ffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:19 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup3(r2, r0, 0x0) [ 623.398786] binder: 20209:20210 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 623.406306] binder: 20209:20210 ioctl c0306201 20008fd0 returned -14 19:28:19 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_nanosleep(0x0, 0x0, &(0x7f0000000580), 0x0) r0 = gettid() dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 19:28:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 623.674223] binder: 20223:20225 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 623.681918] binder: 20223:20225 ioctl c0306201 20008fd0 returned -14 19:28:22 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) tkill(r0, 0x15) 19:28:22 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:22 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup3(r2, r0, 0x0) 19:28:22 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_nanosleep(0x0, 0x0, &(0x7f0000000580), 0x0) r0 = gettid() dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r0, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 19:28:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:22 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0, 0x20}, {0xffffffffffffffff, 0x8006}], 0x5, 0x0, 0x0, 0x0) 19:28:22 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400380, 0x0) ioctl$KVM_S390_VCPU_FAULT(r1, 0x4008ae52, &(0x7f0000000040)=0x7fffffff) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000240)=0x0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000280)=r2) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r3 = gettid() dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000016) tkill(r3, 0x32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r6, 0x502, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x3fc40995938c3faa) 19:28:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:22 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:22 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:28:22 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = socket$bt_rfcomm(0x1f, 0x3, 0x3) dup(r2) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 19:28:22 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:25 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:25 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:25 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0, 0x20}, {0xffffffffffffffff, 0x8006}], 0x5, 0x0, 0x0, 0x0) 19:28:25 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:28:25 executing program 4: r0 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x1, 0x24000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r1+10000000}, 0x0) r2 = gettid() syz_kvm_setup_cpu$x86(r0, r0, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, &(0x7f00000001c0)="0fc71d66b9a60300000f32db9f8d0dbaf80c66b89e87ae8466efbafc0ced0f014877f08087a400720f20620f78312b270f60a20400", 0x35}], 0x1, 0x40, &(0x7f0000000240), 0x0) r3 = dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_REGISTER(r3, 0x400c4301, &(0x7f0000000000)={0x1, 0xffff, 0x80}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) rseq(&(0x7f0000000180)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x1, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 19:28:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:25 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 629.599417] binder: 20295:20296 Acquire 1 refcount change on invalid ref 0 ret -22 [ 629.625123] binder: 20295:20296 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 629.632632] binder: 20295:20296 ioctl c0306201 20008fd0 returned -14 19:28:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:25 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 629.749388] binder: 20300:20301 Acquire 1 refcount change on invalid ref 0 ret -22 [ 629.783035] binder: 20300:20301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 629.790253] binder: 20300:20301 ioctl c0306201 20008fd0 returned -14 19:28:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:26 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = dup(0xffffffffffffffff) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000000000)=0x800) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) [ 630.026781] binder: 20307:20309 Acquire 1 refcount change on invalid ref 0 ret -22 [ 630.065831] binder: 20307:20309 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 630.073412] binder: 20307:20309 ioctl c0306201 20008fd0 returned -14 19:28:28 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:28 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:28 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:28 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:28:28 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0, 0x20}, {r0}], 0x5, 0x0, 0x0, 0x0) 19:28:28 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_smack_transmute(r2, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000040)='TRUE', 0x4, 0x2) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 19:28:28 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:28 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:28 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:28 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:29 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:29 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:31 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:31 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:31 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pkey_alloc(0x0, 0x1) tkill(r1, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$PPPIOCGNPMODE(r2, 0xc008744c, &(0x7f0000000040)={0x2d, 0x2}) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) 19:28:31 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:31 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:31 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0, 0x20}, {r0}], 0x5, 0x0, 0x0, 0x0) 19:28:31 executing program 3: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:31 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:31 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:32 executing program 3: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:32 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 636.186330] binder: 20390:20391 Acquire 1 refcount change on invalid ref 0 ret -22 [ 636.214538] binder: 20390:20391 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 636.222019] binder: 20390:20391 ioctl c0306201 20008fd0 returned -14 19:28:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:34 executing program 4: clock_gettime(0x0, &(0x7f00000005c0)) clock_nanosleep(0x3, 0xfffffffffffffffc, &(0x7f0000000000)={0x77359400}, 0x0) r0 = gettid() r1 = dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000040)) ioctl$KVM_SET_SIGNAL_MASK(r1, 0x4004ae8b, &(0x7f0000000100)={0x4f, "192d413081c1bf49bd76162342c2f7070f1f1c4114b0a2cbc7bb8f86149b98600c0430a05f3ad80f07563bdd6feb33c5ca68170bc7d1f66222c68dd4f88e04bd16d90db18d94a35c47c14a932ef465"}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 19:28:34 executing program 3: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:34 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:34 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:34 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0, 0x20}, {r0}], 0x5, 0x0, 0x0, 0x0) [ 638.806538] binder: 20403:20413 Acquire 1 refcount change on invalid ref 0 ret -22 19:28:34 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 638.866965] binder: 20403:20414 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 638.874477] binder: 20403:20414 ioctl c0306201 20008fd0 returned -14 19:28:35 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:35 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:35 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 639.135523] binder: 20422:20425 Acquire 1 refcount change on invalid ref 0 ret -22 [ 639.179094] binder: 20422:20425 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 639.186635] binder: 20422:20425 ioctl c0306201 20008fd0 returned -14 19:28:35 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:35 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x6) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, r0, 0x0) [ 639.420584] binder: 20432:20433 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 639.428069] binder: 20432:20433 ioctl c0306201 20008fd0 returned -14 19:28:37 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket(0x0, 0x2, 0x7) 19:28:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:37 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x6) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, r0, 0x0) 19:28:37 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:37 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:37 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0, 0x8006}], 0x4, 0x0, 0x0, 0x0) 19:28:37 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {0xffffffffffffffff, 0x8006}], 0x4, 0x0, 0x0, 0x0) [ 641.896985] binder: 20447:20457 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 641.904428] binder: 20447:20457 ioctl c0306201 20008fd0 returned -14 19:28:38 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x6) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, r0, 0x0) 19:28:38 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:38 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:38 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:38 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() socket$caif_seqpacket(0x25, 0x5, 0x1) pipe2(&(0x7f0000000100), 0x800) openat$userio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/userio\x00', 0x4040, 0x0) r2 = eventfd(0x10000) dup(r2) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) tkill(r1, 0x18) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000000)) 19:28:38 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 642.449579] binder: 20474:20481 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 642.457141] binder: 20474:20481 ioctl c0306201 20008fd0 returned -14 19:28:38 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:38 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:38 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 642.825587] binder: 20494:20499 ioctl c0306201 0 returned -14 [ 642.883125] binder: 20494:20499 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 642.890416] binder: 20494:20499 ioctl c0306201 20008fd0 returned -14 19:28:39 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {0xffffffffffffffff, 0x8006}], 0x4, 0x0, 0x0, 0x0) 19:28:39 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000000)=0x7, 0x4) tkill(r1, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 19:28:39 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:39 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:39 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:39 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 643.269725] binder: 20515:20517 ioctl c0306201 0 returned -14 19:28:39 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 643.314379] binder: 20515:20517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 643.321978] binder: 20515:20517 ioctl c0306201 20008fd0 returned -14 19:28:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:39 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:39 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) setsockopt$sock_void(r2, 0x1, 0x24, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r4 = dup(r3) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000000)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000040)={0x1ff, 0x3f, 0x8009, 0x2c, 0x8, 0x9, 0x1000, 0xa76, 0x0}, &(0x7f0000000100)=0x20) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000140)={r5, 0x0, 0x4ddb8cc0, 0xffffffffffffff8a, 0x7, 0x4}, &(0x7f0000000180)=0x14) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 19:28:39 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 643.747989] binder: 20529:20534 ioctl c0306201 0 returned -14 [ 643.787027] binder: 20529:20534 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 643.794598] binder: 20529:20534 ioctl c0306201 20008fd0 returned -14 19:28:40 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {0xffffffffffffffff, 0x8006}], 0x4, 0x0, 0x0, 0x0) 19:28:40 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:40 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:40 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 644.134102] binder: 20546:20554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 644.141466] binder: 20546:20554 ioctl c0306201 20008fd0 returned -14 19:28:40 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:40 executing program 1: r0 = gettid() close(0xffffffffffffffff) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:40 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:40 executing program 1: r0 = gettid() close(0xffffffffffffffff) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 644.463599] binder: 20564:20566 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 644.471046] binder: 20564:20566 ioctl c0306201 20008fd0 returned -14 19:28:40 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x400080000000000, 0x1, 0xcc3, 0xbb0, 0x90}, &(0x7f0000000000)=0x98) ioctl$DRM_IOCTL_SET_MASTER(r2, 0x641e) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000040)={0x8, 0x2, 0x8, 0x5, 0x4, 0x5, 0xffffffff7fffffff, 0x7, r3}, &(0x7f00000001c0)=0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000000280)=0xb96) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r5 = dup(r4) accept4$inet(r2, &(0x7f0000000200), &(0x7f0000000240)=0x10, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x101) 19:28:40 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:40 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0}], 0x4, 0x0, 0x0, 0x0) 19:28:40 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x4, 0x0, 0x6) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, 0xffffffffffffffff, 0x0) 19:28:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:40 executing program 1: r0 = gettid() close(0xffffffffffffffff) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(0xffffffffffffffff, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:40 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 645.023123] binder: 20584:20592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 645.030346] binder: 20584:20592 ioctl c0306201 20008fd0 returned -14 19:28:41 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r0, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x15) 19:28:41 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x4, 0x0, 0x6) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, 0xffffffffffffffff, 0x0) 19:28:41 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 645.438621] binder: 20601:20605 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 645.446207] binder: 20601:20605 ioctl c0306201 20008fd0 returned -14 19:28:41 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x4, 0x0, 0x6) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, 0xffffffffffffffff, 0x0) 19:28:41 executing program 4: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x18200, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x776) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x200000000000001, &(0x7f0000000180)={0x0, 0x0}) syz_genetlink_get_family_id$net_dm(&(0x7f00000001c0)='NET_DM\x00') clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r1+10000000}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r2 = gettid() epoll_create1(0x80000) r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = dup(r3) socket$rds(0x15, 0x5, 0x0) fstat(r4, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) 19:28:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 645.845789] binder: 20614:20618 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 645.853658] binder: 20614:20618 ioctl c0306201 20008fd0 returned -14 19:28:41 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0}], 0x4, 0x0, 0x0, 0x0) 19:28:41 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:41 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:42 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:42 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r0, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x15) 19:28:42 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 646.161080] binder: 20629:20630 ioctl c0306201 20008fd0 returned -14 19:28:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:42 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:42 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(0xffffffffffffffff, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 646.600467] binder: 20644:20647 ioctl c0306201 20008fd0 returned -14 19:28:42 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = dup(0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000280)={0x108}, 0x4) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) accept4$unix(r2, 0x0, &(0x7f0000000000), 0x80000) tkill(r1, 0x1000000000016) timer_create(0x4, &(0x7f0000000200)={0x0, 0x36, 0x5, @thr={&(0x7f0000000040)="ac144c2a605d725a10e40512ac2be23afd9633e99d26acc5c7904df4ec2f4bc3e3049f30951899e2c728d48fa8ba93a1058d2d50a616ac05dc83756c680111", &(0x7f0000000100)="11f062f466505f9f16d54dd9ffcc9a807f015eb108b15c6fbb96a48017f18daeb65906af08da4985ba86250125e2ccae67b1ded5fa43b1302bcd2dca063a84ee6ac191d8d908b07c3f23fad0bc8497db0635eecdcc80083a5ce3ff360457c600c84f0f591f9d935d879c1393d69dc1e05bb93b21290300863b2bcf38ece32679134186fd7fd17bd85267158bf022edeff02cab479e87a21f4d7ca6da91bb0fc17865bbe6b5f8657973d1e9f25acc424678ab2749321a5a411925f5d91a5d1435bb0ed3d7401ffe273176e507805b8974082773de0c15db288507970f4c7c03acc886365a2bcfa51fba"}}, &(0x7f0000000240)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 19:28:42 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:43 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x4020}, {r0}], 0x4, 0x0, 0x0, 0x0) 19:28:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:43 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(0xffffffffffffffff, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:43 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:43 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 647.187457] binder: 20665:20666 ioctl c0306201 20008fd0 returned -14 19:28:43 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r0, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x15) 19:28:43 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(0xffffffffffffffff, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:28:43 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x10, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 647.609449] binder: 20684:20688 ioctl c0306201 20008fd0 returned -14 19:28:43 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, 0x0) 19:28:43 executing program 4: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101040, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r1+10000000}, 0x0) r2 = gettid() ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000240)={&(0x7f0000000140)=[0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x2, 0x5, 0x2, 0x6}) ioctl$VIDIOC_S_MODULATOR(r0, 0x40445637, &(0x7f00000002c0)={0x6, "3ede77ef3eb2195f9d94283c72f46b21b1f45aa7fa8e890c7bb8527c42c6886e", 0x600, 0x6, 0x5, 0x10}) r3 = dup(0xffffffffffffffff) fcntl$setstatus(r3, 0x4, 0x40000) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040), &(0x7f0000000100)=0x4) tkill(r2, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) r5 = dup(r4) timerfd_gettime(r5, &(0x7f0000000280)) ioctl$KVM_GET_NESTED_STATE(r3, 0xc080aebe, &(0x7f0000000600)={0x0, 0x0, 0x2080}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 19:28:43 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x10, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:44 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0, 0x8006}], 0x3, 0x0, 0x0, 0x0) 19:28:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:44 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, 0x0) 19:28:44 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x10, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 648.158483] binder: 20706:20707 ioctl c0306201 20008fd0 returned -14 19:28:44 executing program 4: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12}, &(0x7f00009b1ffc)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000580)={0x0, r0+10000000}, 0x0) r1 = gettid() r2 = dup(0xffffffffffffffff) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000016) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, 0x0, 0xfffffffffffffec9) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000140)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in6=@mcast2}}, &(0x7f0000000240)=0xe8) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000280)={@dev={0xfe, 0x80, [], 0x14}, 0x6a, r4}) r5 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) 19:28:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:44 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x0, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:44 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:44 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, 0x0) 19:28:44 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {0xffffffffffffffff, 0x8006}], 0x3, 0x0, 0x0, 0x0) [ 648.647934] binder: 20728:20733 ioctl c0306201 20008fd0 returned -14 19:28:44 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:44 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0x0, 0x0, [0x70a000]}) 19:28:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:45 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 649.008720] binder: 20744:20748 ioctl c0306201 20008fd0 returned -14 19:28:45 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x0, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:45 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0x0, 0x0, [0x70a000]}) 19:28:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000e40)={0x0, {0x2, 0x0, @remote}, {0x2, 0x0, @local}, {0x2, 0x4e22, @local}, 0x2, 0x0, 0x0, 0x0, 0x45}) openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x8000000000001, 0x70, 0x0, 0x100, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000440)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0x40c392f5) r1 = dup2(r0, r0) sendmsg$alg(r1, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000000)="a7ceec29", 0x4}, {0x0}], 0x2}, 0x8005) write$P9_RATTACH(r1, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xfffffdef, 0x0, 0x0, 0x0) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, &(0x7f0000000400)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000140)) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001880)=""/190, 0xbe}], 0x1}}], 0x400000000000098, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/snmp\x00') socketpair(0x3, 0x6, 0x20000000, 0x0) statx(r2, &(0x7f0000000080)='./file0\x00', 0x400, 0x7ff, &(0x7f00000001c0)) 19:28:45 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 649.473213] binder: 20763:20767 ioctl c0306201 20008fd0 returned -14 19:28:45 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x0, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:45 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {0xffffffffffffffff, 0x8006}], 0x3, 0x0, 0x0, 0x0) 19:28:45 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0x0, 0x0, [0x70a000]}) 19:28:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:45 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 649.913100] binder: 20789:20791 ioctl c0306201 20008fd0 returned -14 19:28:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:46 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(0xffffffffffffffff) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:46 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:46 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3}) [ 650.183927] binder: 20794:20799 ioctl c0306201 20008fd0 returned -14 19:28:46 executing program 4: openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x401000000001, 0x0) close(r1) r2 = socket$netlink(0x10, 0x3, 0xa) r3 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) ftruncate(r0, 0x4820f) connect$netlink(r2, &(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) 19:28:46 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:46 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(0xffffffffffffffff) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 650.597722] binder: 20812:20814 ioctl c0306201 20008fd0 returned -14 19:28:46 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {0xffffffffffffffff, 0x8006}], 0x3, 0x0, 0x0, 0x0) 19:28:46 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3}) 19:28:46 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:46 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(0xffffffffffffffff) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:47 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3}) 19:28:47 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 651.089081] binder: 20832:20841 ioctl c0306201 20008fd0 returned -14 19:28:47 executing program 4: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x401000000001, 0x0) close(r1) r2 = socket$netlink(0x10, 0x3, 0xa) r3 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) ftruncate(r0, 0x4820f) connect$netlink(r2, &(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) 19:28:47 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:47 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:47 executing program 3: syncfs(0xffffffffffffffff) sendmsg(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x401000000001, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r0, r2, 0x0, 0x8000fffffffe) connect$netlink(r1, &(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) [ 651.445878] binder: 20848:20850 ioctl c0306201 20008fd0 returned -14 19:28:47 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0}], 0x3, 0x0, 0x0, 0x0) 19:28:47 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:47 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 651.840823] binder: 20863:20865 ioctl c0306201 20008fd0 returned -14 19:28:48 executing program 4: ioctl$RTC_WIE_ON(0xffffffffffffffff, 0x700f) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x401000000001, 0x0) close(r1) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) ftruncate(r0, 0x4820f) connect$netlink(r2, &(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) 19:28:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:48 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(0x0, 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:48 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:48 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 652.270502] binder: 20881:20883 ioctl c0306201 20008fd0 returned -14 19:28:48 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:48 executing program 3: [ 652.670082] binder: 20895:20897 ioctl c0306201 20008fd0 returned -14 19:28:48 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0}], 