fe8b19cc23a84829278e088c2b3e5407a02b2010eb412e6519b2dfed78ef1ead0cd719d9144144e64e9a6d9b758795ca52bc0641b2906fa99b4b0b72cd2bdd5115d18f578e64ca54874889aa1de432067522c3605e65d77a35df5bf3cd339144666f3d32eef99a74c10d5eefc5f343164483a7734423028f97417d1b979155ac23c569aabd42af5bc8906dd95c064f5cce71ab498c664a97982dc3ea58374d543fd5527843428b7f9a0f959aaf49441f7d7cc3028610d61a254576975827f12b69a8b755fd25de081ccb35eb48f5b4ced2f0c63e5ab02c83c82c32eedea13f459b6d832b8a9faa35fb301b0e34777380fc7353e5890f9aabd89f23616e54e72e90a582ff907ab891adaccaf7f43d871da01911ee3580e58a1617feee8d7a283b807d98d656cab8549df2ac9343f43e036c3babf0b0380d522ee568a30dd33684dcc7155cc1fbf109198fd8d43eb59efeda5de4010ceed6f5ffb4a8f557096475ab52d3c0f0d1feb88dfbd19904cb0b4b923189523731e80ac8f6a514ac146dc77057d5d7ea2e1c71ee3b55576d4250d4f8dffb9261f6050f02bce8a97d6f43b6fb3528f4c92d8c4bc869abac7f705505bee60694d7ffe2670cb134137a338c2a78da08bda5f2b28bd55239ca14b6e5ba1cdf608101673ac301d7b54029281899d224a945bcd62e30c6d8bd179fc3552fda6735efae280ab2f6fb2c6f7cdeb977782a31d7359d51abfaa74aff08a781fe17a0589ca023787499d7a85cd852f4419285b9f41a299ca24fa4d1ab9f5e7e1b00fb3f3d14db0aaffbeefe85394b563421523d772e1a70932ce62bc1586fd4d1c98cd408f900237a50589bab3f490a9c8af42908a95517fd840741d334ac1004a1cc62be021f36186a6de94a8822791822ac0b9e937c1836a436921a9c42debf847698886759d8b7bcf9ae22834a9365a587368af72c4a8c588b67068daf75b8d8be968659a1a7c12b245d78df10b5bb74fb19f58e7273a3756aa0fa06bd49d1ad1f4e4de1a78149cc526dd05b6963097f868a1ec3b1c203546eb112467884e60b7e6e36ac066ec65e89c2164eed1795052cdf793139a8a5c18b96dbb8c0fe36f43c2cb7e70bb877f1703fa327fad2eba7cef556c17f2b9440cfc2f1528d21c73258c414a546ac64ce8293b04cdfa41a898327c9ddbe1006e016fd33fdaccb53a77437c686c9c5493250479916409e64764b8c6482b192d0261a508fe8c666abb69be35e888fdf2d1582f6ce4d5de8908239a3b989ba73d40a17002d3ec725e553cd9cbbd7a1ce471b0dd99feed3c6bb8799d359835863f24795ceedd822496ec389884378cd214a410081bf0ff225210aac7e8658585935bdfdbd6143eb5b47edfe4e5027767c3c991a7f4d0e7485ba2883f6397cfd18708521aadb12ab3d5be97a19eb14c8c1c4c03c182e81892f801c337237633852363009354287a4f3d67c0bc1b77813a1b556f69e100e45eb7611fcfad1a999978dc92a3b535a0db4efcb0850f7bdfc432d6bf50fec1a6b27f3ebdc9d81ead377723d8c993273a20e7e81bf73d5f2e87007010d867911b624447dd94b6d64d875c0f07d4f5041973fb504cfe72c87fb252ba7cf7728e2dc08f8316f90fd8724322fd1e72e952ccc79e98cc177b794946a6fc2099d397895fb46379045cbd64834fb2d46ce320fc2a490485ba1cc5aa6d3b34ae2400d36e3bfd362ec9232988fcba55182d3b66c1ff7c6ee6d6a81a58e71c4a2a7474683bd037ef3f89ce1cd40ac21722c351c8fec340931c10b5e9355b5d56a33442e25a611e3e3200510175e5519502743a6def742073fb2baccd80afa7e5a8e8115523c6067d195014f29ecb61620f6f1a5ce57169896604adb792be364df37fa96bdbe163476552614a980ff979b1d0855659f51327159124a87599ad5fc00a3e8208b3813aa6139a40e9b8d329298e83e3910ed1880aa9133781c4f66312f21774a1483e783fa26a9abb38f65fa6ac0c9b603a33a51f5833544348900b264987b75d1e6036db38b5476a59a4b86c03c9ae643e8a3ba6e57cc959c91674b74e0e473ad271bdbd4bf247dec77f9ce9b7228d49d8e756f454b1ac278bce1284851211354b079009126f43b19637cdba2d4860da8a2564b90b474839c87c82e4ccb23ef55a8bba2041b8eb7f747fc6a39201d506f14d46d6c637dde39a99719d2e6539804194db3bd391225323fb87b18efc500ae834d6620e628c5a62950319f44ff1953123f1b8d9ac6d8929c68858a120d42fb1affaf8f413add6a44bfd4b44b8adf941f6e66e4917582da90cbde32422a8d1361b41f6c18b2b8af50e42931a8f6842586ff157a7c3bcc0fa919906c837b85ff044eefd3f2e3a6eee0fb5b0a56da34ddf78f17ee766e09bba7c78d4c970c1d844f68c2e0887e3de7ac9c580d394e510a88667c06dbbba40a5c81e59bc4217cb2622bebc300471fa3181fc845c45405dc96c0e40042d33ff4a88ec956de7ded8d3d3c3b7749bb88a689268579dc4d1b09efdae6905b8bbcb897b40ffc7fdbe693e6f01644d075358aab92dfab4657000f4376c1ff9ffc0daadefa1aed8852728fca07ba1e3edea197f6e25fc35e7382032d77460302b46872c79c7d66bcd3ec4d5c430027eb2e1b8d68069ccab838b454defe1fb4a05999338495e7175a2a81229c5e2020b0697f7d59ea5960489567ed7b334a20bb429e6fc671db1ad7764e9abd1d5f5f55f566b07389508b03403a9b337aa416e89b64a5867c186360bb7a860f68e82939fec7a491a3c73134b8975698fac9fb849719ca193f34414c735e3e2208110e3954d8f3708db106130f35ff99e626116dacfbaf091289890f7a58a917e7b568368607c8f55af361d1534ed390aaf0c6ccc06023f210e6c214c29104aca9493e5df0274d1fe329efe1f2880dafc2c4d6694e61ad84792d51d41bf48f84b2bc0d196275ca8c07436b0e9ca72308cb99"}, &(0x7f00000026c0)=0x1008) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000001600)={r3, 0xe}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000002700)=ANY=[@ANYRES32=r4, @ANYBLOB="001000000b0ab5ed22611a8eaff7b9c8499cb3e2c8917a7ae57f72617d133598a0d6d0196c576ced50801df919195d0bdd7e197438cf79dd83e85af6337457ddd923a5866ea4a252adbaa5e3e9a515189c02d2f73041557cf38a0f138c85b6c4d7f21da1aaf65461c7b932c57d2a84d1a30aee4ea6a75f54ef7b4e83efa4294880179302326d155c287c05fa8ef0274d06789b4a7af44755f9098520e3aff94cc5dce3d5ec6257612c383ad8f78986f2095905cbef60be0a5d5bdde1c34f32052e533fcfa59813e2b7212ebc6cd2d2cfba0af1ddcc445a2024c4a128385a0205a06f4fa6ec365a4f09962a9557937e955b71af14c74cf10c65745325d743f6b218f6fd057c95889ebb1d1497bd642c4e3bdf83de8c6cb0ad4229dafc5805adcd874da183548d3737ea6e083eec6a48059648ccb243864bfc3b64f7a8ad7a69eedd6ed571ea4b8259424882645500c70b2a00c0193de405fd0e11215f613ef900607b054d37bc7bf6e27883874e718eb7d0153da1e2ba6868a926127bd577a6f8cf007f31752d8a643668330d1508c434e629d2471333e676d43cdefd66b8a7ec0f48648ad1554c314ec6cd4f1dc73354f0ee7bc36a3301450d2a11b3529d2023fdead4164fe0e65eae43804209ad584d254d8afb0ce4661f0877f296202433deb489476af496cd2134adc08421b6637719247f88c8b442edef63537f9498e40e7b0b1b5a45893c95c5e23e099e36ff8dcc5fe5206509f01d1473bdfacf964dc2f4da131941742f36af2841a8fb851b1ec5f0108c047b6d629f28cdf31e88c8b9125fcb5e46527d4267b66ccff39b4816c9cae3b75acc23f2d1285f29a0d1f26107439d135dcddeb136617655da009b84092f8da12eaaf94fa7b8e8c7202c9533828477e976b800ef0a0e4d905f66826de69e578bb041ecb58693307a1fc8a37bd044eee23f95cb26d13fbc5dd959d5d48b0b460e8f26b9be95c8fe3fef8fddd76ec32eeb397bbeae35d5dafdc770e733f5d864b84fbd6922408f9b0e72808647723a564fd4c15e3cecc72abacda4331b032954fcf96bea20156e252a3c4b091a8bed6780d70abb039499f1a2c30158d13b2de00c2f8ab978eca73e422f29cca26607cce5b8df5e7fa9306181ebb150f579af9009a02eaa8a85b9bf6c3e53199ab32161bfa1cbc85f6e049c2018f6ccbe6c2a55c964c2e706e122d38167b000746504aa6796e738d4a014513925f8d6a02e8e903e97b25b16e921cf7e94c66be389a07859537230444ce31de06fcea6fe2160f34c5a5f0483484d56cff4b4674979109f18a5ed25f1b395a45275c7069d7b31c0f3307651471db4b83fe528ca648b5c2084b072e121263eef11bac50784cf3ec3ae1cafa849136c3e0d0bdd79ab67dc02360062f04f9815cb7a0cd8382e338282bbd9fb17ab6e3a8df80aea6b676ff417d0c0649feb65239837dd8ee8293e88d83b9726eba16243dd72e5cdafb01e617b6a083c6f2098f51f30d9504eff801a901450ad762ba0dedd22060d68b46d92d40f9169e2ec77751d13ecd2ebfd0300000000000000f533e7db29b72ccc4c388a3ae9caccd823f596907b36474d3659dfbd80ba70447180d8cb30186de6c1e988d2b2c6e80b3f2ac9cb03b0e431d39a2c7dd5c1d4d06c19d63b693787b85dedbf399fd8a16b39b51d4a6b3ccb30145cc8fae4c9e0f71a13be442368280ee018441ec10f2788a9930a924080acd49419fd4f2ea9c288da0f05103d50f88a09462738671c9eb35760fc9e748d4a5f49bf68b277ec1877e3c890eb43af5409732265c151a5cbe9ea2b986651e0bff773b603a7f7792334b3646288c7ba6657ed6d7311b755d421773c40a5e2cc00a489831aca28715eb0af330391b16098c039d76965d6afea62f2ca99abc739286cdec28fce7b7b89f85a9d9f595ff5ed76eb0fae0487d5e9e99ee6d6abdc818868fa2c45b9c5a343b87f6138c6ba47d8ad55033f989ddf391975d301c47d800ee69551f228015c516ec4ff97071e1c4a9852355acd489d2042d5093aef3135f6f3e3b3b623fc87de828e0c3784fa6bb13035bec35ee11d9d800b6c4de33dfa09579c7157dcd01c2510aa78119e7908fb77855059ac6436740c7251c15fed0e6cf7ef75dee44e1aeafc9282976b9fe701ae30f152dbd7c370e8d70e9f9ddecc0c871a06b24a4dd03b33159538a3ede89ea26b7e8f1c444a53933ab31ad89b4a73a3751d4dce3f3596b01b8fc0609ee88db64a4b825c7867818bb91a2d19c0f6c67bae0f6aea8fcb42bc92430aee5a599d7fc3a39532a19861f5934f321a67ef1bf3d57ce8481f2bffc34b452a73774b2c7b58bb788c32a7c975974df535c4dbad9e921116084759c7e5188f45140ad9f853f508d1e6357c796a608491e349c8e3e11284da0919f2c67fb274b39ea21576bce463a75e02422c6eeea0eec85f0177249db2bb41b9e88a147b441851610e00e4377dfcaae1ca40244409a3b927653b7443154e3edd37d0a189481295305a27433359ac659dac07a935325a39d6d99d1ef89b2e1e0ceb2038e2bbd77f94f8dfcbcc3e6edb582de88051d7a4602b967ca835acfe3bf1d96451e3695cdc60755978b3b36d4558487bbde982ac5f13f6498954bfd9cdbbc226e93e31064590a3bf5666f1bfbef403eda87ee3e9d6d7448436e61483552a144e649d8ac9554f1a537e7c9c374e9f0c9872d4029bff94ee886d213b887830bb2ae33fbfbe54e5740fb1304472aec98130314bee3e2f76fda491febc41fa52133f0938db001bdca366823a7179c78005027584394a9d8840fb4c67c1e530c6fc6e7127b3433180df63afea58fa94ef0eebc9ad1823526bd7e202a8b4fe0b91771b334d4566f427ec64d37c613198d6306d2b6ed2e533d805636133658fa359805fbdcd31b939bb65e5d4a3f307df4e41a9e496c4d87500a0642daf0a397833f49f405c22f4ca71d60f8d478e58637165e6d6a3a5c94aeacd6d49ee9197bc5f43440e3f80ee4c4615a4797ba79ab0912baafdf7ddcee4129d2bda5d193b0c8e2f36033db686d6be76e7f0b47631c89f7da88917b76264a0c2bec99cc96b768335bdb401956239e721a5d2b9a39700e0b247e4fe6cd87f4aacefbdc09a2e027a0c3ec37555dc9989147c673594efe392b309d2586af6670af7973bff23b999f37fc84dbbaeadc1e8b5bc5308e04d18d78f7106be1de9080c2e7df5c1006042edb6f40459f22c2e2c632ad80a7a9a33880ae17cb8df29afbd0bce7657566b4b8b9cb01fa0227188484ec248c5dac391e585ef4d5dbbfa193a338983875e35c0c7d9562429af153a8400849baaabb41b427419e44affdb1c2fac4a53a295cd359a4206701eb63af9a41110a0a29bf7356867ec79419abac525e3349d14a9c5a69cb1648db9cf5d63dcf168f819ccf5933a77af88dbe217b26c3b1e1c9cb3b122a104cf8bf37493c3dafa3b717c0a0fc4befff3a637aef4763031abf991937153c2069c851505b269230a0356ae8059230568b4bca75e2bb4dd0d4a637cb9e919f8e018a65d21c045825d7613d8367159a68bf19d5056ae41b07023dd8f90597ed30173b0c57d72cf7c1bdfae3a34af29c41ee83ff29722a32bd1f528944c74ed46c7141958b8fa0553238d09e8d11eeb518d123459eabff9c9449a2a09ab0b898d54f71601a1ec7bf89de373db82f324cfb3a2033d4d02801166032d50a8b745925ea7672ab1f303089380c6b5d42ea366086d754304e913ff08734406323e50b6c824b9abfad3762a0bb8d7901c8814e84595fb5191445d03411f180253442887dab70baacfac88887cc866abf516238888da7230bcbe7d904743290314c66f07030e332725fa3b8cd5aa27a12c43027e6d049363e4e9c4074ee4606fe98de7523c6cf1732e34ea2ac5fefed9ae818997a069305ebf866008402712dd43adf58f6340f332b29096635643dc81269139301be5711d9efdbc7b6bd9a0496936293502e15d95cf30abb8a8382abc843006a0509a6c834e2005fdeb5f8d2ca26a116b19dacde306aca8af8597a20a57c3e219fe5ab634eaa9f9a97693a5743cc4e0dbc4b7fcf56a7b2ee43b3e0da7ebdb3f5073da60465361b10ed60ad71d2020ba4016270e98b48d3161c150391fc9c323d6a5168275a5130ea9b38f3f36c6dd50ed3e6abfab67ccc85e88dcc9c3b66e879ca1bf020a86ebdc34d3cf6bfc782bb1658ff8f9286bb6638fa1e8e6c4fa4a2ed6f47c4fcee1ea201fc072bfd066d3e0b4e3fbbd63c148c6b67047fd2c657dc85f02c447d48ae0a12549e19ab18bd1238d672c5ca4f282605a44b2a31dec086bf5830a77a22629c0c70f4fd46ff2795440cca1fb76cf0820c67ec28721a28c3c92e9bf88bbc1830eb9020cb5e3a59e28e7b9f7f78e4494a26374ff37c49dfc109d5db62a2391485d18d263273364d597e48caf2034a6b926148824cdd9246589ffc304aa93180ea7ffd963d35a1bd82207648c32184159b4d49cdff3a93b0c7147524a81f957ae5675fbeb5ae42a535078cdbc172361200cac8d276ac129eaac049042a80cade7dd2e61b52d717bfc00e54408e9b3fe89f370b59a84402a1c91b9d3043bfe117eb66b03e5ee18034b00f7fbad284aa157152cd79703dc597bbb254ade4d4fa71e4b07d5884950708d05a2170e6f168012691eeeaf8d90c8ae59ab68d95d19637013a89e6db6b8e35c0f6e03b6329d9d62b5957236f101b3f5f8c2456004e060930f6fabde3271ae89df78fedb32b6f0acaed3b701e664652e36c851e955b714a59ce38a86dc7b71938c74dd50e9ddb327abb35baee44dc59d06b2cafeccbf31633591ed296d36104e9b8ce0209979c4c3c64f380420578a227973a2d11081394656a034290c96134c788b22202d87a6ff5ddc0d9ef6a7860ac571bc8c381388dbcb196c6f5c184dbb4c73c0a44f3d14af98ca7a8cb7a561e55da7e1e29cf08c43e077bc3c04b8dc2721a50d7d23cd5eb001c8bb17cecab9aa69fa900989b41c707dd4e49e4c00bef729a6611918f6015c473ced5aab06bb7914e8a36102c9d0c6ffb5908532b002123203eb53841487bd817608320758d493a9dbbe03c3c628274a7fb6a80a97ee76e9e13d45afbd9792d2f7b552b3713588bb9df5ae8d48397500e0962da3c984dd880f7f55f20f0774efba03301ed7c71aded353c5759cc7512ab354754a0fc34ce0854c69dc5bfcd37dc95ceee8c5f6b209326a995f5515dcaaca9f6ceda99224ead5414d43bfd00318303f34d25a873ff1f9fef3b897bcf36f52a60d0cc00d10098876662050222fdba57d40c978f070c2b100f2bc9196c98434aa6e35f3b1d22cb0f162dbf49ee2b9dc6317212f0b2c9fef6224a184ed6a5c8ef026d8f7b466aefa3c3815369cf99ede891110c7fcbfdd6daf4bcc1780f4ccfcd6729bd6234c32e8eddf6014488632039b7f9e35fc02092db1139d266c9de9580d0c0e60d390b9f3ba0b526be4742f1f0700f97b24f41900efad5b30cf00b0c0a743e27b208f34237752c7f1b84d1d9e4e4ce68726934c8bc6b2f28f71bd0a61f1f431d2cdbfdc233358a5d630d6c1d59186e7f999a2c5de607e1fcd07aaa635ca42524df42c7b5a1bc05174fab1c034517ce75f3d1f99c7262a2bf7e77bb774de248297f88ef1bbf8cbb2e9faf1855d7b14441c0ea89ceaa90fdfe514e87f13a99d98549b69e364821173f6d8ed69b85eb605493f295e4fd01fea81f4fcbe00000000000000000000000000000000"], &(0x7f0000001640)=0x1008) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f00000002c0)={0x78, 0xffffffffffffffda, 0x7, {0x800, 0x1, 0x0, {0x2, 0x8, 0xffffffff, 0x4, 0x7, 0x9, 0x6, 0xffffffff, 0x94b, 0xfffffffffffffff9, 0x0, r0, r1, 0x10001, 0x6}}}, 0x78) r5 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0763044004000000086310409bf6d1734b3d99ad142385d76fa7e83e0ae895fd6234f76393e8c09120d8ca16a16300afa41e0a037c479fe9010b124a488d72dcab513261a6f7550678e1c955b614be0304708888cb8aed34d0fea7f5000000000000000000000000000000000000000000b675f833bb646755c45453ea47df037a3f8b3aa16685f8783be509000b3e4b83410f7213485f59490ff97c73fe5c75432786e305e179b7be9198200a9ea8bab411007960781462f86b29b7c5c141ecee86db57e9f9ccc3cafde3845aa4289ee095479feeabfdd9787aa5969d0ae6256528ea091a201e37bb3d3fce0b26c0d06764b8610be4cf3d7917c988c61488fce2f97e097514840f3822c80c92a05abd54fe40508fe6afaaab30c2efa4b97dcab5785ebb961947ef225f8c5b9475b79fe537d8e896a59f339646fc9eed32", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 669.177327] audit: type=1326 audit(1536814252.999:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21425 comm="syz-executor4" exe="/root/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:50:53 executing program 4: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') [ 669.277003] binder: 21435:21436 BC_INCREFS_DONE uad993d4b73d1f69b no match [ 669.308465] binder: 21435:21436 unknown command -40507382 [ 669.340803] binder: 21435:21436 ioctl c0306201 20000100 returned -22 [ 669.363170] audit: type=1326 audit(1536814253.179:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=21438 comm="syz-executor4" exe="/root/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:50:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = socket$inet6(0xa, 0x8000a, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x3, 'H%H'}, &(0x7f0000000080)=0xb) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f00000000c0)={r2, 0x9, 0x3}, 0x8) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x60, 0x0, &(0x7f0000000200)=[@decrefs={0x40046307, 0x4}, @increfs_done, @transaction={0x40406300, {0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x18, 0x10, &(0x7f0000000180)=[@flat={0x776a2a85, 0x10a, r3, 0x2}], &(0x7f00000001c0)=[0x60, 0x28]}}], 0x97, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 669.537829] binder: 21444:21448 BC_INCREFS_DONE u0000000000000000 no match [ 669.557717] binder: 21444:21448 got transaction to invalid handle [ 669.567655] binder: 21444:21448 transaction failed 29201/-22, size 24-16 line 2855 04:50:53 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) 04:50:53 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:50:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2, 0x0) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000100)=0x3, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x50, 0x0, &(0x7f0000000200)=ANY=[@ANYRES32=r0, @ANYRES64=0x0, @ANYBLOB="00000000004000000000976a000000000000a70cbf4a1d1f1165b025fa01fb83cf057eee105da5eb399a85f78b4f69b3fe0edc8760000000000000000000000000000000"], 0xac, 