0x3, 0x0, 0x0, 0x0) 19:28:48 executing program 4: syncfs(0xffffffffffffffff) sendmsg(0xffffffffffffffff, 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x401000000001, 0x0) close(r1) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) ftruncate(r0, 0x4820f) connect$netlink(r2, &(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) 19:28:48 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:48 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:48 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:49 executing program 3: 19:28:49 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:49 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:49 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:49 executing program 3: 19:28:49 executing program 4: 19:28:49 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}, {r0}], 0x3, 0x0, 0x0, 0x0) 19:28:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:49 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:49 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:49 executing program 3: 19:28:49 executing program 4: 19:28:49 executing program 3: 19:28:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:50 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:50 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:50 executing program 4: 19:28:50 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x0, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:50 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0, 0x8006}], 0x2, 0x0, 0x0, 0x0) 19:28:50 executing program 3: 19:28:50 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:50 executing program 4: 19:28:50 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x0, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 19:28:50 executing program 3: [ 654.788525] binder: 20971:20977 ioctl c0306201 0 returned -14 19:28:50 executing program 4: 19:28:51 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x0, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:51 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:51 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {0xffffffffffffffff, 0x8006}], 0x2, 0x0, 0x0, 0x0) 19:28:51 executing program 3: 19:28:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 19:28:51 executing program 4: 19:28:51 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 655.335924] binder: 20997:20998 ioctl c0306201 0 returned -14 19:28:51 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:51 executing program 3: 19:28:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 19:28:51 executing program 4: 19:28:51 executing program 3: 19:28:51 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:51 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(0xffffffffffffffff, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 655.797409] binder: 21010:21013 ioctl c0306201 0 returned -14 19:28:52 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {0xffffffffffffffff, 0x8006}], 0x2, 0x0, 0x0, 0x0) 19:28:52 executing program 4: 19:28:52 executing program 3: 19:28:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 19:28:52 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:52 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(0xffffffffffffffff, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 19:28:52 executing program 4: 19:28:52 executing program 3: 19:28:52 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:52 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(0xffffffffffffffff, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:52 executing program 3: 19:28:53 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {0xffffffffffffffff, 0x8006}], 0x2, 0x0, 0x0, 0x0) 19:28:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 19:28:53 executing program 4: 19:28:53 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:53 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:53 executing program 3: 19:28:53 executing program 3: 19:28:53 executing program 4: 19:28:53 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) 19:28:53 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:53 executing program 3: 19:28:54 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}], 0x2, 0x0, 0x0, 0x0) 19:28:54 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:54 executing program 4: 19:28:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) 19:28:54 executing program 3: 19:28:54 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:54 executing program 3: 19:28:54 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:54 executing program 4: 19:28:54 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) 19:28:54 executing program 4: 19:28:54 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}], 0x2, 0x0, 0x0, 0x0) 19:28:54 executing program 3: 19:28:54 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:54 executing program 4: 19:28:54 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:54 executing program 0: 19:28:55 executing program 4: 19:28:55 executing program 3: 19:28:55 executing program 0: 19:28:55 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:55 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:55 executing program 3: 19:28:55 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x20}, {r0}], 0x2, 0x0, 0x0, 0x0) 19:28:55 executing program 4: 19:28:55 executing program 0: 19:28:55 executing program 3: 19:28:55 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:56 executing program 3: 19:28:56 executing program 4: 19:28:56 executing program 0: 19:28:56 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:56 executing program 3: 19:28:56 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:56 executing program 4: 19:28:56 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:28:56 executing program 0: 19:28:56 executing program 3: 19:28:56 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, 0x0, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:56 executing program 4: 19:28:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0xa01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) write$cgroup_subtree(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="ff038aa174032dd7e08f93dd86dd60df0061000089ffe548ee93ffff00dc890af53020c7e083ffdb000037d6db6e6806b468412bcfe7"], 0x36) 19:28:57 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg$kcm(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="230000001e0081aee405dc09000f00fe070101000000000063dac37b7403242189c609", 0x23}], 0x1}, 0x0) 19:28:57 executing program 3: r0 = socket$kcm(0xa, 0x802, 0x88) sendmsg$kcm(r0, &(0x7f0000000240)={&(0x7f0000000080)=@in6={0xa, 0x4e24, 0x0, @mcast2}, 0x80, 0x0}, 0x8000) sendmsg$kcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000200)="3218e34aee85e2361a5e54c3022748de84fbfb92dbdb130f0cadcfeb84f6dc4eeb20acf45126e0fa3a55ef2830db0e5efe93bdf7fa3a34b71b", 0x39}], 0x1}, 0x0) 19:28:57 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:28:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20004004, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) 19:28:57 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:28:57 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{0xffffffffffffffff, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 661.297952] netlink: 3 bytes leftover after parsing attributes in process `syz-executor.0'. [ 661.311500] netlink: 3 bytes leftover after parsing attributes in process `syz-executor.0'. [ 661.386596] netlink: 3 bytes leftover after parsing attributes in process `syz-executor.0'. [ 661.421666] netlink: 3 bytes leftover after parsing attributes in process `syz-executor.0'. 19:28:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) bind$alg(r1, &(0x7f0000000940)={0x26, 'hash\x00', 0x0, 0x0, 'vmac64(aes-generic)\x00'}, 0x58) 19:28:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:28:57 executing program 3 (fault-call:7 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 661.683640] binder: BINDER_SET_CONTEXT_MGR already set [ 661.689226] binder: 21234:21236 ioctl 40046207 0 returned -16 [ 661.698259] FAULT_INJECTION: forcing a failure. [ 661.698259] name failslab, interval 1, probability 0, space 0, times 0 [ 661.703438] binder_thread_write: 1 callbacks suppressed [ 661.703466] binder: 21234:21236 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 661.710064] CPU: 0 PID: 21233 Comm: syz-executor.3 Not tainted 5.1.0-rc2+ #24 [ 661.715453] binder: 21234:21236 ioctl c0306201 20008fd0 returned -14 [ 661.727827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 661.727845] Call Trace: [ 661.727916] dump_stack+0x173/0x1d0 [ 661.727970] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 661.728024] should_fail+0xa19/0xb20 [ 661.766532] __should_failslab+0x266/0x290 [ 661.770864] should_failslab+0x29/0x70 [ 661.774817] kmem_cache_alloc_trace+0x125/0xb50 [ 661.779639] ? binder_ioctl_write_read+0x12e0/0x1aaf0 [ 661.784909] ? kmsan_internal_memset_shadow+0x104/0x3a0 [ 661.790359] binder_ioctl_write_read+0x12e0/0x1aaf0 [ 661.795460] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 661.800726] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 661.806179] ? __msan_poison_alloca+0x1e0/0x290 [ 661.811111] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 661.816540] ? binder_poll+0xbd0/0xbd0 [ 661.820536] ? do_vfs_ioctl+0xebd/0x2bf0 [ 661.824694] ? binder_poll+0xbd0/0xbd0 [ 661.828662] binder_ioctl+0x74e/0x2490 [ 661.832653] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 661.837933] ? do_vfs_ioctl+0x187/0x2bf0 [ 661.842074] ? __se_sys_ioctl+0x1da/0x270 [ 661.846289] ? binder_poll+0xbd0/0xbd0 [ 661.850243] do_vfs_ioctl+0xebd/0x2bf0 [ 661.854234] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 661.859589] ? security_file_ioctl+0x92/0x200 [ 661.864160] __se_sys_ioctl+0x1da/0x270 [ 661.868204] __x64_sys_ioctl+0x4a/0x70 [ 661.872164] do_syscall_64+0xbc/0xf0 [ 661.875959] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 661.881286] RIP: 0033:0x4582b9 [ 661.884554] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 661.903516] RSP: 002b:00007f44c9fc6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 661.911407] RAX: ffffffffffffffda RBX: 00007f44c9fc6c90 RCX: 00000000004582b9 [ 661.918839] RDX: 0000000020008fd0 RSI: 00000000c0306201 RDI: 0000000000000004 [ 661.926161] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 19:28:57 executing program 4 (fault-call:5 fault-nth:0): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 661.933476] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f44c9fc76d4 [ 661.940881] R13: 00000000004bf54b R14: 00000000004d12f8 R15: 0000000000000003 [ 661.948991] binder: 21232:21233 BC_REQUEST_DEATH_NOTIFICATION failed [ 661.955659] binder: 21232:21233 ioctl c0306201 20008fd0 returned -14 [ 662.025307] FAULT_INJECTION: forcing a failure. [ 662.025307] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 662.037402] CPU: 0 PID: 21240 Comm: syz-executor.4 Not tainted 5.1.0-rc2+ #24 [ 662.044735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 662.054144] Call Trace: [ 662.056808] dump_stack+0x173/0x1d0 [ 662.060529] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.065816] should_fail+0xa19/0xb20 [ 662.069656] should_fail_alloc_page+0x1fe/0x270 [ 662.074786] __alloc_pages_nodemask+0x4a2/0x5e90 [ 662.079821] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 662.085355] ? __module_address+0x6a/0x5e0 [ 662.089702] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 662.095145] ? is_bpf_text_address+0x47e/0x4b0 [ 662.100102] ? __kernel_text_address+0x250/0x350 [ 662.104956] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.105724] binder: undelivered TRANSACTION_ERROR: 2147774976 [ 662.110209] ? alloc_pages_vma+0x108/0x1970 [ 662.110261] ? wp_page_copy+0x53b/0x2860 [ 662.110317] alloc_pages_vma+0xd26/0x1970 [ 662.110391] wp_page_copy+0x53b/0x2860 [ 662.110452] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 662.110503] ? reuse_swap_page+0x1147/0x1e90 [ 662.110577] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.148059] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.153335] do_wp_page+0x21f2/0x3970 [ 662.157216] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.162696] handle_mm_fault+0x4c5e/0xa4d0 [ 662.167068] __do_page_fault+0xdfd/0x1800 [ 662.171323] do_page_fault+0xe9/0x5c0 [ 662.175214] ? kmsan_unpoison_pt_regs+0x2a/0x30 [ 662.179961] ? page_fault+0x2b/0x50 [ 662.183665] page_fault+0x3d/0x50 [ 662.187198] RIP: 0010:copy_user_generic_unrolled+0xa0/0xc0 [ 662.193061] Code: 7f 40 ff c9 75 b6 89 d1 83 e2 07 c1 e9 03 74 12 4c 8b 06 4c 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 89 d1 8a 06 <88> 07 48 ff c6 48 ff c7 ff c9 75 f2 31 c0 0f 1f 00 c3 0f 1f 40 00 [ 662.212130] RSP: 0018:ffff8881e747fa78 EFLAGS: 00010202 [ 662.217572] RAX: ffffffff84906401 RBX: ffff888076136390 RCX: 0000000000000002 [ 662.224913] RDX: 0000000000000002 RSI: ffff8881e747fba0 RDI: 000000000070a000 [ 662.232239] RBP: ffff8881e747fae8 R08: ffff8880f6137458 R09: 0000778000000000 [ 662.239565] R10: ffffd0ffffffffff R11: ffff888076137460 R12: 0000000000000002 [ 662.246888] R13: ffff8881e747fba0 R14: ffff8881e747fa80 R15: 000000000070a000 [ 662.254244] ? _copy_to_user+0x41/0x1f0 [ 662.258290] ? _copy_to_user+0x113/0x1f0 [ 662.262424] kvm_arch_vcpu_ioctl+0x3a31/0x7810 [ 662.267083] ? kmsan_internal_memset_shadow+0x104/0x3a0 [ 662.272519] ? kmsan_internal_memset_shadow+0x104/0x3a0 [ 662.277991] ? mutex_lock_killable+0x92/0x130 [ 662.282556] kvm_vcpu_ioctl+0xc6d/0x1d20 [ 662.286683] ? kvm_vm_release+0x90/0x90 [ 662.290726] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.295972] ? do_vfs_ioctl+0x187/0x2bf0 [ 662.300099] ? __se_sys_ioctl+0x1da/0x270 [ 662.304311] ? kvm_vm_release+0x90/0x90 [ 662.308370] do_vfs_ioctl+0xebd/0x2bf0 [ 662.312773] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.318029] ? security_file_ioctl+0x92/0x200 [ 662.322605] __se_sys_ioctl+0x1da/0x270 [ 662.326665] __x64_sys_ioctl+0x4a/0x70 [ 662.330620] do_syscall_64+0xbc/0xf0 [ 662.334397] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 662.339638] RIP: 0033:0x4582b9 [ 662.342891] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 662.362028] RSP: 002b:00007f656cedfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 662.369803] RAX: ffffffffffffffda RBX: 00007f656cedfc90 RCX: 00000000004582b9 19:28:58 executing program 3 (fault-call:7 fault-nth:1): r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 662.377158] RDX: 00000000200004c0 RSI: 000000004068aea3 RDI: 0000000000000007 [ 662.384576] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 662.392010] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f656cee06d4 [ 662.399623] R13: 00000000004c0dce R14: 00000000004d2ff0 R15: 0000000000000008 19:28:58 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) [ 662.473950] binder: 21245:21246 ioctl c0306201 20008fd0 returned -14 19:28:58 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{0xffffffffffffffff, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:28:58 executing program 4 (fault-call:5 fault-nth:1): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 662.821660] FAULT_INJECTION: forcing a failure. [ 662.821660] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 662.833526] CPU: 0 PID: 21267 Comm: syz-executor.4 Not tainted 5.1.0-rc2+ #24 [ 662.840813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 662.850164] Call Trace: [ 662.852788] dump_stack+0x173/0x1d0 [ 662.856451] should_fail+0xa19/0xb20 [ 662.860204] should_fail_alloc_page+0x1fe/0x270 [ 662.864917] __alloc_pages_nodemask+0x4a2/0x5e90 [ 662.869724] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.874965] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.880201] ? prep_new_page+0x70a/0x860 [ 662.884292] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.889583] kmsan_internal_alloc_meta_for_pages+0x88/0x500 [ 662.895341] kmsan_alloc_page+0x7e/0x100 [ 662.899442] __alloc_pages_nodemask+0x12fb/0x5e90 [ 662.904325] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 662.909709] ? __module_address+0x6a/0x5e0 [ 662.913978] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 662.919380] ? is_bpf_text_address+0x47e/0x4b0 [ 662.924014] ? __kernel_text_address+0x250/0x350 [ 662.928815] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.934038] ? alloc_pages_vma+0x108/0x1970 [ 662.938376] ? wp_page_copy+0x53b/0x2860 [ 662.942460] alloc_pages_vma+0xd26/0x1970 [ 662.946660] wp_page_copy+0x53b/0x2860 [ 662.950594] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 662.956240] ? reuse_swap_page+0x1147/0x1e90 [ 662.960688] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.965920] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 662.971140] do_wp_page+0x21f2/0x3970 [ 662.974987] handle_mm_fault+0x4c5e/0xa4d0 [ 662.979303] __do_page_fault+0xdfd/0x1800 [ 662.983488] do_page_fault+0xe9/0x5c0 [ 662.987295] ? kmsan_unpoison_pt_regs+0x2a/0x30 [ 662.991976] ? page_fault+0x2b/0x50 [ 662.995637] page_fault+0x3d/0x50 [ 662.999117] RIP: 0010:copy_user_generic_unrolled+0xa0/0xc0 [ 663.004773] Code: 7f 40 ff c9 75 b6 89 d1 83 e2 07 c1 e9 03 74 12 4c 8b 06 4c 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 89 d1 8a 06 <88> 07 48 ff c6 48 ff c7 ff c9 75 f2 31 c0 0f 1f 00 c3 0f 1f 40 00 [ 663.023700] RSP: 0018:ffff8881e88ffa78 EFLAGS: 00010202 [ 663.029099] RAX: ffffffff84906401 RBX: ffff888076130990 RCX: 0000000000000002 [ 663.036369] RDX: 0000000000000002 RSI: ffff8881e88ffba0 RDI: 000000000070a000 [ 663.043658] RBP: ffff8881e88ffae8 R08: ffff8880f6131a58 R09: 0000778000000000 [ 663.050940] R10: ffffd0ffffffffff R11: ffff888076131a60 R12: 0000000000000002 [ 663.058735] R13: ffff8881e88ffba0 R14: ffff8881e88ffa80 R15: 000000000070a000 [ 663.066043] ? _copy_to_user+0x41/0x1f0 [ 663.070068] ? _copy_to_user+0x113/0x1f0 [ 663.075123] kvm_arch_vcpu_ioctl+0x3a31/0x7810 [ 663.080221] ? kmsan_internal_memset_shadow+0x104/0x3a0 [ 663.086569] ? kmsan_internal_memset_shadow+0x104/0x3a0 [ 663.092439] ? mutex_lock_killable+0x92/0x130 [ 663.097000] kvm_vcpu_ioctl+0xc6d/0x1d20 [ 663.101089] ? kvm_vm_release+0x90/0x90 [ 663.105061] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 663.110268] ? do_vfs_ioctl+0x187/0x2bf0 [ 663.114347] ? __se_sys_ioctl+0x1da/0x270 [ 663.121110] ? kvm_vm_release+0x90/0x90 [ 663.125221] do_vfs_ioctl+0xebd/0x2bf0 [ 663.129693] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 663.134921] ? security_file_ioctl+0x92/0x200 [ 663.139444] __se_sys_ioctl+0x1da/0x270 [ 663.143446] __x64_sys_ioctl+0x4a/0x70 [ 663.147448] do_syscall_64+0xbc/0xf0 [ 663.151436] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 663.156654] RIP: 0033:0x4582b9 [ 663.159978] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 663.179077] RSP: 002b:00007f656cedfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 663.186807] RAX: ffffffffffffffda RBX: 00007f656cedfc90 RCX: 00000000004582b9 [ 663.194083] RDX: 00000000200004c0 RSI: 000000004068aea3 RDI: 0000000000000007 [ 663.201554] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 663.209931] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f656cee06d4 [ 663.217201] R13: 00000000004c0dce R14: 00000000004d2ff0 R15: 0000000000000008 19:29:00 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:00 executing program 3: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'bcsf0\x00', 0x2}) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r0, 0x80045301, &(0x7f00000000c0)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000080)={0xbf0000, 0x3, 0xffffffff, [], &(0x7f0000000040)={0x9a091f, 0x4c4, [], @value=0x2}}) close(r1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xd) ioctl$TIOCSETD(r0, 0x541b, 0x0) 19:29:00 executing program 4 (fault-call:5 fault-nth:2): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:00 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:29:00 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{0xffffffffffffffff, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 664.386680] binder: 21276:21281 ioctl c0306201 20008fd0 returned -14 [ 664.395174] FAULT_INJECTION: forcing a failure. [ 664.395174] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 664.407046] CPU: 1 PID: 21279 Comm: syz-executor.4 Not tainted 5.1.0-rc2+ #24 [ 664.414511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 664.423991] Call Trace: [ 664.426614] dump_stack+0x173/0x1d0 [ 664.430275] should_fail+0xa19/0xb20 [ 664.434031] should_fail_alloc_page+0x1fe/0x270 [ 664.438731] __alloc_pages_nodemask+0x4a2/0x5e90 [ 664.443521] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 664.448761] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 664.454006] ? prep_new_page+0x70a/0x860 [ 664.458230] kmsan_internal_alloc_meta_for_pages+0xf2/0x500 [ 664.463970] kmsan_alloc_page+0x7e/0x100 [ 664.468060] __alloc_pages_nodemask+0x12fb/0x5e90 [ 664.472926] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 664.478310] ? __module_address+0x6a/0x5e0 [ 664.482581] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 664.487962] ? is_bpf_text_address+0x47e/0x4b0 [ 664.492592] ? __kernel_text_address+0x250/0x350 [ 664.497409] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 664.502632] ? alloc_pages_vma+0x108/0x1970 [ 664.506971] ? wp_page_copy+0x53b/0x2860 [ 664.511148] alloc_pages_vma+0xd26/0x1970 [ 664.515360] wp_page_copy+0x53b/0x2860 [ 664.519277] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 664.524747] ? reuse_swap_page+0x1147/0x1e90 [ 664.529196] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 664.534413] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 664.539632] do_wp_page+0x21f2/0x3970 [ 664.543468] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 664.548717] handle_mm_fault+0x4c5e/0xa4d0 [ 664.553043] __do_page_fault+0xdfd/0x1800 [ 664.557255] do_page_fault+0xe9/0x5c0 [ 664.561090] ? kmsan_unpoison_pt_regs+0x2a/0x30 [ 664.565795] ? page_fault+0x2b/0x50 [ 664.569880] page_fault+0x3d/0x50 [ 664.573362] RIP: 0010:copy_user_generic_unrolled+0xa0/0xc0 [ 664.579106] Code: 7f 40 ff c9 75 b6 89 d1 83 e2 07 c1 e9 03 74 12 4c 8b 06 4c 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 89 d1 8a 06 <88> 07 48 ff c6 48 ff c7 ff c9 75 f2 31 c0 0f 1f 00 c3 0f 1f 40 00 [ 664.598129] RSP: 0018:ffff8881e740fa78 EFLAGS: 00010202 [ 664.603526] RAX: ffffffff84906401 RBX: ffff888076130990 RCX: 0000000000000002 [ 664.610888] RDX: 0000000000000002 RSI: ffff8881e740fba0 RDI: 000000000070a000 [ 664.618170] RBP: ffff8881e740fae8 R08: ffff8880f6131a58 R09: 0000778000000000 [ 664.625463] R10: ffffd0ffffffffff R11: ffff888076131a60 R12: 0000000000000002 [ 664.632779] R13: ffff8881e740fba0 R14: ffff8881e740fa80 R15: 000000000070a000 [ 664.640094] ? _copy_to_user+0x41/0x1f0 [ 664.645318] ? _copy_to_user+0x113/0x1f0 [ 664.649442] kvm_arch_vcpu_ioctl+0x3a31/0x7810 [ 664.654066] ? kmsan_internal_memset_shadow+0x104/0x3a0 [ 664.659568] ? kmsan_internal_memset_shadow+0x104/0x3a0 [ 664.664985] ? mutex_lock_killable+0x92/0x130 [ 664.669506] kvm_vcpu_ioctl+0xc6d/0x1d20 [ 664.673618] ? kvm_vm_release+0x90/0x90 [ 664.677697] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 664.682914] ? do_vfs_ioctl+0x187/0x2bf0 [ 664.686993] ? __se_sys_ioctl+0x1da/0x270 [ 664.691173] ? kvm_vm_release+0x90/0x90 [ 664.695171] do_vfs_ioctl+0xebd/0x2bf0 [ 664.699096] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 664.704315] ? security_file_ioctl+0x92/0x200 [ 664.708848] __se_sys_ioctl+0x1da/0x270 [ 664.712880] __x64_sys_ioctl+0x4a/0x70 [ 664.716788] do_syscall_64+0xbc/0xf0 [ 664.720532] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 664.725758] RIP: 0033:0x4582b9 [ 664.728972] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 664.747976] RSP: 002b:00007f656cedfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 664.755884] RAX: ffffffffffffffda RBX: 00007f656cedfc90 RCX: 00000000004582b9 [ 664.763554] RDX: 00000000200004c0 RSI: 000000004068aea3 RDI: 0000000000000007 [ 664.772157] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 664.779717] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f656cee06d4 [ 664.787284] R13: 00000000004c0dce R14: 00000000004d2ff0 R15: 0000000000000008 19:29:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000002c0)={0xc2, 0x10000, 0x7, {0x5, @win={{0x1, 0x8001, 0xcf, 0x7f}, 0x3, 0x7, &(0x7f0000000100)={{0x4be, 0x1124, 0x1, 0x3}, &(0x7f00000000c0)={{0x7a547c6c, 0x7f, 0x2, 0x3}, &(0x7f0000000080)={{0x4, 0xffff, 0x3, 0x101}}}}, 0x7, &(0x7f0000000200)="0af864584daa6504322eb27eb98a609003e9e52385b401a62d44535ab5483ab23602919f3c0ad361aaa986dc84fcea4ca8d62410b41a7f8e1b462acb3aee2df496cee72adad91c6cd207a83dbd710b7723ebd03ad0004ff960d5fb6b377ec2f3b036c1aebdcba577452d7bdef38b1acafcf8eb57fff27e58b779962fe5da961b0d4c5a2a473cf479c5571107062ac6118cae54d7bb97c0e2f93805c51d99c9350784", 0x3}}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:01 executing program 4 (fault-call:5 fault-nth:3): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 664.938467] binder: 21290:21291 ioctl c0306201 20008fd0 returned -14 19:29:01 executing program 0: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x400040, 0x0) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0) fchownat(r0, &(0x7f0000000140)='./file0\x00', r1, r2, 0x1000) mkdir(&(0x7f00000000c0)='./file0/file1\x00', 0x103) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) rename(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000080)='.