0x0, &(0x7f0000000140)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) socketpair(0x10, 0x2, 0x6, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000280)=""/243) [ 669.802716] binder: 21456:21458 unknown command 3 [ 669.822553] binder: 21456:21458 ioctl c0306201 200000c0 returned -22 04:50:53 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 669.856027] binder: 21456:21458 unknown command 5 [ 669.868208] binder: 21456:21458 ioctl c0306201 200000c0 returned -22 04:50:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2540, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="076304400400000008631040aa3eeaf88a3d4c728a8e6f62ecf81696fee41f383242c8d01ea0c2af472d55d821244cab0ddb8a5c4853866a56029e96d882b0b6d80c5d8cfc75bc3443b3f29fa2b459b92158c2c87d9cdecb67b821580f2a9ee4d35357b4db4305", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:53 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 670.000468] binder: 21467:21468 BC_INCREFS_DONE u724c3d8af8ea3eaa no match 04:50:53 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) [ 670.057626] binder: 21467:21468 unknown command 941614334 [ 670.095862] binder: 21467:21468 ioctl c0306201 20000100 returned -22 [ 670.143812] binder: 21467:21474 BC_INCREFS_DONE u724c3d8af8ea3eaa no match [ 670.163163] binder: 21467:21474 unknown command 941614334 [ 670.188393] binder: 21467:21474 ioctl c0306201 20000100 returned -22 04:50:54 executing program 3: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x840, 0x0) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000080)=""/86) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 670.302762] binder_thread_write: 18 callbacks suppressed [ 670.302785] binder: 21478:21479 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 670.357672] binder: 21478:21479 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x200000, 0x0) sendmsg$nl_crypto(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=@upd={0x108, 0x12, 0x200, 0x70bd29, 0x25dfdbfc, {{'drbg_pr_hmac_sha512\x00'}, [], [], 0x257cecce25354244, 0xd05ee47d6bfd24df}, [{0x8, 0x1, 0x69a4}, {0x8, 0x1, 0x1f}, {0x8, 0x1, 0x9}, {0x8, 0x1, 0x8001}, {0x8, 0x1, 0x7f}]}, 0x108}, 0x1, 0x0, 0x0, 0x24000000}, 0x800) [ 670.509048] binder: 21483:21484 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 670.533324] binder: 21483:21484 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:54 executing program 3: socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f00000000c0)={r1, r2/1000+30000}, 0x10) r3 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0xfffffffffffffe1d, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0x8c, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa5530300a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:54 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:50:54 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) 04:50:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0xfff, 0x1) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000080)={'IDLETIMER\x00'}, &(0x7f00000000c0)=0x1e) ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f0000000180)={0x0, 0x6, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="f36204400420000004000800", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000001c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:54 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 670.814667] binder: 21497:21498 unknown command 1074029299 [ 670.838655] binder: 21497:21498 ioctl c0306201 20000100 returned -22 [ 670.881307] binder: 21497:21502 unknown command 1074029299 [ 670.898641] binder: 21497:21502 ioctl c0306201 20000100 returned -22 04:50:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000280)={0x0, @aes256, 0x3, "aefbaa70a99e4213"}) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)={0x118, r2, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xe302}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x25}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1f}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xfff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffffffffffff801}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@remote}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@loopback}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xbc51}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x4}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="076304400400000008631040576d65fe0a14622c9894c60650fad8bec513620bf4a23a95b7ad62ce0621a71cf7b3031ab1874c4744e3cde7f5cf0490181e467997b6aa58b72b21676a0289a365", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f0000000040)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f00000005c0)={0x0, 0x3, 0x8, 'queue0\x00', 0x7}) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x1, 0x400080) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000180)={0x0, 0x2}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f00000002c0)={r4, @in6={{0xa, 0x4e22, 0x2, @loopback, 0x4}}}, 0x84) 04:50:54 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 671.035077] binder: 21507:21508 ioctl 800c6613 20000280 returned -22 [ 671.075973] binder: 21507:21508 unknown command 190976965 [ 671.113944] binder: 21507:21508 ioctl c0306201 20000100 returned -22 [ 671.120544] binder: 21507:21512 ioctl 408c5333 200005c0 returned -22 [ 671.167789] binder: 21507:21508 ioctl 800c6613 20000280 returned -22 [ 671.192525] binder: 21507:21513 ioctl 408c5333 200005c0 returned -22 [ 671.192535] binder: 21507:21512 unknown command 190976965 [ 671.192552] binder: 21507:21512 ioctl c0306201 20000100 returned -22 04:50:55 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:55 executing program 3: r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x10}, 0x10) ioctl$void(r0, 0xc0045878) r1 = socket$inet6(0xa, 0xa, 0x5) getsockopt$inet6_udp_int(r1, 0x11, 0x0, &(0x7f00000000c0), &(0x7f0000000140)=0x4) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 671.435061] binder: 21519:21523 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:55 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000002c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000300)={0x0}) r3 = mmap$binder(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x2000005, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000004c0)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001800)={0x1a4, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x20, 0x30, &(0x7f0000000080)=[@fda={0x66646185, 0xa, 0x2, 0x20}], &(0x7f00000000c0)=[0x18, 0x30, 0x30, 0x78, 0x0, 0x38]}}, @clear_death={0x400c630f, 0x3, 0x4}, @transaction={0x40406300, {0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000200), &(0x7f0000000240)=[0x28, 0x78]}}, @acquire_done={0x40106309, r1}, @increfs_done={0x40106308, r2, 0x4}, @transaction={0x40406300, {0x3, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x30, 0x28, &(0x7f0000000340)=[@flat={0x0, 0x0, r3, 0x1}, @fd={0x66642a85, 0x0, r0, 0x0, 0x2}], &(0x7f0000000380)=[0x58, 0x40, 0x18, 0x0, 0x40]}}, @enter_looper, @dead_binder_done={0x40086310, 0x1}, @reply={0x40406301, {0x3, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x60, 0x10, &(0x7f0000000500)=[@ptr={0x70742a85, 0x0, &(0x7f0000000480), 0x1, 0x2, 0xf}, @flat={0x77622a85, 0x100, r4, 0x2}, @fda={0x66646185, 0x6, 0x4, 0x21}], &(0x7f0000000580)=[0x20, 0x0]}}, @reply_sg={0x40486312, {{0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x20, &(0x7f00000005c0), &(0x7f0000000600)=[0x48, 0x0, 0x38, 0x38]}, 0x7}}], 0x1000, 0x0, &(0x7f0000000800)="a00f41abd1f26691307a8fdfa685ece01dc7f797f82590450de23f9530f2f81e3fa5ede461c56d9dc24119a0c9f2ec3ccb55dd8c1c425f9ea114bd810e8ffa373a6d213ca03b1c7f0a6f76f23321cac2e91b4f4ca7f26432181ac6d7e084bde7723f1b9724cd637af133f6ad88bdbce8fb9a99d1f7acfb0b57ea1efe018a06542000d404b2344559a82ce32090e741f57e1c600883dd41a08fa6918f314accbfa3d1ef6644c1bab185bb6a79c2c70acab406d4bf5708fe40c8374202297b35fb8a528a29190c0264f4f38d84cf353e9032ce815b72be4619539b625c53323cef87c00bc68950fa3996dfdd977997ecb9129746f0ffaabcbd07f1bacc464e5ac3e1007db1cbd33712760503d621d38b58e683731ae1a3ef01a42007be331ff73aa107690c0bc9f3504e30b3d2b07c70cc18081b0276eff9517872607120d5a035795ad1bbb64a5a28582a4e00b85a7df702fa2a61371f14c169edaa9dc7acc256a31757094a7c703ce5e3f813bac90f4ecb9bb4e7b79f8ce90a1811e26d7ead9a020e0f0eae1fa8a36e967dc38d8523feaff9d8e1d4ff869b1030e9ee03d8c1ba3b0ebe5b2af258d3c736664bc488d501b7ce1037fe2d41bdb61ebee0f7d1c2aff2487e53b0b3786726478b9fe6b981d76b227208983372fc5e637e5b4a401d7579b1d0407dc872907d6cdd38ce7aee0f01432f00a2551524040695291320edb42cf3dae258a64acb4826ab3ca8caa633defc054705dcdaf853f3e1dd0e703fb87a18a8a962f42f7c2bf77ba922d11996f5b4ecc7f7581a23c0ff5a4f3d0647af80255c40d90e94a19ac46031a3b6a7f259c12f600ff224d3a47b4d9daa4ccb1d0643a6fc539db0453cf9cc5022b48de01e9aaf502edac17d1e24782806b2e74ff4b98015ad243d4e2b24b8dad459ba79f0e09b2b500ebd49b72c188c5287bc5d6bd135791df17f900a87221d10cd9aabd68b5b664e8e2570ed8d0e47cf81704741d366340462a833f1accb469db4babd498c1a7600abbed05245468c2aed0da2d84026243cdd8c1b2841830e428c369c92d9ba531ebf6801360ffc0e829a3a91e1f0a973c15d069be06e7f57f01eeba1ba01b231eb57e612028a29d4b8ddc6308669261e530841ceebe178b1134d017286fc731b67a80d82178d53cedb5ec1a057007b7517f191b1039e96d4e72ac05a46c7165beb95cb9c925490a77ffe7a88f3d773fb3446059bd9a8516f7135a4b2a0795d879f439f556543b700701aee2ee787a7bb19222b0fadd2f729a4767f00570fbcf605a675b5c18b96d9b0748e33d3c19b5175ab371674062cd1e7cf7ebf5896326d9832b2e97eb524eac9d2243ec32d95a5e2beca0b53e6a1c810dfd03ce3f5bb1dd3914bb24c028e39c54b4ebdcc589bc996a84e2d66cf08d3124eebbd9bb121fb24c2799d4b122f86e7044671aa5135e44676932f379d5ac097589cf15ff228a8a1031bbdb99e4f7729b2cddeea395463e464be0d5a8d2a0f8e39b53253f872be52c6059f31693cc3f230c37a23563cf1e3d9388beff5c52248c96ec3e486001dca2d1596b799c7aaf5d4deec4d20aa6e02356014c23e91387126325985f81f79d80e3e588ebb8560e0b0ee1eca4922c07ccebfca4de0eddad289b0e4e2d44e9e133446ec0f08223530ec25ff26b35095049947107921bc398f5767e8f50322aa449a7fdb91c1a3d71db2ed8502fe92860b4977eee24a06479f57b242d8727ec380a33be930cc0fa77bf72ec5f6630b684211df76d705dc63927fc43f9d6784ecd753f206597f5c5a5bcfab578fd12a3feca35383246d303f5482af1cfd06b784726be780bd45e42a42089fddc4c5262d0a49370c6985e5ed2be470166a04af550ea2341152a01a55fd9cdc8e727a1cae9cdee12ee1b4787f4f28cc5554ddaa5bb14cdb6f9aeb0347bc835b50b38df9c27ad1c8f50537f1b8c8e07599ed005195c5e848639fec1349163856b8c2ab1773821adc2939076d98ade123751b3e658a688a51d757a1aec839942a07e45d49668fa5e5498aa6dd095ff0466cc73c0f3c2ad035da6409c83c3809df5abf69ff57f149355984e331150dc1648efe608632c9aa9fdc319a4b76628e859ac9802d97e6abb3e9bc27f6b31dfaf886d5b25a100fb8c6a0016dde8cd821b3980039b9fa980e6a660d8650432ada8e04edc23fc3719e8cd1394958fa1278c0734a93ab99423d763b665e0ef509134483d380e3fabe55fc830ef8beaa387aa13d6f05cd46fd5dd09be15a742da3e85a773f94754171157c2c41113b6083969a77a689c1f0d2447b120df4ac9ba05874ba42dc359ac5958e829454ae1b6b96bf5fd2426435f984f6a2f1cafba183cc6aa9b13469693987b90e9376ca60c9705c47cb572f4964a11541cc1cc3f792a8570e8ee57b1493a53c9de35151d2de3ddc948c71ab11728be5f819f5423a626a626553dfe2d8652fa2c4140a4311c6fbe02fd8212002008975ecbc1e741d001272686e181e41cc2c97c3f2df5c26a043fa1e3a25475fa957c83fc2bea76de33f09a89c23e4fe9417eafc28b05e6df5185f910280484a0de88d6e1c3f91f751c5bb98e5c8562c3d7e27a608750589ec37d83be7dfe8250b9ecbd388ea5c512afcb93ea4f4f2a499f064291a3db5cffc4f40e9496ad361e4c499a19a715190e233b3987e5e0d345cb9c43858f21fefa340363980690940e4fda2f8077941d9ffdbad2963829873d82d9648430c1ff93e5f5add23cee306481ab59bc30cf51a8996c6b02576b3e1953f11af2cd0647f7aeef80a9c87a7f6e55c9b41d4d40a1ab353d7ca95de0770fabaef84e42d3f5873b92325106b5265f24259dccc82a2f1f2e970fb6d3dab898d5260cd8e6be7aeb12b1a56c6b77faee7b1762169cfe9bc17e7b0c15a49627230df312d498afbdf76c39ac9129b7ad547ca716edf59c66b2f5aa65df189b212f5acc5bf0868b6f386d75f851913603dd8f167e4cefe292383e5beaded41eff7ded13fcd4166773472dd95b9785eee8ab3045671b06a80e0a98a532dab882d44007196d2eaf36b6308a2a6fd2b2af85072d3f42b9767e72802e8c309b96363c895e081b0f1c6247953a0181d2f31c896d1a8c977a3b739c2e198d79971990f541bc547f6adfe6c78b0240e6d39e767852510521ea4d96c05d8efa83ae7d1226d8c74de2f9582ef75b072b3aa0df91400f5f05de04ee0cfc324dd62d4597ad48becac50ed5296e26c614f303c539d86102ba2932dea51627a56093aa83b42cc1254234e5973bba1c7faf47b3d32055bd4fe15d84b238bc55e4ad929eda8f573e005e98e8678236b8c66108a7e7e128cb29c6a9981de7d85b606f840ce9d38552c696fb459c32b25ca677d03f8d335a1994ea611018ce9d45b737b8631dc5c5c82a29d007f220ed876f8091c55adf4d33b2d8edfb3127bebbd29c43b8cc6825636ce9a7afda19df0d460db24aae8a2896e6661b4099b4d174e760cdfbd1121d6628635d2e3b5598735112181210344fbf319b566e168fe8e4eac63bd8ccb471bc43eea49ab11c3c810450e2829a4f012076b2e6ce6a8d75bee505e9c172ca56ded2e8b39a0ec6dd90d237ebb86a23d801da6a24713f948b16c0328ff56b3067f1b503c51bffd4ed1dd684e14d630e338b16fef64222d7dd5541ad1be111b3a76558eed99bc7862e438176dfe3958fa5a66225ec55a081b155d76d70cf8bc2a9c1905fd3828ecc62b37e2204f06851de73cdedf911e29ace73cb1173f5e4135a7d17980d35a8c87c84a1f0e4498cc5732a44c130ce0d8e87908d19e660ddf6007c8e8f24de81bc86e71948849549f27bf2e27367e48fbcac074b91e8911ecd8996740a62ff6701382892c0bc6571bffac8966dca7824e363931c0654f2daa3189fc64af8750d4d36297f15261e9b6c3978e973316e013f8eccaf90818e28d07b9a7e8ecdf5eadcd50af8f697bcb48f53b3e95f703dc582530bba5fb182c20b2919ce2ed99f51266c062901195393d1a8ba42ca25bf6986953a9cc1189fba85351c5254d1efaa51df286c6ce7bcc0b303b6c46ebcee89d482609167a4158b32d864712734b18f1eb8876ada7136096423bc7bb982a22794f4081411cc98b48512f3b602d3905daca73e1302d5572649d09a6e651ccf6e651e5122348fbed8d4037378ddb9984034475e0195c1de5206b13a43382732c66a17f7469d456e78cf454299edc904174219528f2bc165c478e72e80e52a7bbdf446ef605b23da3b478824e26675cc99127ac313adcbbfd227d6db68a44639accbf918b5b2cde286c0cf966281130b77d04cc4da61db3018416761f099cf57aabc41cc7bc6e268ced1e58c27368dbb835df5b42dd271c1c711ba5aa5148cf01f3a1b56dc64e9d608059deca8f754e6cba617a99b8f53a2decba5abcf39234c7d1000c43e462e5a872781d6af87f8cba5577554987d101e495344b2ce95a874560a3578b9facfdc766155e8b030d5828714b2ca9d055f2fa6e81039e2ac5506782af1f8eb3ef3e71acdaf39893800e4559ca89fd80228154e7e7a65a965336a1a018a1ebb72654da10bc8418a16baa60f291d96195b9dbdc04733132092ffbb9ee5b5e4640311b5892ef5feb68e2ac3342a78f8e044a4a09fae61cce61324735b20b307ed0a1ea9a5d2a4555a8d82d7e623b312514a4817e4f2c3a219ca65a2c823e78856b2f2fa0d91e7eb7c53892668d2e4e48d382c6428c99a8bf9e1beb29ee6e101ba72c55c64dfa180a5ad999a4d55638a7bf2837532418e776fea5566164a62b73a2d0d7c835a56142a8d2f0e19522af9bac5f2e2e9eaeb6b361fb5be4e08632fb44a0fd219626d02e19824f9aac2105e89c34e63ae1f2b98b2e5e03f192c5f4f9bb5a509a4dc04629ec49bff5847535e55d2ebc49a1e74739846168ab8d7fd3a077c17a35826e2eb9cde26c288d288f4e92cb86ea1d4b833fb0cc8d23b033131a7e5f44242e33af92604234d584623d8f7395a37ff59c95463c35d9938528bab3d60037d74a321eaaaafab74b7928eb49daee860a0570ce79d71c059320e2b09bfa6b8b0d73a455d9fe2ce8ce4e17676a42828c762e4b068c096df371aafc2453fa10267abb0ee7cf26fbe57c519ba04bf8632a7744bab0a24fbd73656466e193d39e50a3601e7e0f872f5cd36531f4d19055d15cdeabc56bdf9e4d9ca6b1ea6b0ad3ec1c4df6702a1b3db491c43cc8102261bc6e3d3cd12277e884423b628ecb3639956793c0bd48007ccbbe520c5eadeef6883c55a87c3abb211090f591b9194843d72ec2be513fb8101cbe22e2c95b7178a60f69cd9a18135527cdcce5b32ffb8f92ed007bd7864c09f4ff6edddde46f7059b3a532d2d957b0aab785a3f1f07fb206505ae83528c74a7a325d0f253ad558541fbff18cb4fee19c57641a13a36f2fc897c689886fe4817cf725f9444554d6488f81a4d65f08f9e6d62aac5da79c5dda1e668e366f6eb5a136193a8a289d441a2161d7dd49016e309787811a70ece2fd87a18910587b7c3cd6a1958cf638541ca0cf9b3f1bb6e25cde12deb75f01bff6ab7b5c628aa37204dacaf5f9bdeed01679b6f6b60f450767a200d558703d77280a6855472cfb108c599973094ef46d8dba7f7b36bced56de30647e7f007dc6bebde2b7ea250cac03a5b3a52d6579777275dc7972b33b14f5fc4555dd0efc6f9a3c363afbb49b62efd4eed1ce5063e1c974e0b90705e550fa87c463d6983fc00ba773ec5bbf2216a52e2cba894e1f3bfca8"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x42000, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001ac0)={0xdc, 0x0, &(0x7f0000001900)=[@acquire_done={0x40106309, r3}, @increfs_done={0x40106308, r3, 0x2}, @reply={0x40406301, {0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, &(0x7f0000000200), &(0x7f0000001840)=[0x0, 0x38, 0x48, 0x40, 0x38, 0x28, 0x0, 0x0, 0x20]}}, @free_buffer={0x40086303, r1}, @enter_looper, @transaction_sg={0x40486311, {{0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x30, 0x10, &(0x7f00000005c0)=[@flat={0x77682a85, 0xa, r4, 0x2}, @flat={0x73622a85, 0xa, r3, 0x2}], &(0x7f00000018c0)=[0x38, 0x28]}, 0xd5}}, @decrefs={0x40046307, 0x1}, @dead_binder_done={0x40086310, 0x4}], 0xa3, 0x0, &(0x7f0000001a00)="8df0efa6b9390d65ff6fb8ded779085c729c1fa52a367d9d0489f9485d349e020782b10e4c932210c58ec7fd604ff02617e033a79bc0e5d4d192f669be6789e1dacaa6ee18e97c8d2015a25ff8a42707bdafbe37d60e3323653501e41a61bad115423171140a081e8433fe4ca0a9960a8ee74cf4540d2a57bb83449037b9ef249dbd1e7aa735840fc2b97df4dc56df348069df101ec4d3163a24280ab38c80dfe769f1"}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r5, 0xc0a85320, &(0x7f0000000140)={{0x428f, 0x3ff}, 'port0\x00', 0x0, 0x10800, 0x100000001, 0x3, 0x288, 0x2000400000, 0x0, 0x0, 0x1, 0x23b}) 04:50:55 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 671.641849] binder: 21531:21532 got transaction to invalid handle [ 671.655891] binder: 21531:21532 transaction failed 29201/-22, size 32-48 line 2855 [ 671.665199] binder: 21531:21532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:55 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:55 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 672.414542] binder: 21531:21536 got transaction to invalid handle [ 672.428508] binder: 21531:21536 transaction failed 29201/-22, size 32-48 line 2855 [ 672.453301] binder_thread_write: 15 callbacks suppressed [ 672.453315] binder: 21531:21546 DecRefs 0 refcount change on invalid ref 4 ret -22 04:50:56 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:56 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 672.498705] binder: 21531:21546 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:56 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:56 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x252a00, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000080)=r1, 0x4) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000001c0)='gretap0\x00') r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000180)=0x0) getpgrp(r3) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x3af, 0x0, &(0x7f0000000280), 0xfffffffffffffffb, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000000c0)={0x2, 0xfffffffffffffbff, 0x0, 0x2}, 0x8) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) readlinkat(r1, &(0x7f0000000140)='.\x00', &(0x7f0000000180)=""/159, 0x9f) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000240)={0x2d, 0x3, 0x0, {0x0, 0xc, 0x0, "73656c6605656d3075736572"}}, 0x2d) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:56 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:56 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 672.819794] binder: 21563:21565 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 672.841270] binder: 21563:21565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:56 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 672.869442] binder: 21563:21568 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 672.934001] binder: 21563:21568 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x28, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304400400000008631040", @ANYRES64=0x0, @ANYRESDEC=r0], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:56 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 673.074326] binder: 21576:21577 Acquire 1 refcount change on invalid ref 4 ret -22 [ 673.082184] binder: 21576:21577 unknown command 808464432 [ 673.118464] binder: 21576:21577 ioctl c0306201 20000100 returned -22 04:50:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000080000400000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 673.268836] binder: 21583:21584 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 673.296881] binder: 21583:21584 BC_REQUEST_DEATH_NOTIFICATION invalid ref 134217728 04:50:57 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:57 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="076304400400000008631040", @ANYRES64=0x0, @ANYBLOB="000000972905fcffffff7f00000000e5f42483fd680e630c"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:57 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:50:57 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 673.463930] binder: 21590:21591 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 673.483435] binder_thread_write: 13 callbacks suppressed [ 673.488934] binder: 21590:21591 BC_INCREFS_DONE u0000000000000000 no match [ 673.523130] binder: 21590:21591 unknown command 8388607 [ 673.543310] binder: 21590:21591 ioctl c0306201 20000100 returned -22 04:50:57 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:57 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x0) r1 = dup(r0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e24, @local}}, [0x8001, 0xfaa6, 0x400, 0x5, 0x1, 0x0, 0xffff, 0x1ff, 0x8, 0x1, 0x7f, 0x0, 0x4, 0x504, 0x1]}, &(0x7f0000000040)=0x100) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={r2, 0x10001}, &(0x7f00000000c0)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 673.726822] binder: 21604:21605 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 673.760467] binder: 21604:21605 BC_INCREFS_DONE u0000000000000000 no match 04:50:57 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:50:57 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 673.807469] binder: 21604:21609 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 673.863185] binder: 21604:21609 BC_INCREFS_DONE u0000000000000000 no match 04:50:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'U+', 0x3}, 0x28, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0000010004000200ca631040", @ANYRES64=0x0, @ANYBLOB="00000000000000000e630c40000000000000000000000000"], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 673.924017] binder: 21611:21616 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 673.980089] binder: 21618:21619 unknown command 65536 [ 673.992522] binder: 21611:21616 BC_INCREFS_DONE u0000000000000000 no match [ 674.004271] binder: 21618:21619 ioctl c0306201 20000100 returned -22 [ 674.031270] binder: 21618:21620 unknown command 65536 04:50:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x2800, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000080)={'veth0_to_bridge\x00', @random="bc265fb41912"}) lseek(r0, 0x0, 0x5) [ 674.052383] binder: 21618:21620 ioctl c0306201 20000100 returned -22 [ 674.177747] binder: 21623:21624 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 674.207311] binder: 21623:21624 BC_INCREFS_DONE u0000000000000000 no match [ 674.239703] binder: 21623:21624 BC_INCREFS_DONE u0000000000000000 no match 04:50:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x50002, 0x0) ioctl$KVM_PPC_GET_PVINFO(r1, 0x4080aea1, &(0x7f0000000080)=""/33) setsockopt$inet_mreqsrc(r1, 0x0, 0x0, &(0x7f00000000c0)={@remote, @empty, @local}, 0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) [ 674.396329] binder: 21628:21629 BC_INCREFS_DONE u0000000000000000 no match [ 674.430517] binder: 21628:21630 BC_INCREFS_DONE u0000000000000000 no match 04:50:58 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:58 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:50:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = getpid() getpgid(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x101000, 0xaa) r3 = dup3(r0, r0, 0x80000) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000080)={0x4, r3}) 04:50:58 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:58 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:58 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 674.775662] binder: 21640:21641 BC_INCREFS_DONE u0000000000000000 no match [ 674.812191] binder: 21640:21641 BC_INCREFS_DONE u0000000000000000 no match 04:50:58 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:50:59 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:50:59 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:50:59 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:50:59 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 675.814676] binder_thread_write: 10 callbacks suppressed [ 675.814689] binder: 21658:21665 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:50:59 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:50:59 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:59 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:50:59 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:00 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:00 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:00 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:00 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:00 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:00 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:00 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 676.720727] binder: 21690:21697 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:00 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:00 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:01 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:01 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:01 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:01 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) 04:51:01 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 677.666030] binder_thread_write: 8 callbacks suppressed [ 677.666044] binder: 21717:21720 DecRefs 0 refcount change on invalid ref 4 ret -22 04:51:01 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:01 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) 04:51:01 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 677.756509] binder: 21717:21720 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:01 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) 04:51:01 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:02 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:02 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:02 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:02 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:02 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:02 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 678.537088] binder: 21751:21757 DecRefs 0 refcount change on invalid ref 4 ret -22 04:51:02 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 678.601332] binder_thread_write: 4 callbacks suppressed [ 678.601344] binder: 21751:21757 BC_INCREFS_DONE u0000000000000000 no match 04:51:02 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 678.699030] binder: 21751:21757 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:03 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:03 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:03 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 679.437106] binder: 21771:21773 DecRefs 0 refcount change on invalid ref 4 ret -22 04:51:03 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 679.504497] binder: 21771:21773 BC_INCREFS_DONE u0000000000000000 no match [ 679.553151] binder: 21771:21773 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:03 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:03 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:04 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:04 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 680.333885] binder: 21792:21795 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 680.341664] binder: 21792:21795 BC_INCREFS_DONE u0000000000000000 no match 04:51:04 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:04 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 680.451007] binder: 21792:21795 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:04 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:04 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:04 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:05 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 681.230175] binder: 21813:21815 DecRefs 0 refcount change on invalid ref 4 ret -22 04:51:05 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 681.289271] binder: 21813:21815 BC_INCREFS_DONE u0000000000000000 no match [ 681.320626] binder: 21813:21815 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:05 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:05 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:05 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:05 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:06 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 682.148011] binder: 21834:21836 DecRefs 0 refcount change on invalid ref 4 ret -22 04:51:06 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 682.206368] binder: 21834:21836 BC_INCREFS_DONE u0000000000000000 no match [ 682.283870] binder: 21834:21836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:06 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:06 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:06 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:06 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 683.066398] binder: 21852:21854 DecRefs 0 refcount change on invalid ref 4 ret -22 04:51:06 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:06 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 683.158739] binder: 21852:21854 BC_INCREFS_DONE u0000000000000000 no match [ 683.212532] binder: 21852:21854 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:07 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:07 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:07 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:07 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:07 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:07 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:07 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 683.988551] binder: 21878:21884 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 684.028100] binder: 21878:21884 BC_INCREFS_DONE u0000000000000000 no match 04:51:07 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 684.054844] binder: 21878:21884 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:07 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:08 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:08 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:08 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 684.868078] binder: 21899:21902 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 684.908138] binder: 21899:21902 BC_INCREFS_DONE u0000000000000000 no match 04:51:08 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 684.982805] binder: 21899:21902 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:08 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:09 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:09 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:09 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:09 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 685.779051] binder: 21920:21924 DecRefs 0 refcount change on invalid ref 4 ret -22 04:51:09 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 685.835051] binder: 21920:21924 BC_INCREFS_DONE u0000000000000000 no match [ 685.887959] binder: 21920:21924 