\x00') 19:29:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2c000, 0x0) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f0000000080)={0xff, 0x3, 0x4, 0x70000, {}, {0x5, 0x2, 0xb6, 0xd430, 0x1, 0x3, "22ddc4fa"}, 0x4, 0x3, @userptr=0x9, 0x4}) [ 665.183835] binder: 21299:21300 ioctl c0306201 20008fd0 returned -14 19:29:01 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:29:01 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0}], 0x1, 0x0, 0x0, 0x0) 19:29:03 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000002580)=[{{&(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000140)=""/180, 0xb4}, {&(0x7f0000000240)=""/213, 0xd5}, {&(0x7f0000000040)=""/9, 0x9}, {&(0x7f0000000340)=""/243, 0xf3}, {&(0x7f0000000440)=""/40, 0x28}, {&(0x7f0000000540)=""/131, 0x83}, {&(0x7f0000000480)=""/57, 0x39}, {&(0x7f0000000600)=""/6, 0x6}], 0x8, &(0x7f00000006c0)=""/233, 0xe9}, 0x3}, {{&(0x7f00000007c0)=@un=@abs, 0x80, &(0x7f0000001d00)=[{&(0x7f0000000840)=""/95, 0x5f}, {&(0x7f00000008c0)=""/240, 0xf0}, {&(0x7f00000009c0)=""/133, 0x85}, {&(0x7f0000000a80)=""/23, 0x17}, {&(0x7f0000000ac0)=""/115, 0x73}, {&(0x7f0000000b40)=""/54, 0x36}, {&(0x7f0000000b80)=""/105, 0x69}, {&(0x7f0000000c00)=""/4096, 0x1000}, {&(0x7f0000001c00)=""/117, 0x75}, {&(0x7f0000001c80)=""/122, 0x7a}], 0xa, &(0x7f0000001dc0)=""/134, 0x86}, 0x4}, {{0x0, 0x0, &(0x7f0000002040)=[{&(0x7f0000001e80)=""/225, 0xe1}, {&(0x7f0000001f80)=""/138, 0x8a}], 0x2, &(0x7f0000002080)=""/16, 0x10}, 0x4}, {{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f00000020c0)=""/220, 0xdc}, {&(0x7f00000021c0)=""/85, 0x55}, {&(0x7f0000002240)=""/242, 0xf2}, {&(0x7f0000002340)=""/66, 0x42}, {&(0x7f00000023c0)=""/198, 0xc6}], 0x5, &(0x7f0000002540)=""/15, 0xf}, 0x9}], 0x4, 0x12040, &(0x7f0000002680)) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000002700)=ANY=[@ANYBLOB="060000000000000407feb3bb69217f00bf1040582051a31b68"], 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x8000, 0x0) 19:29:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x5, 0x400400) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0xb6df, @rand_addr="7f7f404556efeca4bee4deca3a592bd4", 0x8}, 0x1c) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:03 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_buf(r0, 0x0, 0x200000000000043, &(0x7f0000000000)=""/30, &(0x7f0000001000)=0x1e) fcntl$setstatus(r0, 0x4, 0x4800) 19:29:03 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0}], 0x1, 0x0, 0x0, 0x0) 19:29:03 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xd3, 0x0, &(0x7f00000001c0)=[@acquire], 0xfffffffffffffe45, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) write$P9_RREADLINK(r3, &(0x7f0000000080)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:03 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x100, 0x1c) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f00000001c0)={0x0, 0x100, 0x197, &(0x7f0000000180)}) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmsg$rds(r1, &(0x7f0000000ec0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/60, 0x3c}], 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="bd78db3057765ab97df34e9bcab2d619c0f8d96d0ff13de9a41a8742d8f7886cbb51dbd8014bcc9bd4d59fa8d4b08cba13b48591ca0afc520dbb67"], 0x32}, 0x100080000000000) 19:29:03 executing program 4: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x10880, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000380)=0xe8) getsockname(r1, &(0x7f00000003c0)=@hci={0x1f, 0x0}, &(0x7f0000000440)=0x80) recvmmsg(r0, &(0x7f0000005500)=[{{&(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000480)=[{&(0x7f00000005c0)=""/87, 0x57}], 0x1, &(0x7f0000000640)=""/4096, 0x1000}, 0xffffffffffff8001}, {{&(0x7f0000001640)=@nfc_llcp, 0x80, &(0x7f00000019c0)=[{&(0x7f00000016c0)=""/228, 0xe4}, {&(0x7f00000017c0)=""/67, 0x43}, {&(0x7f0000001840)=""/194, 0xc2}, {&(0x7f0000001940)=""/95, 0x5f}], 0x4, &(0x7f0000001a00)=""/4096, 0x1000}, 0xfbfc}, {{&(0x7f0000002a00)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002a80)=""/93, 0x5d}, {&(0x7f0000002b00)=""/31, 0x1f}, {&(0x7f0000002b40)=""/188, 0xbc}], 0x3, &(0x7f0000002c40)=""/48, 0x30}, 0x6}, {{&(0x7f0000002c80), 0x80, &(0x7f0000002f40)=[{&(0x7f0000002d00)}, {&(0x7f0000002d40)=""/253, 0xfd}, {&(0x7f0000002e40)=""/217, 0xd9}], 0x3, &(0x7f0000002f80)=""/4096, 0x1000}, 0x2}, {{&(0x7f0000003f80)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000005440)=[{&(0x7f0000004000)=""/139, 0x8b}, {&(0x7f00000040c0)=""/203, 0xcb}, {&(0x7f00000041c0)=""/28, 0x1c}, {&(0x7f0000004200)=""/4096, 0x1000}, {&(0x7f0000005200)=""/249, 0xf9}, {&(0x7f0000005300)=""/73, 0x49}, {&(0x7f0000005380)=""/182, 0xb6}], 0x7, &(0x7f00000054c0)=""/6, 0x6}, 0xffffffffffffff16}], 0x5, 0x40000000, &(0x7f0000005640)={0x0, 0x989680}) accept$packet(r3, &(0x7f0000005680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000056c0)=0x14) getsockname$packet(r3, &(0x7f0000005700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000005740)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000005780)={{{@in=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f0000005880)=0xe8) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f00000058c0)={0x0, @local, @dev}, &(0x7f0000000140)=0xc) recvmmsg(0xffffffffffffffff, &(0x7f000000df80)=[{{&(0x7f0000005e00)=@caif=@rfm, 0x80, &(0x7f0000006080)=[{&(0x7f0000005e80)=""/44, 0x2c}, {&(0x7f0000005ec0)=""/212, 0xd4}, {&(0x7f0000005fc0)=""/130, 0x82}], 0x3, &(0x7f00000060c0)=""/111, 0x6f}, 0x5}, {{&(0x7f0000006140)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000008580)=[{&(0x7f00000061c0)=""/4096, 0x1000}, {&(0x7f00000071c0)=""/178, 0xb2}, {&(0x7f0000007280)=""/194, 0xc2}, {&(0x7f0000007380)=""/212, 0xd4}, {&(0x7f0000007480)=""/60, 0x3c}, {&(0x7f00000074c0)=""/4096, 0x1000}, {&(0x7f00000084c0)=""/135, 0x87}], 0x7, &(0x7f0000008600)=""/18, 0x12}, 0x4}, {{&(0x7f0000008640)=@ipx, 0x80, &(0x7f0000008900)=[{&(0x7f00000086c0)=""/7, 0x7}, {&(0x7f0000008700)=""/161, 0xa1}, {&(0x7f00000087c0)=""/183, 0xb7}, {&(0x7f0000008880)=""/121, 0x79}], 0x4, &(0x7f0000008940)=""/4096, 0x1000}, 0x3}, {{&(0x7f0000009940)=@ax25={{0x3, @bcast}, [@remote, @rose, @netrom, @null, @rose, @default, @remote, @null]}, 0x80, &(0x7f0000009a40)=[{&(0x7f00000099c0)=""/108, 0x6c}], 0x1, &(0x7f0000009a80)=""/242, 0xf2}, 0x26}, {{&(0x7f0000009b80)=@xdp, 0x80, &(0x7f000000acc0)=[{&(0x7f0000009c00)=""/65, 0x41}, {&(0x7f0000009c80)=""/7, 0x7}, {&(0x7f0000009cc0)=""/4096, 0x1000}], 0x3, &(0x7f000000ad00)=""/177, 0xb1}, 0x7ff}, {{0x0, 0x0, &(0x7f000000af80)=[{&(0x7f000000adc0)=""/138, 0x8a}, {&(0x7f000000ae80)=""/98, 0x62}, {&(0x7f000000af00)=""/100, 0x64}], 0x3, &(0x7f000000afc0)=""/161, 0xa1}, 0x7}, {{&(0x7f000000b080)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f000000d400)=[{&(0x7f000000b100)=""/85, 0x55}, {&(0x7f000000b180)=""/125, 0x7d}, {&(0x7f000000b200)=""/80, 0x50}, {&(0x7f000000b280)=""/8, 0x8}, {&(0x7f000000b2c0)=""/74, 0x4a}, {&(0x7f000000b340)=""/96, 0x60}, {&(0x7f000000b3c0)=""/4096, 0x1000}, {&(0x7f000000c3c0)=""/4096, 0x1000}, {&(0x7f000000d3c0)=""/62, 0x3e}], 0x9, &(0x7f000000d4c0)=""/223, 0xdf}, 0x4}, {{&(0x7f000000d5c0)=@hci={0x1f, 0x0}, 0x80, &(0x7f000000d880)=[{&(0x7f000000d640)=""/167, 0xa7}, {&(0x7f000000d700)=""/69, 0x45}, {&(0x7f000000d780)=""/198, 0xc6}], 0x3, &(0x7f000000d8c0)=""/216, 0xd8}, 0x7fff}, {{&(0x7f000000d9c0)=@nfc_llcp, 0x80, &(0x7f000000db80)=[{&(0x7f000000da40)=""/46, 0x2e}, {&(0x7f000000da80)=""/236, 0xec}], 0x2, &(0x7f000000dbc0)=""/119, 0x77}, 0x6}, {{&(0x7f000000dc40)=@rc, 0x80, &(0x7f000000df40)=[{&(0x7f000000dcc0)=""/30, 0x1e}, {&(0x7f000000dd00)=""/65, 0x41}, {&(0x7f000000dd80)=""/229, 0xe5}, {&(0x7f000000de80)=""/190, 0xbe}], 0x4}, 0x9}], 0xa, 0x20, &(0x7f000000e200)={0x77359400}) getpeername$packet(r3, &(0x7f000000e240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f000000e280)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f000000e2c0)={'team0\x00'}) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f000000e780)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f000000e740)={&(0x7f0000005940)=ANY=[@ANYBLOB="1c040000", @ANYRES16=r4, @ANYBLOB="0c0127bd7000fcdbdf250300000008000100b9874d7c1dc374a58e7ae21de6b6388c7bc07b1d0575400f450d3903ac4511", @ANYRES32=r5, @ANYBLOB="280202003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="400001002400010071756575655f6964000000000000000000000000000000000000000000000000080003000300000008000400c600000008000600", @ANYRES32=r7, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r9, @ANYBLOB="08000700000000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000100000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004008000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000500000008000600", @ANYRES32=r11, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000100000008000600", @ANYRES32=r12, @ANYBLOB="08000100", @ANYRES32=r13, @ANYBLOB="d001020040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r14, @ANYBLOB="08000700000000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000700000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000004000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400e288000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000900000038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000900000038000100240001006d636173745f72656a6f696e5f696e74657276616c000000000000000000000008000300030000000800040001000000"], 0x41c}, 0x1, 0x0, 0x0, 0x8000}, 0x80) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5387, &(0x7f0000000080)) r15 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r15, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 667.669450] binder: 21335:21337 unknown command 0 [ 667.674684] binder: 21335:21337 ioctl c0306201 20012000 returned -22 19:29:03 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x8000, 0x100) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000080)={0x0, 0x92, "ba971204e273505308d386e46c05147fb923b0494e085877f851ab854b1de6d40898af18e5d93fffb16919e0b3e3220f42e7291d75e735b06e8c7f897d2cbae1315afa1be1cd388cbde56c3d6a12c9a7fa422832b0b2c729b870c65f06eb8dbde33a2e9d3f1012f9c0432c1bf9d3738050761857b851f2365114031f8b0a949164515e06fadff06dd606c3086fa5a8817b69"}, &(0x7f0000000140)=0x9a) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000000180)={r4, 0x1000, 0x100000000}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:06 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) r4 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3000000, 0x100012, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0xff59, 0x0, &(0x7f0000000640)=[@release={0x40046306, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=[@flat={0xec2aa6aeb3f7664c, 0x10b, r4, 0x4}], &(0x7f00000005c0)=[0x0, 0x60, 0x18, 0x40, 0x30, 0x28, 0x0, 0x38, 0x38]}}, @reply_sg={0x40486312, {{0x3, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@fd={0x66642a85, 0x0, r2, 0x0, 0x4}, @flat={0x77682a85, 0x10a, r4}, @fd={0x66642a85, 0x0, r1, 0x0, 0x1}], &(0x7f0000000180)=[0x20, 0x28, 0x0]}, 0x6}}, @free_buffer={0x40086303, r4}, @decrefs={0x40046307, 0x4}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280), &(0x7f00000002c0)=[0x78, 0x30, 0x78]}, 0x8001}}, @transaction={0x40406300, {0x0, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@ptr={0x70742a85, 0x1, &(0x7f0000000300), 0x0, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f0000000340), 0x0, 0x1, 0x11}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f0000000400)=[0x30, 0x40, 0x0]}}], 0x2f6, 0x0, 0x0}) 19:29:06 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:06 executing program 0: unshare(0x20400) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x218e00, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10108404}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x60, r3, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x363e}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3a}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x30}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffffcc2}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000000)={'bcsh0\x00', {0x2, 0x4e24, @rand_addr=0x7}}) get_thread_area(&(0x7f0000000200)={0x9, 0x1000, 0x400, 0xfffffffffffff12f, 0x1ff, 0x3f, 0x36, 0x7f, 0xfffffffffffffffb, 0x80}) connect$l2tp(r1, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r2, 0x111, 0x5, 0x400000, 0x4) 19:29:06 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0}], 0x1, 0x0, 0x0, 0x0) 19:29:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 670.618567] binder: 21365:21372 Release 1 refcount change on invalid ref 2 ret -22 [ 670.626720] binder: 21365:21372 got transaction to invalid handle [ 670.633256] binder: 21365:21372 transaction failed 29201/-22, size 0-0 line 2994 [ 670.640996] binder: 21365:21372 ioctl c0306201 20000140 returned -14 19:29:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x9, 0x2001) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:06 executing program 0: r0 = socket(0x10, 0x3, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@local, @loopback, 0x0, 0x1, [@multicast1]}, 0x14) write(r0, &(0x7f00000001c0)="2400000043001f001007f4f9002304000a04f5110c000100020100020800038005000000", 0x24) prctl$PR_SET_FPEXC(0xc, 0x3) 19:29:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x62000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r1, 0xc0385720, &(0x7f0000000080)={0x1, {0x77359400}, 0x3}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000100)=[@release={0x400c630e}], 0xd1, 0x0, 0x0}) 19:29:06 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) dup3(r2, r0, 0x0) [ 670.826819] binder: undelivered TRANSACTION_ERROR: 29201 [ 671.030408] binder: 21391:21394 ioctl c0306201 20008fd0 returned -14 [ 671.030619] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 671.051441] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. 