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:09 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:10 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:10 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:10 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:10 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 686.652651] binder: 21941:21944 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 686.689231] binder: 21941:21944 BC_INCREFS_DONE u0000000000000000 no match 04:51:10 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 686.746648] binder: 21941:21944 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:10 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:10 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:11 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:11 executing program 5: keyctl$set_reqkey_keyring(0xf, 0x0) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:11 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 687.540454] binder: 21962:21966 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 687.581040] binder: 21962:21966 BC_INCREFS_DONE u0000000000000000 no match 04:51:11 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 687.652265] binder: 21962:21966 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:11 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:11 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:12 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:12 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:12 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 688.517002] binder: 21983:21990 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 688.540832] binder: 21983:21990 BC_INCREFS_DONE u0000000000000000 no match 04:51:12 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 688.567038] binder: 21983:21990 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:12 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:13 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:13 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:13 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:13 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:13 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 689.434071] binder: 21999:22010 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 689.469852] binder: 21999:22010 BC_INCREFS_DONE u0000000000000000 no match [ 689.524814] binder: 21999:22010 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:13 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:13 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:14 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 690.343397] binder: 22021:22028 DecRefs 0 refcount change on invalid ref 4 ret -22 04:51:14 executing program 4: keyctl$set_reqkey_keyring(0xf, 0x0) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 690.390873] binder: 22021:22028 BC_INCREFS_DONE u0000000000000000 no match [ 690.432631] binder: 22021:22028 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:14 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:14 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:14 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:14 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:14 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:14 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:15 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:15 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:15 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:15 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:15 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:15 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:15 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:15 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:15 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:15 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:15 executing program 3: keyctl$set_reqkey_keyring(0xf, 0x0) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:15 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:15 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:16 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 692.219908] audit: type=1326 audit(1536814276.039:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22092 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 692.308023] binder: 22092:22097 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 692.322654] binder: 22092:22097 BC_INCREFS_DONE u0000000000000000 no match [ 692.337373] binder: 22092:22097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:16 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:16 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:16 executing program 1: getrusage(0x0, &(0x7f0000000240)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:16 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:16 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:17 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 693.138873] audit: type=1326 audit(1536814276.949:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22115 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 693.214750] binder: 22115:22118 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 693.232872] binder: 22115:22118 BC_INCREFS_DONE u0000000000000000 no match [ 693.243071] binder: 22115:22118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:17 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:17 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:17 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:17 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:17 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 694.012868] audit: type=1326 audit(1536814277.829:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22135 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:17 executing program 1: getrusage(0x0, &(0x7f0000000240)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 694.103962] binder: 22135:22139 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 694.121059] binder: 22135:22139 BC_INCREFS_DONE u0000000000000000 no match 04:51:18 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 694.146402] binder: 22135:22139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 04:51:18 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:18 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:18 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:18 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:18 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:18 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:18 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:18 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:18 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:18 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x2c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done, @request_death], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:19 executing program 1: getrusage(0x0, &(0x7f0000000240)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:19 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:19 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:19 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 695.626149] audit: type=1326 audit(1536814279.449:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22190 comm="syz-executor4" exe="/root/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:19 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:19 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}, @increfs_done], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:19 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:19 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:19 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:19 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:20 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:20 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:20 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:20 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:20 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:20 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000280)=[@decrefs={0x40046307, 0x4}], 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:20 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 696.750139] audit: type=1326 audit(1536814280.569:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22224 comm="syz-executor4" exe="/root/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:20 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:20 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:20 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:20 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:20 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:20 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:21 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:21 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 697.241186] audit: type=1326 audit(1536814281.059:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22258 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:21 executing program 4: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:51:21 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:21 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280), 0xac, 0x0, &(0x7f00000003c0)="38b72d52c5eaa474333adfb7de510bedc23f6d0c88cd59f6d9a63a87c59fa61b8fbb3d3fdea458d137356ae50e8939c1c0239aa94cb33fa553af08a8233ab62363c35e9aa3ae376e255acf515601cfb3fa238b5f4acbd16bd05de729b1f2b4a0a52c46fd7bba95c4ece4ae2bbd72fa74afb23b66901780f389af8c630c9ce3058319091854dd7538779bc67aea1f3caabfc3e2b5c43fe536989bf3c1e408a7c7aac7dc93bd4877c79346de27"}) 04:51:21 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:21 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 697.631043] audit: type=1326 audit(1536814281.449:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22266 comm="syz-executor4" exe="/root/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:21 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:21 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:21 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:21 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:21 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:22 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 698.140934] audit: type=1326 audit(1536814281.959:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22289 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 698.215990] audit: type=1326 audit(1536814282.019:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22292 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:22 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 698.370471] audit: type=1326 audit(1536814282.189:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22299 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:22 executing program 4: mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000580)) getegid() lstat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000440)) fstat(0xffffffffffffffff, &(0x7f00000005c0)) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000700)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f0000000780)) renameat(0xffffffffffffffff, &(0x7f0000000740)='./file0\x00', 0xffffffffffffffff, &(0x7f00000007c0)='./file0\x00') getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0), &(0x7f0000000540)=0xc) getresgid(&(0x7f0000000640), &(0x7f0000000680), &(0x7f00000006c0)) getgroups(0x0, &(0x7f0000000700)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getegid() ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, 0x0) accept$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000140)=0x6e) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, &(0x7f00000002c0)=""/233) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") writev(0xffffffffffffffff, &(0x7f00000001c0), 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f00000003c0)) request_key(&(0x7f0000000a40)='id_legacy\x00', &(0x7f0000000a00), &(0x7f0000000a80)='\x00', 0xfffffffffffffffb) request_key(&(0x7f0000000480)='encrypted\x00', &(0x7f00000004c0), &(0x7f0000000500)='trusted\x00', 0x0) fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000440)) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f00000001c0)) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f0000000800)) lstat(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)) lstat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) getgroups(0x0, &(0x7f0000000a00)) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/udp\x00') getuid() 04:51:22 executing program 1: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000005380)={{{@in6, @in=@local}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000005480)=0xe8) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:22 executing program 5: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f00000003c0)}) [ 698.553039] audit: type=1326 audit(1536814282.369:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22308 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:22 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:22 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000001c0)={@remote, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@local, 0x0, 0x0, 0xff, 0x3}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000240)=0x5, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x88d9, @loopback}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@mcast2}, &(0x7f0000000140)=0x20) 04:51:22 executing program 1: clock_gettime(0xa8000000, &(0x7f00000001c0)) perf_event_open(&(0x7f0000c86f88)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) seccomp(0x1, 0x0, &(0x7f0000001ac0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4000058fe8}]}) syz_execute_func(&(0x7f0000000380)="42568055a07a7a69ef69dc00d990c841ff0f1837d9cb0f38d4c4022d9b65fec19086d9f28fc9e5e5c422c98c56002b74742e1a1a010d64ac1e5d31a3b786e2989f7f") creat(&(0x7f0000000040)='./file0\x00', 0x0) getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000080), &(0x7f00000000c0)=0x4) memfd_create(&(0x7f0000000140)='\x00', 0x0) ioctl$KVM_GET_SREGS(0xffffffffffffffff, 0x8138ae83, &(0x7f0000000400)) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000180), &(0x7f0000000240)=0x4) 04:51:22 executing program 3: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x0, 0x0, &(0x7f0000000100)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") 04:51:22 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 699.035850] audit: type=1326 audit(1536814282.859:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22328 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:23 executing program 4: syz_read_part_table(0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000000b80)="4a08a219624b109a1219266aa31594df6bee472cf445ab073cb588acc8752039284799405ece19f576b80c3aa7f2aacd875f464151a720fb5e11d2abd672c4277c20cee931d0090f9276535d3774f317aeb93b692baaf187596beccec8cd456cfce93e00436c5d6947c75f6133328abfd8d9edad436c0bfc7e982a7dcfc7830c7af2b885302d3e7625aa1360d748b34f83079d859d4e6f8c89b66a8fef5b0ebffb1ae9ed4a28cc8d3501accb7704f077994cc552e9936522dbf865812d5bfec12761e7e92d0191d5e406c4d41ca7533d15adc4ef5763879a4863b64bf29d7f095586b789b87df3e78866d83d30c388e35229f1868502f8ac16d652c817c518e234d02075874764630a8d73e1aa731250117c8ea63d1da15ed7c6f44db3ea64896847f605e04606baf05bb342a12539d5ee0fe8cbdf53385950d0cc82ee7afd8bd5c8e3ebfa79d7cd1c4b5161dcc37109c5cb9aefaef996ea64b5cd5b54be1c4b96168392f75e9d04d3c0a0ba46d6f1e77fe1d4b0e6e185dec802b560bade946d3dd698e113e7170407bb9b6e7eb958339faf3d567dcbd2d77889150fe7ee7e29c6ce474ce267661691da65f8569afec0b5860dde395da8c358679b140889da1dd6c4925be03c48ea9c402bfa0eb06cb666dc444f17bc31576b85a2ef8a903c7df51ac8efb348b6350f97e6846d759f55604c77d34fb8a2adb2689172e02764e3", 