19:29:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x6, 0x1) setsockopt$packet_buf(r2, 0x107, 0x7, &(0x7f00000000c0)="e37ca20bb8611da791b8135af50d86073fdc9b57c40d41e5fefbdb614e1381064f9db4eaa541d0a7feab3e14a29f97b16bd0661a98866cabda80a2d9bd1c3b9a310668acb2d88f04af62bde2448f479c536231684d8e58", 0x57) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4, 0xe00000000000000}, [@nested={0x8, 0x9, [@generic='\n']}]}, 0x1c}}, 0x0) 19:29:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x40400, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x5000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x100, r4, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x26d5}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1ff}]}, @IPVS_CMD_ATTR_SERVICE={0x50, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x62}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x5, 0x18}}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7}]}]}, 0x100}, 0x1, 0x0, 0x0, 0x40}, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 671.197074] binder: 21399:21400 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 671.204724] binder: 21399:21400 ioctl c0306201 20008fd0 returned -14 19:29:09 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fe) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000000), &(0x7f0000000040)=0x4) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:09 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) dup3(r2, r0, 0x0) 19:29:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup(r1) setsockopt$inet_tcp_int(r2, 0x6, 0x1b, &(0x7f00000000c0)=0x7ff, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9e6, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r4, 0x400443c8, &(0x7f0000000080)={r3, 0x100000001}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) r5 = syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x4, 0x200) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f000000dff8)=[@exit_looper], 0x0, 0x0, 0x0}) 19:29:09 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x80000000200, 0x2) ioctl$FS_IOC_FSGETXATTR(r0, 0x8038550a, 0x0) 19:29:09 executing program 5 (fault-call:2 fault-nth:0): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:09 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x4001, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x810102}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x701, 0x70bd2a, 0x25dfdbfc, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0xffffffff}}, ["", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) fsync(r0) 19:29:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) 19:29:10 executing program 0: r0 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x60ff) ftruncate(r0, 0x281fd) setsockopt$ARPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000005f00)={'filter\x00', 0x4}, 0x68) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x175d900f) recvmmsg(0xffffffffffffffff, &(0x7f0000009000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 19:29:10 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a001, 0x1ff]}) 19:29:10 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) dup3(r2, r0, 0x0) 19:29:10 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x129) 19:29:12 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xffffffffffffff1f, 0x2000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="f362ee790111001d"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x8, 0x400) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:12 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:29:12 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x240040, 0x0) bind$vsock_dgram(r1, &(0x7f0000000100)={0x28, 0x0, 0x2710, @host}, 0x10) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) geteuid() r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x6, 0x101000) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000040)={0x8, 0x5, 0x2}) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:12 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000280)=[{&(0x7f0000000340)=""/245, 0xf5}], 0x1, 0x0) [ 676.885682] binder: 21462:21465 unknown command 2045666035 [ 676.891414] binder: 21462:21465 ioctl c0306201 20012000 returned -22 19:29:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000005c0)={0x2, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\vc'], 0x0, 0xfffffdfd, 0x0}) [ 676.986024] binder: 21462:21465 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 676.993570] binder: 21462:21465 ioctl c0306201 20008fd0 returned -14 19:29:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write$P9_RSETATTR(r0, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0x7) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:13 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x30d) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x10001, 0x0) ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000280)={0x4be, 0xc, 0x4, 0x40, {0x0, 0x7530}, {0x7, 0x0, 0x800, 0x7fff, 0x40, 0x0, "eef209ce"}, 0x3, 0x1, @planes=&(0x7f00000001c0)={0x2, 0x27, @mem_offset=0x22f, 0x9}, 0x4}) write$P9_RSTATFS(r0, &(0x7f0000000140)={0x43, 0x9, 0x2, {0x0, 0x9, 0x9fbb, 0x7, 0x7, 0x4f9, 0x4, 0x4, 0x9}}, 0x43) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f00000000c0)={0x1, 0x8, 0xfffffffffffff68b, 0x100000000, 0x1000, 0x2}) prctl$PR_GET_SECUREBITS(0x1b) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000440)=0x0) ptrace$setregs(0xffffffffffffffff, r2, 0x7, &(0x7f0000000480)="ee33700f07ed50ee3fcbd3114204f19b67248392f3fc730d5bc47bab545b8918f8fc8afcb7fe918c6acf2268d69a5e8cabb3cc4142d86eac3a18054981852e8bc48e0b64ceeb413a40e282cbf0db367000e9df4ed782") ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/10) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) openat$cgroup_ro(r3, &(0x7f00000003c0)='io.stat\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r1, &(0x7f0000000300)="5251069fba550468fa3d0dd2b235baee16191eb262a4aac67e46f2e1ec161a65735d527e4f2c6cb1fba4b3269ecc9f1a0d0f18d81c1f3d1be0327e9d653bcf02642848e64d6f2215e9998d42b80d800dc3ef294e99c68ed46c5cdbdda86fc1683500044f5afa04c2cbdcb272d79e99797a724af71146931702eaaf90fa49cd2b3528cd084581ca65ec3c25ee0270cc0533818025a35c57774d", &(0x7f00000003c0)}, 0x20) fremovexattr(r0, &(0x7f0000000200)=@known='user.syz\x00') ioctl$RTC_AIE_ON(r3, 0x7001) 19:29:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = socket$kcm(0x29, 0x7, 0x0) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000000)=@generic={0x3, 0x401, 0x7}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x84) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{}, {0x0}]}) ioctl$DRM_IOCTL_UNLOCK(r4, 0x4008642b, &(0x7f0000000140)={r5}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 677.271590] binder: 21480:21484 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER 19:29:13 executing program 0: r0 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) fadvise64(r0, 0x0, 0x0, 0x0) 19:29:13 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) r1 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffff9c, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={r1}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r2, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 677.395088] binder: 21492:21493 ioctl c0306201 20008fd0 returned -14 19:29:16 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r0, 0x15) 19:29:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.capability\x00', &(0x7f0000000180)=@v1={0x1000000, [{0x100, 0xfffffffffffff4bb}]}, 0xc, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) socketpair(0x19, 0x5, 0x28000000000000, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000080)={{0x0, @empty, 0x4e20, 0x3, 'rr\x00', 0x3, 0x0, 0x4a}, {@rand_addr=0xfffffffffffffffd, 0x4e24, 0x10003, 0xfffffffffffeffff, 0x852, 0xb6d}}, 0x44) 19:29:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000180)={'vxcan1\x00', {0x2, 0x4e21, @local}}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x7, 0x181081) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10004000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)={0x148, r3, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x40, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x75b}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0xf4, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa3d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x95c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6126}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd845}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa28}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffffffe0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xda2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffffffff0000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xcd5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x4000}, 0x8090) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$RTC_IRQP_SET(r2, 0x4008700c, 0x507) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:16 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000240)={0x0, 0x5, 0x3}) 19:29:16 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:29:16 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = getpgid(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000000)=r1) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'nr0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000ff7f0000ad0000000300000000000000060000001f000000000000001f0000000000000006000003a2f9d69f9f3b11430009000000070000007fffffff0000000004000000ff030000ff0f00000100000000000000000800"]}) [ 680.033595] binder: 21509:21513 ioctl c0306201 20008fd0 returned -14 19:29:16 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) execve(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=[&(0x7f0000000040)='em1#trusted},}posix_acl_access-\x00'], &(0x7f0000000200)=[&(0x7f0000000100)='proc+,nodev\x00', &(0x7f0000000140)='ppp0eth0^-trusted!]^\x00', &(0x7f0000000180)=']wlan0-(em1wlan1+{\x00', &(0x7f00000001c0)='em1\x00']) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:16 executing program 0: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$apparmor_exec(r0, &(0x7f0000000040)={'exec ', '&\t&'}, 0x8) clone(0x0, 0x0, 0x0, 0x0, 0x0) 19:29:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) r3 = request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)='losystemloself*wlan1ppp0@em0em1+selinux)\x00', 0xfffffffffffffffc) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000100)={r3, 0x8000, 0x9}, &(0x7f0000000140)={'enc=', 'oaep', ' hash=', {'digest_null\x00'}}, &(0x7f0000000200)="de62e5fef5d4f9d7cd5e93a2f62e161b6a2646e1d9a6d5670fa18d431ac186", &(0x7f0000000240)=""/162) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x2, 0x70bd26, 0x25dfdbfe, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x2, 0x543, 0x100000001, 0x5}}}, ["", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:16 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000000)=[{r0, 0x2}, {r0, 0x4101}], 0x0, 0x0, 0x0, 0x181) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x3ff, 0x0) getsockname$netlink(r1, &(0x7f0000000080), &(0x7f0000000140)=0xc) r2 = semget(0x2, 0x3, 0x10) semop(r2, &(0x7f0000000100)=[{0x2, 0x7f, 0x1800}, {0x6, 0x3f, 0x800}], 0x2) [ 680.442535] binder: 21536:21537 ioctl c0306201 20008fd0 returned -14 19:29:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = msgget$private(0x0, 0x0) msgctl$MSG_INFO(r1, 0xc, &(0x7f0000000400)=""/189) r2 = syz_open_dev$radio(&(0x7f0000000200)='/dev/radio#\x00', 0x0, 0x2) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000240)) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x9, 0x341003) ioctl$VIDIOC_G_PARM(r5, 0xc0cc5615, &(0x7f00000000c0)={0x9, @raw_data="73dbc3eb1e70ca2004ba8616432d91251c56d44c56732da9ce0b553446a1e60f598eea34c742350c99ff16d762180e7da1f2b907942224db746a0283aadb800e18cdb3ab4ba8ad425c90a0aef22289c31f1bc6e2d9d7068781d206247b0fb29a54dba1528968d3be632c5dbfecf161be9c5c0a1308e68c13acfb0cd041be220b15377d1c62a52e587a4885fef7fac18d0ec7e4f2ef511d5f6bfc25d2d84b972b554ff9ebbe0528395e63814c7fc6f8c6c1b6b45a5ad413539ce295cf51b47b1f5c3932eaaf2179a9"}) ioctl$VIDIOC_ENCODER_CMD(r5, 0xc028564d, &(0x7f0000000040)={0x2, 0x1, [0x7ff, 0x100000000, 0x5, 0x1, 0xdd, 0x2, 0x5, 0x3]}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000000), 0xfffffffffffffe57, 0x0, 0x0}) 19:29:19 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r0, 0x15) 19:29:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0xfffffffffffffffd) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r4 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x8, 0x20400) ioctl$TCSETAW(r4, 0x5407, &(0x7f0000000040)={0xc19e, 0x528, 0x101, 0x8, 0x0, 0x7f, 0x800, 0x4, 0x3, 0xbc}) 19:29:19 executing program 0: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$apparmor_exec(r0, &(0x7f0000000040)={'exec ', '&\t&'}, 0x8) clone(0x0, 0x0, 0x0, 0x0, 0x0) 19:29:19 executing program 3: openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/keycreate\x00', 0x2, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1c76, 0x2100) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000200)={@rand_addr="eb74f8303de8694f2cd07be7de986b23", 0x6, 0x2, 0x2, 0x2, 0x3, 0x509}, &(0x7f0000000240)=0x20) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) r5 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x9, 0xc80) ioctl$VIDIOC_ENUMOUTPUT(r5, 0xc0485630, &(0x7f0000000100)={0xffff, "2a76791568b9e12d80dd755bf11e2c61673c3fbfc5c4ab6977cf19cd4b1d495f", 0x1, 0x7fffffff, 0x4, 0x40004, 0x2}) fchdir(r2) fsync(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffe4d, 0x0, &(0x7f000000dff8), 0x2ae, 0x0, 0x0}) 19:29:19 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:29:19 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x1f, 0x400040) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x4, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x4000000) 19:29:19 executing program 4: socketpair$unix(0x1, 0x8ed694fb6183cbb8, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = getpid() fcntl$setownex(r2, 0xf, &(0x7f0000000000)={0x2, r3}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x0, 0x288200) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) ioctl$CAPI_INSTALLED(r2, 0x80024322) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:19 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) r2 = getpid() socket$bt_bnep(0x1f, 0x3, 0x4) kcmp(r1, r2, 0x7, r0, r0) r3 = socket$inet(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="24000000660007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b138a32052b44e099d881e02546dcda4cc7e6397", 0x4c}], 0x1}, 0x0) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x90) ioctl$VHOST_SET_VRING_BASE(r4, 0x4008af12, &(0x7f0000000040)={0x3, 0x5}) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:19 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r0, 0x8922, &(0x7f0000000400)={'ip6tnl0\x00', @ifru_ivalue}) 19:29:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x100000000000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:19 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'nlmon0\x00', {0x2, 0x4e22, @remote}}) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) socketpair(0x2, 0x800, 0x6, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000000c0), 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 683.646503] ip6tnl0: mtu less than device minimum 19:29:22 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, 0x0, 0x0) tkill(r0, 0x15) 19:29:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="b474be24aa28b8d3"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r1, 0x2, 0x6, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:22 executing program 0: 19:29:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r4 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x1, 0x40000) ioctl$PPPIOCGFLAGS1(r4, 0x8004745a, &(0x7f0000000040)) 19:29:22 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, 0xffffffffffffffff, 0x0) 19:29:22 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) getpeername(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f00000000c0)=0x80) recvmmsg(r0, &(0x7f0000001880)=[{{&(0x7f0000000100)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000180)=""/169, 0xa9}, {&(0x7f0000000280)=""/79, 0x4f}], 0x2, &(0x7f0000000340)=""/218, 0xda}, 0x2}, {{&(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000800)=[{&(0x7f00000004c0)=""/176, 0xb0}, {&(0x7f0000000580)=""/189, 0xbd}, {&(0x7f0000000640)=""/246, 0xf6}, {&(0x7f0000000740)=""/5, 0x5}, {&(0x7f0000000780)=""/123, 0x7b}], 0x5, &(0x7f0000000880)=""/4096, 0x1000}, 0xd7f3}], 0x2, 0x40000100, &(0x7f0000001900)={0x77359400}) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000001940)={@multicast2, @broadcast, r2}, 0xc) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 686.287066] binder: 21612:21618 unknown command 616461492 [ 686.292895] binder: 21612:21618 ioctl c0306201 20012000 returned -22 19:29:22 executing program 0: [ 686.351254] binder: 21612:21622 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 686.358919] binder: 21612:21622 ioctl c0306201 20008fd0 returned -14 19:29:22 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) 19:29:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}}, 0x7fffffff, 0x3, 0x4, 0x8, 0x2}, &(0x7f0000000040)=0x98) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000180)={r2, 0x401}, &(0x7f00000001c0)=0x8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000002c0)={r3, 0x7c, &(0x7f0000000240)=[@in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e21, 0xfff, @mcast1, 0x1a4}, @in={0x2, 0x4e24}, @in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e24, @remote}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e21, @local}]}, &(0x7f0000000300)=0x10) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r6, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffd) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00e\x00'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="fa620c4000006fdd2b4ad23640ddaefad18b0000"], 0x2ae, 0x0, 0x0}) 19:29:22 executing program 0: [ 686.659865] binder: 21635:21637 unknown command 0 [ 686.665118] binder: 21635:21637 ioctl c0306201 20012000 returned -22 [ 686.690118] binder: 21635:21637 unknown command 1074553594 [ 686.696140] binder: 21635:21637 ioctl c0306201 20008fd0 returned -22 19:29:22 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) ppoll(&(0x7f00000000c0), 0x3c8, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f00000000c0)={'ip_vti0\x00', {0x2, 0x4e20, @empty}}) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x40, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000140)) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_flowlabel\x00') getsockopt$XDP_MMAP_OFFSETS(r0, 0x11b, 0x1, &(0x7f0000000180), &(0x7f0000000200)=0x60) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000240)={{{@in6=@mcast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@loopback}}, &(0x7f0000000340)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000380)={'team0\x00', r3}) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f0000000040)={0xc, 0x2, {0x53, 0x100, 0x7fff, {0x4, 0x1c83}, {0x80000000, 0xe2}, @const={0x2, {0x1000, 0x0, 0xffffffff80000000, 0x5}}}, {0x57, 0x100, 0x6, {0x8, 0x100}, {0x0, 0xfffffffffffffffc}, @cond=[{0x1, 0x7f060947, 0x1000000000000, 0x40, 0x52, 0x1}, {0x32, 0x3a175a16, 0x3, 0x4, 0x0, 0x1ff}]}}) 19:29:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xa89, 0x100) write$vhci(r4, &(0x7f00000000c0)=@HCI_SCODATA_PKT={0x3, "c7c3beefa2d62fe537e73d643498adb068525c43982e11c518f3017df864fc0a8ce152ac2d4b549eecd590d073b62658d977d88f6114bf05680d4462e4e30921d03048043e71772a2ce7933f8b6ac05c678f2278327bc4fe1c65f442ec4cc00027fa4ad5248094c6b8501dcdee750feefd77482fc261b5d33db49d111484d2060eafac93bd2db171bad0e3599dea2aa889bc711d87bac0a4e7f87074cbd365210ef1cd995b6164a62cfb05c443db12cfbc67a1d4a4b6551234a17131dad7f26860"}, 0xc2) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa1, 0x0, [0x70a800]}) 19:29:25 executing program 1: gettid() r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r0, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x15) 19:29:25 executing program 0: 19:29:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x7b3874d9366fb567, 0x0, &(0x7f0000000000)=ANY=[@ANYRES32=r1], 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f00000001c0)) setreuid(r2, r3) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:25 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x171) 19:29:25 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, 0xffffffffffffffff, 0x0) [ 689.421646] binder: 21650:21659 unknown command 4 [ 689.426820] binder: 21650:21659 ioctl c0306201 20012000 returned -22 19:29:25 executing program 0: [ 689.532613] binder: 21650:21659 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 689.539858] binder: 21650:21659 ioctl c0306201 20008fd0 returned -14 19:29:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x10000, 0x0) ioctl$KVM_SET_XSAVE(r1, 0x5000aea5, &(0x7f0000000540)={"be05ce13b6faba832c03b1b1e04642c23827f5f51536ba8507b4a707d62fedfdaba032c1f31766083a9b5a186d3e0627b825986b1afaf9117515b210637f1634945459a339742145b83f0a5631da014e8cd60c281878d7d3246c0a91cd8d0c4f4dede74bc04b32e48ee428c108008d925e96e14d4359b88ed973e3fb903283755dc858ac3abc2e5673bce50e4fe6bb20aa40bad7f3f167c5e7818091dbde8727c82b121aefa2c47366777787cd6da9b79abfc1e8aca3021be047b147593f7842fad85f89a628945295fa71db6befd90bb0c89a4b6e905bd6866be36dfd2790c065d60686c6d3803b92e796261861fd0b484611c469f958dd9b8ec2a2b65f146d9e85b3372aad3fee08a174d83aa4e6fe330c975f504e837682559fc27d17c76bb17ba51f92dea0d42aa4e35d0cea3e75c16a03f07b40d6e1d649e5eaa67e01e0c24c6343e1bacd04469798c71160e4bda21ed55115cf1a35d1ca1c6d04cc1080b057e985c683e4585c511d867c499d404fe013991d621c268170a51e21bc9709957924c901f5fe7a559c31d29d676168ad4406bce0d36adebfc61928a67df781389e4137d058ed7252c9d32cbf263226149ebbe28da5c81c4dde4f07e8e22caf1fa70324cd90ad23ec108fb585cbb7a26fe26c9e1510e8f0ba251ce90ee6b3d82816bcdc37ba505bfd80b6b9927ebb5678b6f4d3753be26f390a30c5e87917d148fce423d9eecb5feb4b3a5560e31086286f690cd414d8e777c412925ff5658be52c7c0c2b23b4a4847322381ede7b6d97ad816a636ef06f909145b701c23f50aa63db35ca53333f4256d2fcecd9dcb5c331fe205b12fc2731cbab23e98d91a3c270328c4bd0534738837bfdb3478e48a8a64dffbc8008eb0d0359f3b66a4748e182a106b0836a57c1dc89135d27e3502f2de53fc3fb07748f08ad9552b39bf5bd06e740310218231dc91d4a03a8cc835744c75ab0a72c12de5c5ba0bacb757f14fce97c2ec08a5700769f580776748b4501f4467d851f8696cf0b20e80841146bc88ea75b43665caca0336bd0c9075e18e2edb0cd9f8038dc7d1291971aa684818bd1e37639af49e6b191fd339131b1900ae590c7db0aaca69d929495d8260b5f87f90f3568676de1e89f7e81380016537f77eb9c86f93b1067e12060ae9fe1439e33473de3aa835727b85e19fece8897bc27452e2330cecd04f9885c01467b3b776828cd9b0005c8a5a3e6c8cf8bc5af5ad082dbce46d59dd846f9157bb240c44ec5dfdd5c543390f06065def4df09b3e4731d46876541a1a6c72f915e08a69c9271c7f991004e0b27d0bef536713e149358fd0f4c37eaed3a37221613287cdb41ca8ddd95008863fbe3d8ea570cc45f279507df4be60cc7a694c1149f7f0a056acaf63c7c007523c8a1a9874a71ee5872856f7ac5222522c6c9dae9c84b3f"}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:25 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000000)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0xfffffd5a) 19:29:25 executing program 0: 19:29:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x28000, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f0000000080)=0xda, 0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:25 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 689.998469] binder: 21679:21680 ioctl c0306201 20008fd0 returned -14 19:29:26 executing program 0: 19:29:26 executing program 1: gettid() r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r0, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x15) 19:29:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x4000000000000) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:26 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_all\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r1, 0x80605414, &(0x7f00000000c0)=""/200) ppoll(&(0x7f0000000040)=[{r0, 0x8009}], 0x1, 0x0, 0x0, 0x0) 19:29:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x280000, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'veth0_to_team\x00'}) close(r0) openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video37\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:26 executing program 0: 19:29:26 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, 0xffffffffffffffff, 0x0) [ 690.471069] binder: 21698:21699 ioctl c0306201 20008fd0 returned -14 19:29:26 executing program 0: 19:29:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:26 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x0, 0x200) ioctl$RTC_UIE_OFF(r4, 0x7004) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000180)) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) vmsplice(r1, &(0x7f0000000140)=[{&(0x7f0000000080)="87eda0d831cf17857bdf0034f9831c1a085a596c6d876eeaa4833d3da68277c9db3703db2e5a71f12c66fca59073ca48c01164d891e84aed45b8284dcecce5c5d6a861281e458a6c8e193d707ac6a79874a3b3096e14ccd79bb3ccd9f6b8311ab74bb94c87da33af4620a3cd6294706e6937eb69a55cd1232840870ee6810d8cbdef9a4232a0ee47012e468a49", 0x8d}, {&(0x7f0000000240)="50b9f1e8f7efae38eaa98ef144f0907dd15df35d23402ff540b2b77193e940ef4010cc82b54ca284c3b4ca6535cef02f5d51649d2d4855b60bb99c1f14955773c88ec0ef54ec86524edbad3840fb95c5c8563b21a060e65e7c728052867b06c2c76aa3776b92290a1ac12a4e2525bf75cd58b88d459f86a3691be8e3326a39941e8520320ae35f216a0ca7dc3ea62ab9ac9cef319279e6f6e4b3b9a5a51464606859b93bdb45aef0691702839fcb83322ae0711277722ce9218cf60cf752240c7d35c260f7a6dc4694d44861a04894ac91fcffb550e94f4340c48067d9fb80d6bd9d1389d84d8a8d", 0xe8}, {&(0x7f0000000340)="7214383148b4624c661ce5201fe9081ee4631a11fdec22cd8f223b53d2ba1e75cdef8a444faf7f4b50f09d8c41a9b1a31ff193fcb84d8f522ace6154c34d3ec103a87ed77a266227e0ab3228e44f51925f66bd31ec12353cbcaaf2a87d4c1298e806205cfd0789a35f6f5ef1f11d44172939b51f5e6772de85938eb958e3ebed4675ac9dcc8ba1546bc2ab8f8324d9c9e561f82770209f0f81ce00c1c311c8a526392f92704d986481735b3cf4511d2e1cdb3462600cc5fb3bac2867b11bf3d3d7fec7a7633316beed4c0472be4d19bdef6597874a539d808c178e0b645bcb10175fdbdfabf91e0ef3300e2c5826950841e4bd639c07eb696c3cbf", 0xfb}], 0x3, 0xa) [ 690.748447] binder: 21710:21711 ioctl c0306201 20008fd0 returned -14 19:29:26 executing program 0: 19:29:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0563044000000000cebbe06a4c674d1fe695df73f702afd6fd2975b449c15da67053c0d618c2c245653e6dec5c0473d9714bb1e9d45f793eb866f2893106c661c6a336dee4daeae6b9ea9b33b713689f097be253878f065f239f"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) r3 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_UNLOCK(r3, 0x4008642b, &(0x7f0000000140)={r4}) 19:29:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400000, 0x4) ioctl$KVM_NMI(r2, 0xae9a) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 691.027082] binder: 21718:21720 ioctl c0306201 20008fd0 returned -14 19:29:27 executing program 1: gettid() r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r0, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x15) 19:29:27 executing program 0: 19:29:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="c94c93cd172bad25ba690b7605d9b049b40779dee40cdffd82c83b459728737e16f096ed5dec1df806e8271d607a4e00b4cc88c1d070aa7b3a9c6062f675cca4c30c3a52347d2936e8cff678715bace189a914dffdc8b22aad6f73874b5404b05d"], 0x2ae, 0x0, 0x0}) r4 = dup3(r2, r0, 0x80000) openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) 19:29:27 executing program 2: 19:29:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x10000, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x4400, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, r1, 0x0, 0x9, &(0x7f00000000c0)='/dev/kvm\x00', 0x0}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000140)=r3, 0x4) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = semget(0x0, 0x4, 0x410) semctl$GETVAL(r5, 0x0, 0xc, &(0x7f0000001540)=""/4096) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:27 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffff9c, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x80) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x1, r1, 0x14, r2}, 0x10) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r3, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 691.567660] binder: 21732:21734 unknown command -845984567 [ 691.573634] binder: 21732:21734 ioctl c0306201 20008fd0 returned -22 [ 691.645215] binder: 21732:21734 tried to acquire reference to desc 0, got 1 instead 19:29:27 