0x200}]) 04:51:23 executing program 5: clock_gettime(0x7, &(0x7f00000000c0)) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000340)) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) getpgrp(0x0) ptrace$getsig(0x4202, 0x0, 0x0, &(0x7f0000000440)) getpid() socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000b40)) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000380)={"7261770004000000000000000000000000000100"}, &(0x7f0000000400)=0x54) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000240)) uname(&(0x7f0000000c80)=""/194) openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x0, 0x0) ioctl$EVIOCGBITSND(0xffffffffffffffff, 0x80404532, &(0x7f00000002c0)=""/41) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) ptrace$getsig(0x4202, 0x0, 0x0, &(0x7f0000000140)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) rmdir(&(0x7f0000000300)='./file0\x00') syz_execute_func(&(0x7f0000000180)="42805da0be0fef69dc0f01eece73fe95fa380f38217f1af3f3817e768cc80000000081b5e5b42b00000021abf00fbab204000000cafc205bdae5e54175450f2e1ac4010d64ac1e5d31a3b73e670f530c2771fb0703") fsync(0xffffffffffffffff) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000680)=ANY=[], 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getuid() stat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000500)) geteuid() fstat(0xffffffffffffffff, &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000000780)) fstat(0xffffffffffffffff, &(0x7f0000000480)) stat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000880)) stat(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)) lstat(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00)) getegid() fstat(0xffffffffffffff9c, &(0x7f0000000a80)) [ 699.486791] Dev loop4: unable to read RDB block 1 [ 699.491826] loop4: unable to read partition table [ 699.523113] loop4: partition table beyond EOD, truncated [ 699.528626] loop_reread_partitions: partition scan of loop4 () failed (rc=-5) [ 699.673724] Dev loop4: unable to read RDB block 1 [ 699.678658] loop4: unable to read partition table [ 699.703122] loop4: partition table beyond EOD, truncated [ 699.708626] loop_reread_partitions: partition scan of loop4 () failed (rc=-5) 04:51:23 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000001c0)={@remote, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@local, 0x0, 0x0, 0xff, 0x3}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000240)=0x5, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x88d9, @loopback}, 0x1c) 04:51:23 executing program 1: sync() openat$pfkey(0xffffffffffffff9c, &(0x7f00000005c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) syz_genetlink_get_family_id$team(&(0x7f00000007c0)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000880)={{{@in6=@mcast1, @in=@loopback}}, {{@in6}, 0x0, @in=@dev}}, &(0x7f0000000280)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000000b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000b40)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'team0\x00'}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c00)={@mcast1}, &(0x7f0000000c40)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000e00)={@loopback, @multicast1}, &(0x7f0000000e40)=0xc) getuid() openat$rtc(0xffffffffffffff9c, &(0x7f0000000640)='/dev/rtc0\x00', 0x0, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000006c0)) socket$inet_udplite(0x2, 0x2, 0x88) clock_adjtime(0x0, &(0x7f00000004c0)) fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f0000000340)={'L-', 0x100000000}, 0x28, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000240)) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000680)=0xffffffffffffffff, 0x4) pread64(0xffffffffffffffff, &(0x7f0000000c80)=""/216, 0xd8, 0x0) add_key(&(0x7f0000000200)='syzkaller\x00', &(0x7f00000002c0), &(0x7f0000000280), 0x0, 0xfffffffffffffffe) keyctl$read(0xb, 0x0, &(0x7f0000000800)=""/80, 0xffffffffffffffc5) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000300), 0x10) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000400)={0x2000000000000134, &(0x7f0000000240)}, 0xffffffffffffffeb) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f00000000c0)) signalfd4(0xffffffffffffffff, &(0x7f00000003c0), 0x8, 0x0) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f0000000380)) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000000340)) syz_execute_func(&(0x7f0000000440)="42805da0d10fef69dc0f01ee660f3a608600088041cb913591913d062900770f78993d233d23410feefa6b2179660f38302fbae5e5e575450f2e1a3828c44379dfb9d6adbe90dfe2989f7f") 04:51:23 executing program 3: syz_extract_tcp_res$synack(&(0x7f0000000380), 0x1, 0x0) inotify_init() socket$inet6_tcp(0xa, 0x1, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @local}, &(0x7f00000001c0)=0x18) syz_extract_tcp_res$synack(&(0x7f0000000280), 0x1, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000002e80), 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) getpid() socket$inet_icmp_raw(0x2, 0x3, 0x1) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_genetlink_get_family_id$team(&(0x7f00000004c0)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000500), &(0x7f0000000540)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000600)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e00)={'team0\x00'}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000e40)={@mcast1}, &(0x7f0000000e80)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000ec0)={{{@in6=@remote, @in6=@local}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000fc0)=0xe8) clock_gettime(0x0, &(0x7f00000017c0)) recvmmsg(0xffffffffffffffff, &(0x7f0000001700), 0x0, 0x0, &(0x7f0000001800)) getpeername$packet(0xffffffffffffffff, &(0x7f0000001840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000002c0)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000001e40)={@dev, @remote}, &(0x7f0000001e80)=0xc) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000001ec0)={@broadcast, @multicast1}, &(0x7f0000001f00)=0xc) getsockname$packet(0xffffffffffffff9c, &(0x7f0000001f40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001f80)=0x14) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000002080)={@local}, &(0x7f00000020c0)=0x14) recvmsg(0xffffffffffffffff, &(0x7f0000002f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000002e00), 0x0, &(0x7f0000002ec0)=""/57, 0x39}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002f40)={@rand_addr, @loopback}, &(0x7f0000002f80)=0xc) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000003ac0)={@broadcast}, &(0x7f0000003b00)=0xc) recvmmsg(0xffffffffffffffff, &(0x7f000000b040), 0x0, 0x0, &(0x7f000000b2c0)={0x0, 0x989680}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f000000b9c0)={&(0x7f0000000480), 0xc, &(0x7f000000b980)={&(0x7f00000006c0)=ANY=[]}}, 0x0) syz_execute_func(&(0x7f0000000140)="42805da0320fef69dc0f01eece73fe19fa380f38211af3f242d2be00000000c481b5e5bc2b0000002167f00fbab204000000ca6b2179dae5e54175450f2e1ac4010d64ac1e5d31a3b744dbe271fb0703") keyctl$set_reqkey_keyring(0xe, 0x0) accept$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000300)=0x1c) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000001880)=ANY=[]) 04:51:23 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:23 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:23 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:24 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) 04:51:24 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:24 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:24 executing program 1: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) ustat(0x0, &(0x7f00000002c0)) openat$autofs(0xffffffffffffff9c, &(0x7f0000001400)='/dev/autofs\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000014c0)={{}, 'syz0\x00'}) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ff6000/0x7000)=nil, 0x7000, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000001480)) pkey_alloc(0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pkey_free(0xffffffffffffffff) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, &(0x7f0000000140)) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000400)=""/4096) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) timer_create(0x0, &(0x7f0000000040), &(0x7f00000000c0)) gettid() prctl$setptracer(0x59616d61, 0x0) exit(0x0) ioctl$TCGETS(0xffffffffffffffff, 0x5401, &(0x7f0000000300)) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") 04:51:24 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:25 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR64=&(0x7f0000000140)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 701.643117] binder: BINDER_SET_CONTEXT_MGR already set 04:51:25 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:25 executing program 3: seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f00000003c0)="428055a0aa878769ef69dc00d9ce8441ff0f1837bb38149ac4c19086fbd9f28fc9c461d25d53a6c421301698000000004c42e145bd10167ea70075a70075fbc6f8fe237532c6c62e1a55010d64ac1e5da3c958b706b7989f7f") getuid() fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000800)) gettid() socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'lo\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000080)={"6c6f0000000004000000000600"}) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000100), 0x8) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000080)=@fragment, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000b00)) getpid() getpgrp(0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000b40)) gettid() ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'team0\x00'}) sendmmsg(0xffffffffffffffff, &(0x7f0000000fc0), 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000b80)) getpgid(0x0) getresuid(&(0x7f0000000d40), &(0x7f0000000bc0), &(0x7f0000001300)) getegid() fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000013c0)) fstat(0xffffffffffffffff, &(0x7f0000001400)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001480), &(0x7f00000014c0)=0xc) getuid() fstat(0xffffffffffffffff, &(0x7f0000001500)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000001580)) fstat(0xffffffffffffffff, &(0x7f0000001640)) [ 701.672947] binder: 22412:22415 ioctl 40046207 0 returned -16 04:51:25 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:25 executing program 1: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) ustat(0x0, &(0x7f00000002c0)) openat$autofs(0xffffffffffffff9c, &(0x7f0000001400)='/dev/autofs\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000014c0)={{}, 'syz0\x00'}) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ff6000/0x7000)=nil, 0x7000, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000001480)) pkey_alloc(0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pkey_free(0xffffffffffffffff) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, &(0x7f0000000140)) ioctl$EVIOCGVERSION(0xffffffffffffffff, 0x80044501, &(0x7f0000000400)=""/4096) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) timer_create(0x0, &(0x7f0000000040), &(0x7f00000000c0)) gettid() prctl$setptracer(0x59616d61, 0x0) exit(0x0) ioctl$TCGETS(0xffffffffffffffff, 0x5401, &(0x7f0000000300)) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") 04:51:25 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:26 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:26 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:26 executing program 3: getpriority(0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/null\x00', 0x0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000400), 0x8) lstat(&(0x7f0000000300)='./file1\x00', &(0x7f0000000080)) syz_genetlink_get_family_id$fou(&(0x7f0000000480)='fou\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000440), 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x14}, 0x14}}, 0x0) memfd_create(&(0x7f0000000140)='tmpfs\x00', 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000180)=ANY=[], &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) memfd_create(&(0x7f00000002c0)="68d903dad7726c", 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpid() syz_execute_func(&(0x7f00000001c0)="42805da0ca24a3a3ef69dc0f01ee0dce41cbff9191a33d06290028770f0f993d233d234142d85d096b2179660f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7e29873bb7f") ioctl$BLKPBSZGET(0xffffffffffffffff, 0x127b, &(0x7f0000000180)) ioctl$EVIOCSREP(0xffffffffffffffff, 0x40084503, &(0x7f0000000340)) renameat(0xffffffffffffffff, &(0x7f0000000240)='./file1\x00', 0xffffffffffffffff, &(0x7f0000000380)='./file1\x00') 04:51:26 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:26 executing program 1: getxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)=ANY=[], &(0x7f00000000c0)=""/14, 0xe) openat$pfkey(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@dev, @in6=@mcast2}}, {{@in=@local}}}, &(0x7f0000000700)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000800)={{{@in6=@mcast2, @in6}}, {{@in=@remote}, 0x0, @in6=@ipv4={[], [], @rand_addr}}}, &(0x7f0000000780)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000000900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000940)=0x14) accept4$packet(0xffffffffffffffff, &(0x7f0000000980)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000009c0)=0x14, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d40)={{{@in6=@mcast1, @in=@remote}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000a00)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000a80)={0x0, @multicast1, @dev}, &(0x7f0000000bc0)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000fc0)={{{@in6=@local, @in6=@ipv4={[], [], @multicast1}}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f00000010c0)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000011c0)={'irlan0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000012c0)={{{@in=@broadcast, @in6=@remote}}, {{@in=@loopback}, 0x0, @in=@multicast1}}, &(0x7f00000013c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000001480)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000014c0)={'tunl0\x00'}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000001580)={{{@in6=@local, @in=@local}}, {{@in=@multicast1}, 0x0, @in6}}, &(0x7f0000001680)=0xe8) ioctl$sock_ifreq(0xffffffffffffff9c, 0x0, &(0x7f00000016c0)={'ip6gre0\x00', @ifru_addrs=@xdp}) recvmmsg(0xffffffffffffffff, &(0x7f0000002780), 0x0, 0x0, &(0x7f0000002800)) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000002840)={@broadcast, @loopback}, &(0x7f0000002880)=0xc) accept4$packet(0xffffffffffffff9c, &(0x7f0000005000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000005040)=0x14, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000054c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f0000005380)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000055c0)={{{@in=@multicast1, @in=@multicast2}}, {{@in6}, 0x0, @in6}}, &(0x7f00000053c0)=0xffffffffffffffe0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000056c0)={{{@in, @in6=@local}}, {{@in=@rand_addr}, 0x0, @in=@multicast2}}, &(0x7f0000005400)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000005880)={{{@in6=@remote, @in=@rand_addr}}, {{@in=@dev}, 0x0, @in=@loopback}}, &(0x7f0000005980)=0xe8) accept(0xffffffffffffffff, &(0x7f00000059c0)=@ll, &(0x7f0000005a40)=0x80) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000005a80)={{{@in=@local, @in6=@ipv4={[], [], @multicast1}}}, {{}, 0x0, @in6}}, &(0x7f0000005b80)=0xe8) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000006540)={&(0x7f0000000400), 0xc, &(0x7f0000006500)={&(0x7f00000028c0)=ANY=[]}}, 0x0) eventfd(0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000740)='memory.stat\x00', 0x0, 0x0) ioctl$BLKROSET(0xffffffffffffffff, 0x125d, &(0x7f0000000200)) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x0) seccomp(0x0, 0x0, &(0x7f0000000080)) getxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=ANY=[], &(0x7f0000000240)=""/211, 0xd3) seccomp(0x0, 0x0, &(0x7f0000000100)) pipe(&(0x7f0000000140)) epoll_create(0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f00000001c0)="42805da0ca24a3a3ef69dc0f01ee0dce41cbff9191a33d06290028770f0f993d233d234142d85d096b2179660f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7e29873bb7f") 04:51:26 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:27 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:27 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() [ 703.585100] tmpfs: No value for mount option 'hÙÚ×rl' 04:51:27 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:27 executing program 1: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) 04:51:27 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:27 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) 04:51:28 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") 04:51:28 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:28 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) 04:51:28 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:28 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:28 executing program 1: mincore(&(0x7f0000ffc000/0x1000)=nil, 0x1000, &(0x7f0000000440)=""/165) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) finit_module(0xffffffffffffffff, &(0x7f0000000040)=']{\x00', 0x0) fcntl$getown(0xffffffffffffffff, 0x9) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000000780)=ANY=[], 0x0) ioctl$TIOCLINUX6(0xffffffffffffffff, 0x541c, &(0x7f0000000080)) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f00000000c0)) ftruncate(0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000380)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000700)="428055a0876969ef69dc00d990c841ff0f183737db6a00f30f2c560fc19086d9f28fc94134fec4c1fae634fd000000003e1025794c4ce54515753da23da22e1a1a010d64ac1e5d9ec46261bbb63c00000066430f3832b907ee00007f") socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000140)) ioctl$sock_inet_SIOCGIFPFLAGS(0xffffffffffffffff, 0x8935, &(0x7f00000005c0)={'rose0\x00'}) nanosleep(&(0x7f0000000040), 0x0) eventfd(0x0) sched_rr_get_interval(0x0, &(0x7f00000000c0)) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x0, 0x0) ioctl$BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000300)) getpgrp(0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) pipe2(&(0x7f0000000180), 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f00000001c0)) openat(0xffffffffffffffff, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) syz_execute_func(&(0x7f0000000240)="428055a061f36ee9d92a5c41ff0f1837370f38211ac4c4829bdd2520200fee0a9d9d2179fbe5f541754566470f71d600c48179fcdf26bc2ebc0d641e5dc4e1e0120db80000007f") getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000500)={@mcast2}, &(0x7f0000000540)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'team0\x00'}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000400)) ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000200)) accept$packet(0xffffffffffffffff, &(0x7f0000007940), &(0x7f0000007980)=0x14) 04:51:29 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:29 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") 04:51:29 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) 04:51:29 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:29 executing program 1: getpid() sched_setaffinity(0x0, 0x12, &(0x7f0000000000)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, &(0x7f0000000180)="b9da0b0000b80a000080ba000000000f3066baf80cb8640b748eef66bafc0cb000ee0f01ca660f38826d0a0f20d835080000000f22d80f01c8c4c29d45142dd3000000c1700800c4e2b1904454ec0f01c8", 0x51}], 0x1, 0x0, &(0x7f0000000240), 0x0) gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) fstat(0xffffffffffffffff, &(0x7f0000000400)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000300), &(0x7f0000000340)=0x8) seccomp(0x1, 0x0, &(0x7f0000001ac0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4000058fe8}]}) syz_execute_func(&(0x7f0000000200)="40805da08d0fef69dcc4a3bd79734c4450c48275ad7700f30faeda380fc4c27d0777051af3f081768cc8000000c481b5e5bc2b0000002167f00fbab204000000ca6b2179dae5e54175451a010d64ac1e5d31a3b744dbe271fb0f4fb500088041") 04:51:29 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:30 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:30 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") 04:51:30 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:30 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:30 executing program 1: munlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f00000001c0)="42805da0ca24a3a3ef69dc0f01ee0dce41cbff9191a33d06290028770f0f993d233d234142d85d096b2179660f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7e29873bb7f") 04:51:31 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:31 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) geteuid() 04:51:31 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:31 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:31 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) 04:51:31 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) 04:51:31 executing program 1: getrandom(&(0x7f0000000200)=""/148, 0x340, 0x0) clock_gettime(0x0, &(0x7f00000001c0)) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000140)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4000000000058fe4}]}) syz_execute_func(&(0x7f00000004c0)="40805da08d0fef69dcc4a3bd79734c44cec48275ad7700f30faeda380fc4c27d0777051af3f081768cc8000000c481b5e5bc2b0000002167f00fbab204000000ca6b2179dae5e54175451a010d64ac1e5d31a3b744dbe271fb0f4fb500088041") seccomp(0x0, 0x0, &(0x7f0000000100)) ustat(0x0, &(0x7f0000000140)) openat$zero(0xffffffffffffff9c, &(0x7f0000000340)='/dev/zero\x00', 0x0, 0x0) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000380)) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000540), 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000140)={0x0, 0x989680}, &(0x7f00000000c0), 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, &(0x7f0000000080)) 04:51:31 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) 04:51:31 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:32 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) geteuid() 04:51:32 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:32 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:32 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:32 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:32 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:32 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:32 executing program 1: futex(&(0x7f0000000040), 0xc, 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f00000000c0), 0x0) mincore(&(0x7f0000ffc000/0x1000)=nil, 0x1000, &(0x7f0000000440)=""/165) seccomp(0x0, 0x0, &(0x7f0000000100)) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000140), 0x0) mincore(&(0x7f0000ffc000/0x2000)=nil, 0x2000, &(0x7f00000002c0)=""/165) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) finit_module(0xffffffffffffffff, &(0x7f0000000040)=']{\x00', 0x0) add_key(&(0x7f0000000680)='cifs.idmap\x00', &(0x7f0000000740), &(0x7f0000000880), 0x0, 0xfffffffffffffffd) request_key(&(0x7f0000000200)='rxrpc_s\x00', &(0x7f0000000780), &(0x7f0000000540)='/dev/urandom\x00', 0x0) add_key$keyring(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffc) keyctl$unlink(0x9, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000600)) rename(&(0x7f0000000500)='./file0\x00', &(0x7f00000004c0)='./file0\x00') getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000006c0), &(0x7f0000000700)=0xc) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f00000000c0)) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000380)='yeah\x00', 0x5) seccomp(0x0, 0x0, &(0x7f0000000100)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) syz_emit_ethernet(0x0, &(0x7f0000000940)=ANY=[], &(0x7f0000000040)) openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x0, 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000140)="42805da0690fef69dc0f01ee8141ff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") accept4$inet6(0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000280)=0x1c, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f0000000400)) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000800)={0x0, @empty, @dev}, &(0x7f0000000840)=0xc) syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000400)) geteuid() getegid() 04:51:32 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) geteuid() 04:51:33 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:33 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:33 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:33 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:33 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:33 executing program 1: syz_extract_tcp_res$synack(&(0x7f0000000300), 0x1, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x0, 0x0) mremap(&(0x7f0000ffa000/0x4000)=nil, 0x6000, 0x10000, 0x0, &(0x7f0000fec000/0x10000)=nil) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) memfd_create(&(0x7f00000000c0)='posix_acl_accesssystemp\x00', 0x0) syz_execute_func(&(0x7f0000000600)="42805da0510fef69dc0f01ee0dce41cbff9191a33d062900770f78993d233d23417e0f6eeefa39f6eefa39f60f38302fc4a10dfbd6450f2e1ac4010d64ac1e5d31a3b7e2989f7f") add_key$keyring(&(0x7f0000000500)='keyring\x00', &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) 04:51:33 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:34 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:34 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:34 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:34 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 710.887799] binder: BINDER_SET_CONTEXT_MGR already set [ 710.901117] binder_alloc: 22412: binder_alloc_buf, no vma [ 710.934706] binder: 22666:22668 ioctl 40046207 0 returned -16 [ 710.953260] binder: 22666:22669 transaction failed 29189/-3, size 24-0 line 2970 04:51:34 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 710.981545] binder: BINDER_SET_CONTEXT_MGR already set [ 711.003933] binder: 22666:22672 ioctl 40046207 0 returned -16 04:51:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 711.049938] binder_alloc: 22412: binder_alloc_buf, no vma [ 711.077142] binder: 22666:22673 transaction failed 29189/-3, size 24-0 line 2970 04:51:34 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 711.192420] binder: BINDER_SET_CONTEXT_MGR already set 04:51:35 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 711.213281] binder: 22679:22680 ioctl 40046207 0 returned -16 [ 711.220477] binder_alloc: 22412: binder_alloc_buf, no vma [ 711.239277] binder: 22679:22681 transaction failed 29189/-3, size 24-0 line 2970 [ 711.373274] binder: BINDER_SET_CONTEXT_MGR already set [ 711.409365] binder_alloc: 22412: binder_alloc_buf, no vma [ 711.432157] binder: 22690:22691 ioctl 40046207 0 returned -16 04:51:35 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 711.459508] binder: 22690:22693 transaction failed 29189/-3, size 24-0 line 2970 [ 711.570848] binder: BINDER_SET_CONTEXT_MGR already set [ 711.596907] binder_alloc: 22412: binder_alloc_buf, no vma [ 711.622111] binder: 22698:22699 ioctl 40046207 0 returned -16 04:51:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 711.645319] binder: 22698:22700 transaction failed 29189/-3, size 24-0 line 2970 04:51:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 711.777014] binder_alloc: 22412: binder_alloc_buf, no vma [ 711.798035] binder: 22702:22703 transaction failed 29189/-3, size 24-0 line 2970 04:51:35 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 711.932337] binder_alloc: 22412: binder_alloc_buf, no vma [ 711.976000] binder: 22706:22708 transaction failed 29189/-3, size 24-0 line 2970 [ 712.048365] binder_alloc: 22412: binder_alloc_buf, no vma [ 712.071176] binder: 22713:22714 transaction failed 29189/-3, size 24-0 line 2970 04:51:35 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:35 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:36 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") [ 712.179722] binder: BINDER_SET_CONTEXT_MGR already set [ 712.194176] binder: 22722:22723 ioctl 40046207 0 returned -16 [ 712.230848] binder_alloc: 22412: binder_alloc_buf, no vma [ 712.253957] binder: 22722:22728 transaction failed 29189/-3, size 24-0 line 2970 04:51:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 712.293415] binder: undelivered TRANSACTION_ERROR: 29189 04:51:36 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() [ 712.392924] binder: BINDER_SET_CONTEXT_MGR already set [ 712.405513] binder: 22733:22734 ioctl 40046207 0 returned -16 [ 712.427416] binder_alloc: 22412: binder_alloc_buf, no vma 04:51:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 712.451243] binder: 22733:22734 transaction failed 29189/-3, size 24-0 line 2970 [ 712.476155] binder: undelivered TRANSACTION_ERROR: 29189 [ 712.577231] binder: BINDER_SET_CONTEXT_MGR already set [ 712.609502] binder: 22739:22740 ioctl 40046207 0 returned -16 [ 712.639793] binder: undelivered TRANSACTION_ERROR: 29189 04:51:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 712.769936] binder: BINDER_SET_CONTEXT_MGR already set 04:51:36 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 712.817499] binder: 22744:22745 ioctl 40046207 0 returned -16 04:51:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 712.923572] binder: BINDER_SET_CONTEXT_MGR already set [ 712.935820] binder: 22749:22752 ioctl 40046207 0 returned -16 04:51:36 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:36 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 713.032092] binder: BINDER_SET_CONTEXT_MGR already set [ 713.062238] binder: 22755:22756 ioctl 40046207 0 returned -16 04:51:36 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:37 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 713.458106] cgroup: fork rejected by pids controller in /syz1 04:51:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:37 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:37 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:37 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:37 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:38 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:38 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:38 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:38 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:38 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:39 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:39 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:39 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:39 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:39 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:39 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:40 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x1a, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:40 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:40 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:40 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x1a, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:40 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 717.051431] binder: undelivered TRANSACTION_ERROR: 29189 [ 717.156478] binder: undelivered TRANSACTION_ERROR: 29189 [ 717.165514] binder: undelivered TRANSACTION_ERROR: 29189 [ 717.186837] binder: undelivered TRANSACTION_ERROR: 29189 [ 717.206865] binder: undelivered TRANSACTION_ERROR: 29189 [ 717.226058] binder: undelivered TRANSACTION_ERROR: 29189 04:51:41 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") [ 717.253695] binder: undelivered TRANSACTION_ERROR: 29189 04:51:41 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:41 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:41 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:41 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 717.514926] binder_release_work: 6 callbacks suppressed [ 717.514933] binder: undelivered TRANSACTION_ERROR: 29189 04:51:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x1a, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) [ 717.982703] IPVS: ftp: loaded support on port[0] = 21 [ 718.004247] device bridge_slave_1 left promiscuous mode [ 718.011633] bridge0: port 2(bridge_slave_1) entered disabled state [ 718.089315] device bridge_slave_0 left promiscuous mode [ 718.108516] bridge0: port 1(bridge_slave_0) entered disabled state 04:51:42 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:42 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:42 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() [ 718.343692] team0 (unregistering): Port device team_slave_1 removed [ 718.400316] team0 (unregistering): Port device team_slave_0 removed 04:51:42 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 718.440805] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 718.519972] bond0 (unregistering): Releasing backup interface bond_slave_0 04:51:42 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 718.700348] bond0 (unregistering): Released all slaves 04:51:42 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:43 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:43 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:43 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:43 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:43 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x0, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 720.578918] bridge0: port 1(bridge_slave_0) entered blocking state [ 720.586315] bridge0: port 1(bridge_slave_0) entered disabled state [ 720.594302] device bridge_slave_0 entered promiscuous mode [ 720.641608] bridge0: port 2(bridge_slave_1) entered blocking state [ 720.648557] bridge0: port 2(bridge_slave_1) entered disabled state [ 720.656497] device bridge_slave_1 entered promiscuous mode [ 720.702278] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 720.749815] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 720.891854] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 720.933800] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 721.110452] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 721.117718] team0: Port device team_slave_0 added [ 721.145233] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 721.152389] team0: Port device team_slave_1 added [ 721.179767] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 721.209290] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 721.253347] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 721.301985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 721.578145] bridge0: port 2(bridge_slave_1) entered blocking state [ 721.584539] bridge0: port 2(bridge_slave_1) entered forwarding state [ 721.591136] bridge0: port 1(bridge_slave_0) entered blocking state [ 721.597536] bridge0: port 1(bridge_slave_0) entered forwarding state [ 721.604989] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 722.433268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 722.554553] 8021q: adding VLAN 0 to HW filter on device bond0 [ 722.647201] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 722.739519] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 722.745717] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 722.752768] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 722.846003] 8021q: adding VLAN 0 to HW filter on device team0 04:51:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x27, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:47 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:47 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:47 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:47 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:47 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) [ 723.404347] binder: BINDER_SET_CONTEXT_MGR already set [ 723.409679] binder: 23229:23230 ioctl 40046207 0 returned -16 [ 723.417246] binder_alloc_new_buf_locked: 7 callbacks suppressed [ 723.417251] binder_alloc: 22412: binder_alloc_buf, no vma [ 723.428964] binder_transaction: 7 callbacks suppressed [ 723.428973] binder: 23229:23231 transaction failed 29189/-3, size 0-0 line 2970 04:51:47 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 723.587325] binder: BINDER_SET_CONTEXT_MGR already set 04:51:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2e, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 723.608701] binder: 23244:23247 ioctl 40046207 0 returned -16 [ 723.609340] binder_alloc: 22412: binder_alloc_buf, no vma 04:51:47 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 723.664385] binder: 23244:23248 transaction failed 29189/-3, size 24-0 line 2970 [ 723.776030] binder: BINDER_SET_CONTEXT_MGR already set 04:51:47 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 723.797561] binder_alloc: 22412: binder_alloc_buf, no vma [ 723.823316] binder: 23254:23255 ioctl 40046207 0 returned -16 [ 723.826612] binder: 23254:23256 transaction failed 29189/-3, size 24-0 line 2970 04:51:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x31, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:47 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:47 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 724.005669] binder: BINDER_SET_CONTEXT_MGR already set [ 724.032776] binder_alloc: 22412: binder_alloc_buf, no vma [ 724.058973] binder: 23262:23264 ioctl 40046207 0 returned -16 [ 724.089183] binder: 23262:23267 transaction failed 29189/-3, size 24-0 line 2970 04:51:48 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2e, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:48 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:48 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:48 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:48 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") [ 724.348663] audit: type=1326 audit(1536814308.169:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23276 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 724.380329] binder: BINDER_SET_CONTEXT_MGR already set 04:51:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2e, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 724.417855] binder: 23280:23281 ioctl 40046207 0 returned -16 [ 724.435976] binder_alloc: 22412: binder_alloc_buf, no vma [ 724.455625] binder: 23280:23292 transaction failed 29189/-3, size 24-0 line 2970 04:51:48 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 724.522426] binder: BINDER_SET_CONTEXT_MGR already set [ 724.551709] binder_alloc: 22412: binder_alloc_buf, no vma [ 724.572444] binder: 23295:23296 ioctl 40046207 0 returned -16 04:51:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2b, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 724.584228] audit: type=1326 audit(1536814308.409:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23299 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 [ 724.590619] binder: 23295:23297 transaction failed 29189/-3, size 24-0 line 2970 04:51:48 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) getpgid(0xffffffffffffffff) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) [ 724.699778] binder: BINDER_SET_CONTEXT_MGR already set [ 724.718589] binder_alloc: 22412: binder_alloc_buf, no vma [ 724.741445] binder: 23303:23306 ioctl 40046207 0 returned -16 [ 724.758331] audit: type=1326 audit(1536814308.579:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=23309 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x4572d9 code=0x0 04:51:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x28, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 724.787815] binder: 23303:23307 transaction failed 29189/-3, size 24-0 line 2970 04:51:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000"], 0x0, 0x0, &(0x7f00000003c0)}) [ 724.922161] binder: BINDER_SET_CONTEXT_MGR already set [ 724.956858] binder_alloc: 22412: binder_alloc_buf, no vma [ 724.962475] binder: 23313:23316 transaction failed 29189/-3, size 24-0 line 2970 [ 724.976408] binder: BINDER_SET_CONTEXT_MGR already set [ 724.994226] binder: 23313:23314 ioctl 40046207 0 returned -16 [ 725.002882] binder: 23317:23319 ioctl 40046207 0 returned -16 [ 725.002920] binder_alloc: 22412: binder_alloc_buf, no vma [ 725.075953] binder: 23317:23318 transaction failed 29189/-3, size 24-0 line 2970 04:51:49 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:49 executing program 0: 04:51:49 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:49 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:49 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000e40)={'vcan0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:49 executing program 0: [ 725.527810] binder: BINDER_SET_CONTEXT_MGR already set [ 725.547702] binder_alloc: 22412: binder_alloc_buf, no vma [ 725.576560] binder: 23333:23334 ioctl 40046207 0 returned -16 04:51:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) [ 725.606878] binder: 23333:23335 transaction failed 29189/-3, size 24-0 line 2970 04:51:49 executing program 0: [ 725.711184] binder: BINDER_SET_CONTEXT_MGR already set 04:51:49 executing program 0: 04:51:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) [ 725.744557] binder: 23343:23344 ioctl 40046207 0 returned -16 04:51:49 executing program 0: [ 725.899536] binder: BINDER_SET_CONTEXT_MGR already set [ 725.941478] binder: 23350:23353 ioctl 40046207 0 returned -16 04:51:50 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000980)) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:50 executing program 0: 04:51:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:50 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000380), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[]}}, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:50 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:50 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x24, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:50 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000001c0)={@remote, 0x0, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@local, 0x0, 0x0, 0xff, 0x3}, 0x20) [ 726.645333] binder: BINDER_SET_CONTEXT_MGR already set [ 726.653078] binder: 23370:23374 ioctl 40046207 0 returned -16 04:51:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x24, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:50 executing program 0: sync() seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) keyctl$set_reqkey_keyring(0x14, 0x0) syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000240), 0x8, 0x0) syz_execute_func(&(0x7f0000000c40)="42805da0cd0fef69dc0f01eece73fe19fa380f38211af3f081a4768cca0000808081b5e5bc2b0000002167f00fbab204000000ca6b2179dae5e541757a45450f71f5fbc4010d64ac1e5d31a3b744dbe271fb26f00fbb9500000000") seccomp(0x0, 0x0, &(0x7f0000000040)) syz_execute_func(&(0x7f0000000080)="4280f25dc482113c5c08eace73fe19fac461796e04dfc4c27922644a00436cf0817e768cc80000000081b5e5bc2b0000002167f00fbab204000000ca0fa10e25e5e44135450f2e1ac4010d64ac1e5d31a3b74472e671fb0703") [ 726.777164] binder: BINDER_SET_CONTEXT_MGR already set [ 726.793472] binder: 23379:23381 ioctl 40046207 0 returned -16 04:51:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x24, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) [ 726.898353] binder: BINDER_SET_CONTEXT_MGR already set [ 726.915025] binder: 23386:23387 ioctl 40046207 0 returned -16 04:51:50 executing program 0: munlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000600), 0x0) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f00000001c0)="42805da0ca24a3a3ef69dc0f01ee0dce41cbff9191a33d06290028770f0f993d233d234142d85d096b2179660f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7e29873bb7f") [ 727.031948] binder: BINDER_SET_CONTEXT_MGR already set [ 727.043338] binder: 23393:23394 ioctl 40046207 0 returned -16 04:51:51 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") 04:51:51 executing program 1: getitimer(0x0, &(0x7f0000000300)) getrandom(&(0x7f0000000200)=""/148, 0x94, 0x0) seccomp(0x0, 0x0, &(0x7f0000000100)) ustat(0x0, &(0x7f0000000140)) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f0000000140)={0x0, 0x989680}, &(0x7f00000000c0), 0x0) open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) io_setup(0x0, 0xfffffffffffffffe) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000040)="42805da0cd0fef69dc0f01eece73fe19fa380f38211af3f081a4768cca0000808081b5e5bc2b0000002167f00fbab204000000ca6b2179dae5e541757a45450f71f5fbc4010d64ac1e5d31a3b744dbe271fb26f00fbb9500000000") ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000007ec0)) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") 04:51:51 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:51 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:51 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000000)) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f00000002c0)={'filter\x00', 0x96, "e92d2bcd3e6625d52549d9edadf8e98aa8fd092f1e8182501276cd0351de6351ec3b519a0a986348072ed1af6e0739e6a63a0901dcbd16a20c54d61fd3eb78c3cc8317dee37143fd9f7ae1ac34561b16522b3c488a68b932579e354abcf0b98e9497d019bc7c006c4812e3ba2ef26a02e9f80e3a55598ef10f2fda1db7c0bb0575f3764407227dffa8375359bc8f6d610e4a41f6923f"}, &(0x7f0000000380)=0xba) setsockopt$inet6_buf(r0, 0x29, 0x80000000000021, &(0x7f0000000240), 0x0) 04:51:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:51 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) clock_getres(0x0, &(0x7f0000000240)) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000200), 0x4) ustat(0x0, &(0x7f0000000140)) socket$inet6_udp(0xa, 0x2, 0x0) dup(0xffffffffffffffff) fstat(0xffffffffffffffff, &(0x7f00000003c0)) getegid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000500)={0xa0}, 0xa0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000000c0), 0xfffffd9b) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'ip6tnl0\x00'}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000006c0)={@local}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, &(0x7f00000004c0)) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0xc) syz_execute_func(&(0x7f0000000640)="42805da00fef69dc0f01ee263a208600acc041cbcb3e3636a72900770f7899583d23502306470f953efa6b2179660f38302fbae5e5e575450f2e1a8af5c44379dfb9d6adbe90dff2249f7e") accept(0xffffffffffffff9c, &(0x7f0000000340)=@in6={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1f6) flistxattr(0xffffffffffffffff, &(0x7f00000001c0)=""/14, 0xe) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000300)=@req3, 0x1c) 04:51:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) 04:51:52 executing program 4: keyctl$set_reqkey_keyring(0x1d, 0x0) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000740)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) futex(&(0x7f0000000040), 0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000140), 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000540), 0x4) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) eventfd(0x0) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) renameat(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0xffffffffffffffff, &(0x7f00000005c0)='./file0\x00') syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000b00)={{{@in6=@mcast2, @in6=@mcast2}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000c00)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000c40)={@loopback}, &(0x7f0000000c80)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000cc0)={'syzkaller1\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000d00)={0x0, @broadcast, @remote}, &(0x7f0000000d40)=0xc) accept$packet(0xffffffffffffffff, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000f00)={'bridge_slave_1\x00'}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001000)={'bpq0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in, @in6=@dev}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f0000001140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001580)={&(0x7f0000000400), 0xc, &(0x7f0000001540)={&(0x7f0000001180)={0x14}, 0x14}}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 04:51:52 executing program 3: keyctl$set_reqkey_keyring(0x3, 0xffffffffffffffff) seccomp(0x0, 0x0, &(0x7f0000000140)={0x0, &(0x7f0000000080)}) openat$zero(0xffffffffffffff9c, &(0x7f0000000600)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000640)={0x0, 0xffffffffffffff9c}) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000003c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000800)}}, 0x18) write$P9_RWSTAT(0xffffffffffffffff, &(0x7f0000000500)={0x7}, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000780), &(0x7f00000007c0)=0x8) clock_gettime(0x0, &(0x7f0000000180)) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040), 0x8) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000200)="42805da0610fef69dc0fc201e5eee5eeff0faa0faa370f38211ac4c19086d9f28fc9410feefac421e572f1f0a6e5e54175440f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfc4c3916efafe9f7f") 04:51:52 executing program 5: getrandom(&(0x7f0000000200)=""/148, 0xffffffffffffff11, 0x3) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) socket$inet6(0xa, 0x0, 0x0) clock_gettime(0x0, &(0x7f00000005c0)) pselect6(0x40, &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580), &(0x7f0000000600), &(0x7f0000000680)={&(0x7f0000000640), 0x8}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000040)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000340)) ustat(0x0, &(0x7f0000000140)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') open(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000640)=ANY=[], 0x0) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f00000006c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f00000000c0)={'gretap0\x00', @broadcast}) syz_execute_func(&(0x7f0000000180)="428055a06b6969ef69dc00d99069203737c3397c2a060f38211a40a564a741dfe0400f01efe5e54175457d0f2e1a1a01460f01ee31a3b786e2989f3f") geteuid() 04:51:52 executing program 2: getrusage(0x0, &(0x7f0000000240)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000140)) getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000180)) lookup_dcookie(0x0, &(0x7f0000000280)=""/61, 0x3d) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f00000001c0)={{0x2, 0x0, @loopback}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000080)={'vcan0\x00', @broadcast}) clock_gettime(0x0, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) getpeername(0xffffffffffffffff, &(0x7f0000000480)=@xdp, &(0x7f0000000700)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000580)=@raw, &(0x7f00000003c0)='GPL\x00', 0x0, 0x94, &(0x7f0000000640)=""/148}, 0x48) geteuid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@rand_addr, @in6=@remote}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@remote}}, &(0x7f0000000b00)=0xe8) stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) fstat(0xffffffffffffffff, &(0x7f0000003400)) getgroups(0x0, &(0x7f0000003480)) getuid() lstat(&(0x7f0000003880)='./file0\x00', &(0x7f00000038c0)) getuid() getegid() stat(&(0x7f0000004a80)='./file0\x00', &(0x7f0000004ac0)) fstat(0xffffffffffffffff, &(0x7f0000004b40)) getresuid(&(0x7f0000004bc0), &(0x7f0000004c00), &(0x7f0000004c40)) stat(&(0x7f0000004c80)='./file0\x00', &(0x7f0000004cc0)) getresuid(&(0x7f0000005100), &(0x7f0000005140), &(0x7f0000005180)) getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000052c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000005300)) syz_execute_func(&(0x7f0000000500)="42805da0510fef69dc0f01ee0dce0ecf41cb410f38053f660f3825cf260f4fb6fd000000a33d062900770f789933d23d674141b11c1d0b00000244fe80cc39390f38302fbae5e5e575450f2e1ac4010d64ac1e5d31a3b7c44379dfb9d6adbe90dfe2989f7f") [ 728.726787] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.824168] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.829814] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.851173] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.873425] binder: undelivered TRANSACTION_ERROR: 29189 04:51:52 executing program 0: keyctl$set_reqkey_keyring(0xf, 0xfffffffffffffffb) futex(&(0x7f0000000040), 0x1, 0x0, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x0) clock_gettime(0x0, &(0x7f00000003c0)) seccomp(0x0, 0x0, &(0x7f0000000380)={0x0, &(0x7f0000000240)}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) syz_execute_func(&(0x7f0000000240)="428055a0876969ef69dc00d990c841ff0f1837370f38211ac4c19086d9f28fc9410feefa4e2179fbe5e54175455d0f2e1a1a010d64ac1e5d31a3b786e2989f7f") [ 728.894525] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.929762] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.955343] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.976356] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.981932] binder: undelivered TRANSACTION_ERROR: 29189 04:51:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000003c0)}) [ 729.367833] ================================================================== [ 729.375490] BUG: KASAN: slab-out-of-bounds in mqueue_get_tree+0x2a2/0x2e0 [ 729.382528] Read of size 8 at addr ffff8801c7d038a8 by task syz-executor1/23450 [ 729.390018] [ 729.391661] CPU: 0 PID: 23450 Comm: syz-executor1 Not tainted 4.19.0-rc3-next-20180912+ #72 [ 729.400147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 729.409534] Call Trace: [ 729.412167] dump_stack+0x1d3/0x2c4 [ 729.415916] ? dump_stack_print_info.cold.2+0x52/0x52 [ 729.421155] ? printk+0xa7/0xcf [ 729.424444] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 729.429335] print_address_description.cold.8+0x9/0x1ff [ 729.434761] kasan_report.cold.9+0x242/0x309 [ 729.439235] ? mqueue_get_tree+0x2a2/0x2e0 [ 729.443524] __asan_report_load8_noabort+0x14/0x20 [ 729.448657] mqueue_get_tree+0x2a2/0x2e0 [ 729.452778] vfs_get_tree+0x1cb/0x5c0 [ 729.456708] mq_create_mount+0xe3/0x190 [ 729.460717] mq_init_ns+0x15a/0x210 [ 729.464357] copy_ipcs+0x3d2/0x580 [ 729.467897] ? ipcns_get+0xe0/0xe0 [ 729.471445] ? do_mount+0x1db0/0x1db0 [ 729.475247] ? kmem_cache_alloc+0x33a/0x730 [ 729.479619] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 729.485199] ? perf_event_namespaces+0x136/0x400 [ 729.489998] create_new_namespaces+0x376/0x900 [ 729.494677] ? sys_ni_syscall+0x20/0x20 [ 729.498658] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 729.504254] ? ns_capable_common+0x13f/0x170 [ 729.508680] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 729.513616] ksys_unshare+0x79c/0x10b0 [ 729.517507] ? walk_process_tree+0x440/0x440 [ 729.521923] ? lock_downgrade+0x900/0x900 [ 729.526093] ? kasan_check_read+0x11/0x20 [ 729.530311] ? do_raw_spin_unlock+0xa7/0x2f0 [ 729.534796] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 729.539391] ? kasan_check_write+0x14/0x20 [ 729.543648] ? do_raw_read_unlock+0x3f/0x60 [ 729.548026] ? do_syscall_64+0x9a/0x820 [ 729.552012] ? do_syscall_64+0x9a/0x820 [ 729.555997] ? lockdep_hardirqs_on+0x421/0x5c0 [ 729.560629] ? trace_hardirqs_on+0xbd/0x310 [ 729.565002] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 729.570382] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 729.575881] ? __ia32_sys_prlimit64+0x8c0/0x8c0 [ 729.580612] __x64_sys_unshare+0x31/0x40 [ 729.584688] do_syscall_64+0x1b9/0x820 [ 729.588617] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 729.594062] ? syscall_return_slowpath+0x5e0/0x5e0 [ 729.599005] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 729.603885] ? trace_hardirqs_on_caller+0x310/0x310 [ 729.608954] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 729.614026] ? prepare_exit_to_usermode+0x291/0x3b0 [ 729.619129] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 729.624075] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 729.629353] RIP: 0033:0x459d87 [ 729.632653] Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 3d 8a fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 1d 8a fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 729.651653] RSP: 002b:00007fff3f284358 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 729.659447] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459d87 [ 729.666812] RDX: 0000000000000000 RSI: 00007fff3f284360 RDI: 0000000008000000 [ 729.674133] RBP: 0000000000930b28 R08: 0000000000000000 R09: 0000000000000018 [ 729.681453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000010 [ 729.688819] R13: 0000000000412cc0 R14: 0000000000000000 R15: 0000000000000000 [ 729.696142] [ 729.697820] Allocated by task 23450: [ 729.701593] save_stack+0x43/0xd0 [ 729.705127] kasan_kmalloc+0xc7/0xe0 [ 729.708895] kmem_cache_alloc_trace+0x152/0x750 [ 729.713614] copy_ipcs+0x1c6/0x580 [ 729.717330] create_new_namespaces+0x376/0x900 [ 729.722028] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 729.727085] ksys_unshare+0x79c/0x10b0 [ 729.731062] __x64_sys_unshare+0x31/0x40 [ 729.735200] do_syscall_64+0x1b9/0x820 [ 729.739185] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 729.744460] [ 729.746168] Freed by task 0: [ 729.749270] (stack is not available) [ 729.753037] [ 729.754691] The buggy address belongs to the object at ffff8801c7d03180 [ 729.754691] which belongs to the cache kmalloc-2048 of size 2048 [ 729.767628] The buggy address is located 1832 bytes inside of [ 729.767628] 2048-byte region [ffff8801c7d03180, ffff8801c7d03980) [ 729.779702] The buggy address belongs to the page: [ 729.784676] page:ffffea00071f4080 count:1 mapcount:0 mapping:ffff8801da800c40 index:0x0 compound_mapcount: 0 [ 729.794719] flags: 0x2fffc0000008100(slab|head) [ 729.799502] raw: 02fffc0000008100 ffffea0006de7488 ffff8801da801948 ffff8801da800c40 [ 729.807478] raw: 0000000000000000 ffff8801c7d02080 0000000100000003 0000000000000000 [ 729.815420] page dumped because: kasan: bad access detected [ 729.821188] [ 729.822897] Memory state around the buggy address: [ 729.827994] ffff8801c7d03780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 729.835425] ffff8801c7d03800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 729.842803] >ffff8801c7d03880: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 729.850208] ^ [ 729.854959] ffff8801c7d03900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 729.862368] ffff8801c7d03980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 729.869807] ================================================================== [ 729.877223] Disabling lock debugging due to kernel taint [ 729.882891] Kernel panic - not syncing: panic_on_warn set ... [ 729.882891] [ 729.890274] CPU: 0 PID: 23450 Comm: syz-executor1 Tainted: G B 4.19.0-rc3-next-20180912+ #72 [ 729.893529] kobject: 'loop4' (000000001649cf11): kobject_uevent_env [ 729.900144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 729.900154] Call Trace: [ 729.918488] dump_stack+0x1d3/0x2c4 [ 729.922122] ? dump_stack_print_info.cold.2+0x52/0x52 [ 729.927341] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 729.931982] kobject: 'loop4' (000000001649cf11): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 729.932127] panic+0x238/0x4e7 [ 729.944817] ? add_taint.cold.5+0x16/0x16 [ 729.949010] ? trace_hardirqs_on+0x9a/0x310 [ 729.953357] ? trace_hardirqs_on+0xb4/0x310 [ 729.957822] ? trace_hardirqs_on+0xb4/0x310 [ 729.959414] kobject: 'loop2' (00000000263795c1): kobject_uevent_env [ 729.962151] kasan_end_report+0x47/0x4f [ 729.972511] kasan_report.cold.9+0x76/0x309 [ 729.976837] ? mqueue_get_tree+0x2a2/0x2e0 [ 729.981162] __asan_report_load8_noabort+0x14/0x20 [ 729.985605] kobject: 'loop2' (00000000263795c1): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 729.986105] mqueue_get_tree+0x2a2/0x2e0 [ 729.999596] vfs_get_tree+0x1cb/0x5c0 [ 730.003466] mq_create_mount+0xe3/0x190 [ 730.007480] mq_init_ns+0x15a/0x210 [ 730.011110] copy_ipcs+0x3d2/0x580 [ 730.012798] kobject: 'loop0' (00000000b0e897ff): kobject_uevent_env [ 730.014652] ? ipcns_get+0xe0/0xe0 [ 730.014668] ? do_mount+0x1db0/0x1db0 [ 730.014681] ? kmem_cache_alloc+0x33a/0x730 [ 730.014702] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 730.021282] kobject: 'loop0' (00000000b0e897ff): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 730.024633] ? perf_event_namespaces+0x136/0x400 [ 730.024651] create_new_namespaces+0x376/0x900 [ 730.024669] ? sys_ni_syscall+0x20/0x20 [ 730.061077] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 730.066654] ? ns_capable_common+0x13f/0x170 [ 730.071113] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 730.076044] ksys_unshare+0x79c/0x10b0 [ 730.079934] ? walk_process_tree+0x440/0x440 [ 730.084341] ? lock_downgrade+0x900/0x900 [ 730.088489] ? kasan_check_read+0x11/0x20 [ 730.092639] ? do_raw_spin_unlock+0xa7/0x2f0 [ 730.097040] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 730.101630] ? kasan_check_write+0x14/0x20 [ 730.105870] ? do_raw_read_unlock+0x3f/0x60 [ 730.110192] ? do_syscall_64+0x9a/0x820 [ 730.114160] ? do_syscall_64+0x9a/0x820 [ 730.118135] ? lockdep_hardirqs_on+0x421/0x5c0 [ 730.122715] ? trace_hardirqs_on+0xbd/0x310 [ 730.127043] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 730.132411] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 730.137859] ? __ia32_sys_prlimit64+0x8c0/0x8c0 [ 730.142529] __x64_sys_unshare+0x31/0x40 [ 730.146594] do_syscall_64+0x1b9/0x820 [ 730.150485] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 730.155843] ? syscall_return_slowpath+0x5e0/0x5e0 [ 730.160770] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 730.165609] ? trace_hardirqs_on_caller+0x310/0x310 [ 730.170620] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 730.175635] ? prepare_exit_to_usermode+0x291/0x3b0 [ 730.180651] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 730.185493] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 730.190677] RIP: 0033:0x459d87 [ 730.193871] Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 3d 8a fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 1d 8a fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 730.212771] RSP: 002b:00007fff3f284358 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 730.220475] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459d87 [ 730.227746] RDX: 0000000000000000 RSI: 00007fff3f284360 RDI: 0000000008000000 [ 730.235012] RBP: 0000000000930b28 R08: 0000000000000000 R09: 0000000000000018 [ 730.242275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000010 [ 730.249551] R13: 0000000000412cc0 R14: 0000000000000000 R15: 0000000000000000 [ 730.257782] Kernel Offset: disabled [ 730.261424] Rebooting in 86400 seconds..