executing program 2: 19:29:27 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000000)=0x200002, 0xfffffc94) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:27 executing program 0: [ 691.691693] binder: 21732:21734 unknown command -845984567 [ 691.697624] binder: 21732:21734 ioctl c0306201 20008fd0 returned -22 19:29:27 executing program 4: setxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.upper\x00', &(0x7f0000000240)={0x0, 0xfb, 0x15, 0x5, 0x3, "a26df7175feacbcee7288f2437cf629d"}, 0x15, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000280)='/dev/audio#\x00', 0x1, 0x80400) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f00000002c0)={0x7, 0x7, 0x101, 0x0, 0x81, 0x0, 0x400, 0xfffffffffffffffb, 0xffffffffffffff80, 0x9, 0x40, 0x9, 0x0, 0x9, 0x0, 0x7, 0x1000, 0x6, 0x80000001}) getsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f0000000400), 0x2) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f00000003c0)=0x3) r5 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x9, 0x208082) setsockopt$packet_buf(r5, 0x107, 0x5, &(0x7f0000000140)='Ib', 0x2) r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x4000, 0x0) bind$inet6(r6, &(0x7f0000000380)={0xa, 0x4e23, 0xfffffffffffffff8, @local, 0x3}, 0x1c) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000300)={[0x4000, 0xf004, 0x36a4335b57438153, 0x7000], 0x3, 0x42, 0x7fff}) ioctl$VIDIOC_S_TUNER(r6, 0x4054561e, &(0x7f00000000c0)={0x4, "5487923aa8cef6ff0e576911abd2ca2cb1507b50f4f2cf1e4d3fd4555d1d68af", 0x3, 0x480, 0x32f5, 0x7ff, 0x4, 0x1, 0x401, 0x4a}) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:28 executing program 0: 19:29:28 executing program 2: 19:29:28 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x0) 19:29:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x9) close(r0) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$VIDIOC_S_OUTPUT(r4, 0xc004562f, &(0x7f0000000080)=0x100000001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:28 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) init_module(&(0x7f0000000200)='filter\x00', 0x7, &(0x7f0000000d40)='&em1bdev\x00') r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x100) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000300)={0xffffffffffffffff, r1, 0x0, 0x1c, &(0x7f00000002c0)='systemcpusetwlan0&+trusted(\x00', 0xffffffffffffffff}, 0x30) sendmsg$nl_generic(r1, &(0x7f0000000900)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0xe891b637287fbe28}, 0xc, &(0x7f00000008c0)={&(0x7f0000000340)={0x558, 0x33, 0x0, 0x70bd2b, 0x25dfdbfc, {0x19}, [@typed={0x8, 0x7a, @u32=0x3}, @nested={0xb4, 0x19, [@typed={0x8, 0x34, @u32=0xffffffff7fffffff}, @typed={0xc, 0x26, @u64=0x80000001}, @typed={0x4, 0x42}, @typed={0x8, 0xfffffffffffffffd, @u32=0x7}, @typed={0x8, 0x75, @u32=0x3}, @generic="a4fc8014cb97ef042d3d8f045177f98a15adf0103ed75d28fd965856c61a6be7c42547c0a7621d4d05aa8a03dc8cb7843bec0185752481c41f3e8c24bc7c3d827e3ee6747bdf599ca1d0bafcb0a476209cdb512839a934120338aed73111083de53329c2353c1bea7b3c07f1d3b9b9b363e3dec761f5449439b54b3e2a", @typed={0x8, 0x91, @u32=0x40}]}, @typed={0x8, 0x28, @pid=r2}, @typed={0x8, 0x3d, @fd=r1}, @nested={0x158, 0x82, [@generic="1560ece25cf69893867d1784300a2c3b14e00fa76b4613c3da0d7d772e0c98e75a2be89542305068f9bde76b996cdc9a60a978c25059c74a37c8ec02206f428dfabeb0cef9753ab77d6a44683e934f89b81d59393d0574c58ce449d05032da980d493f2587956e04453d7024cf94feceb7a2a03a19eebdd169108fa88d47cc453bcd6170dfc5743002b35c3596ba69bfa5d195b446018855c518d42639c0ace94aa1b83828c8f76da79d980e38d5354944ba93e763a68b53dae83c7d445cd16486db06c6a742f61546bbf44e0b7d612412c8466969", @generic="532064936eafce757c538ff7c574f09ad865a060be5790b060f08a144b9a4c08467b7251320e4df6f47f06e1932b2d9aff3f6f6d933e92d33b3b1b09d8f52452bae3c88be2540e6e490719d15bc433ce0ab5193a1c273ca639798eef5ca9bdef240f82757e35d3f647b8b777d15af988d73dad182e0fc6115a73015894"]}, @generic="66ce8b6c118524b4a0bc3e25010cfd73f966a6b8ded73e412c27da0b35abc52f0d12c9dfc875a9604b5b9e204fe585add6964e1eaddebfc6cf507a51801d9cd259ff4ab58c5dd5d4a66af6dc74ed63a6a3cac35f29164d646d868ebabe9ded7831c6db2432f55273cbc2f87a5bde86e4ef7bb9f779f500478523b758eee0eb2a2849f3a2263d8e6a61f7fb702c9e15b967ce5d6b8541698828df366dbf2669342e121aec9fe93fa68a87e43d41e66f7bf400aee74d2e63b466f8665e77ae", @nested={0x1c4, 0x7, [@generic="53a3009b25c01f634f145e30a3087d98c75a2fd91815b426b45a6eb2fe209d376e6337ef91ffbfd159768ca480cf6d8a7640a6fab74b8a5fc626eee5db7147555e4e2dd5303b7d53bb773dc03895b064a96b15d0d78076ded4c477be986d15bc1c3b8513bfed", @generic="4ca50f090ac41eef7a1730bc76c2986f8df06cb984801f74c7bad51a3c9d688849dce78df200a334e1e9b3f08aec9a139104ae5baeadac15502ca132b6a1eaabb930c309156cfd126819b0eff57f24473e463a3b14e694961d6311edde857f8a5c8ffc", @generic="ab4172b4f4dad23bf5972c312bb32ae1185f36b69411d2c72052c2d43283601d6e47e3cd3a4a64317ef3441e93ea906dbf0da16ec44e126531c091df720afc5fb2cf2b407eee4625b2d2ffe3d3acf697755e3c4acab27db614e50cea1e13eeabb28309b03f360d72100367c38299ffd64f1ea26e40faf7bbf8f205b9c121168d502e54737f90130409351086ac0940ae81bf6e9ee4da8d9ab1fafc011ef712fc0418c6f87437cf706afd981f9c57c2c23cef49739f08fa24dbc77f5401c62d86d8b3b670783be8c70a790e6e91874a3025a540df5cac5730a479ead045db8289b8e1c0165caf458081b32063910f65b48d4cf8edc786"]}, @generic="d125fe0c0a8c8f3814b4ba356aed283a0be83164a39e32d3202fd55a97a5959a1fad7996983ab89bd6fc232fc6d7adec53481448fe465997c92569b22ac61d28f8e84466180e47c5aeee8c98ec98060757fd2049d401f7cfde6e40fae6bda3903714696cfc8c2d053585a67ff9c498a3b3cf4b91a89ad2e8f469782b3437bb595e32cb78e9916635c7ccaac5b1ddaccf7541fdecda6a7ce0f42fef9840af"]}, 0x558}, 0x1, 0x0, 0x0, 0x40}, 0x10) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f00000000c0)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000f200000088dd2aa67b51c5a27c0c1955beb98a12468b1e1a877f152ada5970c61185f3f76c7d931d31a7047b7c310dd2b43e233b141eb79057259d75c620bdf78c62958e62ad92916b119e7c6c14df4672deab1172fad346c0787ab0cbc5961e02251b33e193e6bd921f69194fd24a53f968340fe283f4837bf9a44b7a4bf5e20e489d6c9d8a5f4fc4547bb1644144c9fcdd9e0efd38f44b46fb1d54d9b37ea0d8e7d4e3df3e3c82c426b94b852979a60c1b6aa83bf8c29eb1727518beb41e2ac6fbcaa5a7d7bc8091baea9a94e98e21bcab059108d9113a651dbcda07495689b7f307bd8dcf94965740d304744cf7587f4a325e0c91"], &(0x7f0000000040)=0x116) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000d80)={'vcan0\x00', 0x0}) bind$xdp(r1, &(0x7f0000000dc0)={0x2c, 0x4, r3, 0x27, r1}, 0x10) write$binfmt_elf64(r0, &(0x7f0000000e00)=ANY=[@ANYBLOB="7f454c46bd0708008ffb0000000000000200070002000000dc0000000000000040000000000000001d030000000000000200000002003800010003000100ffff000000700200000001010000000000000500000000000000070000000000000007000000000000004ed600000000000000000000000000000600000007000000000000000000000007000000000000000004000000000000090000000000000080000000000000000500000000000000edb18b6d4347bc9800c863aa9556f2a2807f6829fe8c7edee7db09520b291421be1970bdc80f0d726e51f9fd74068c9283f2cf9eb24bb5285d774bc8b0758d69e1b90cc803f1b5c60d0e660c44570b778f91f67e800bfcae5a35aa140c3e9e556c53656e5953b6394a15affb7343e1638fd799ff1124899bd77aaccfc39f140c886c69966258f08fa6aea4859bfd94ea2af57e56b03c3a621131a5170d24680eda592f5deff19389582e7cada057dfd3fc6eaa04fcaf303a51b76de4884f39f34663229b2db40cecfae29b1569389dbca1b86b67ba6578bed4170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002845f9a0bff5c334c668c6c38059b600"/2713], 0xa8a) 19:29:28 executing program 0: 19:29:28 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f00000000c0)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x6, @random="57288bbd6c97"}, 0x72, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 'veth1_to_hsr\x00'}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_int(r0, 0x0, 0x1e, &(0x7f0000000240), &(0x7f0000000280)=0x4) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x111, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r5, 0x7}}, 0x10) 19:29:28 executing program 2: [ 692.670336] QAT: Invalid ioctl [ 692.684798] binder: 21768:21769 ioctl c0306201 20008fd0 returned -14 19:29:28 executing program 2: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./file1\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) link(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000180)='./file1/file0\x00') lsetxattr$security_selinux(0x0, 0x0, 0x0, 0x0, 0x0) 19:29:28 executing program 0: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x2, 0x0) pwrite64(r0, &(0x7f00000001c0)="7800bf9123962b71ba72fb0896028dc18bfbe9dc0b572b06b5dd64f946f7a7b5b13eb0648efbcee042aeba1f5f05ed5e00f83361264c40bef48d2d801265d78c", 0x40, 0x0) 19:29:28 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'veth1_to_bond\x00', 0x401}) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000080)) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f00000000c0)={'team_slave_0\x00', 0xfffffffffffffbff}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) acct(&(0x7f0000000000)='./file0\x00') ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:29 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x10000, 0xd) ioctl$VIDIOC_G_JPEGCOMP(r1, 0x808c563d, &(0x7f0000000240)) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000040)=[@window={0x3, 0x8, 0xdc}, @mss={0x2, 0x6}, @sack_perm, @sack_perm, @sack_perm, @mss], 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) getsockname$unix(r1, &(0x7f00000000c0), &(0x7f0000000140)=0x6e) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000180), &(0x7f0000000300)=0x68) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:29 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x20000000802, 0x0) write(r0, &(0x7f0000000200)="240000001a0025f00018000400edfc0e8000000000000000000000000800020048050000", 0x24) [ 693.164147] binder: 21793:21794 ioctl c0306201 20008fd0 returned -14 19:29:30 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x0) 19:29:30 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x10000, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x1, 0x2}, 0x10) listxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/137, 0x89) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000200)={r2, r3/1000+10000}, 0x10) 19:29:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="05630440000000008ea28801c05a6dcd1ccc2d985e538cae2cbf3c01b23d000061f6154a09018be0a35c49981e65299daf2ff8c8fe60404ac6959d2abb23c95192"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) fsetxattr$security_capability(r0, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000080)=@v1={0x1000000, [{0x3, 0x10001}]}, 0xc, 0x1) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000340)='/dev/autofs\x00', 0x440000, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x24, r4, 0x0, 0x70bd2a, 0x25dfdbfc, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x7ff}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e21, 0x3ff, @empty, 0x80000000}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}], 0x2c) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000380)={@dev, @multicast2, 0x0}, &(0x7f00000003c0)=0xc) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000400)={r5, 0x1, 0x6, @link_local}, 0x10) 19:29:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000007802008e"], 0x0, 0x0, 0x0}) 19:29:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket(0x0, 0xa, 0x5) setsockopt$bt_BT_POWER(r4, 0x112, 0x9, &(0x7f0000000000)=0x6, 0x1) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:30 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/.vm\x00', 0x0, 0x0) ioctl$FIBMAP(r0, 0x1, 0x0) [ 694.010048] binder: 21814:21817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 694.037221] binder: 21818:21819 transaction failed 29189/-22, size -8214563005904453632-0 line 2994 [ 694.050496] binder: 21814:21817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 694.058130] binder: 21814:21817 ioctl c0306201 20008fd0 returned -14 19:29:30 executing program 2 (fault-call:6 fault-nth:0): mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:30 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) recvmmsg(r0, &(0x7f0000002a00)=[{{&(0x7f0000000480)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000500)=""/230, 0xe6}, {&(0x7f0000000600)=""/3, 0x3}, {&(0x7f0000000640)=""/230, 0xe6}, {&(0x7f0000000740)=""/88, 0x58}, {&(0x7f00000007c0)=""/12, 0xc}, {&(0x7f0000000800)=""/107, 0x6b}], 0x6, &(0x7f0000000900)=""/227, 0xe3}, 0x283f}, {{&(0x7f0000000a00)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @initdev}}}}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000a80)=""/113, 0x71}, {&(0x7f0000000b00)=""/100, 0x64}, {&(0x7f0000000b80)=""/85, 0x55}, {&(0x7f0000000c00)=""/173, 0xad}], 0x4}, 0x5}, {{&(0x7f0000000d00)=@nfc_llcp, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000d80)=""/164, 0xa4}], 0x1, &(0x7f0000000e80)=""/25, 0x19}, 0x5}, {{0x0, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000000ec0)=""/241, 0xf1}], 0x1}, 0x53}, {{0x0, 0x0, &(0x7f0000002180)=[{&(0x7f0000001000)=""/125, 0x7d}, {&(0x7f0000001080)=""/9, 0x9}, {&(0x7f00000010c0)=""/115, 0x73}, {&(0x7f0000001140)=""/4096, 0x1000}, {&(0x7f0000002140)=""/22, 0x16}], 0x5}, 0x200}, {{0x0, 0x0, &(0x7f0000002640)=[{&(0x7f0000002200)=""/174, 0xae}, {&(0x7f00000022c0)=""/101, 0x65}, {&(0x7f0000002340)=""/83, 0x53}, {&(0x7f00000023c0)=""/237, 0xed}, {&(0x7f00000024c0)=""/253, 0xfd}, {&(0x7f00000025c0)=""/38, 0x26}, {&(0x7f0000002600)=""/53, 0x35}], 0x7, &(0x7f00000026c0)=""/90, 0x5a}, 0x5}, {{&(0x7f0000002740)=@nfc, 0x80, &(0x7f0000002980)=[{&(0x7f00000027c0)=""/151, 0x97}, {&(0x7f0000002880)=""/164, 0xa4}, {&(0x7f0000002940)=""/12, 0xc}], 0x3, &(0x7f00000029c0)=""/20, 0x14}, 0xbea}], 0x7, 0x2, &(0x7f0000002bc0)={0x0, 0x1c9c380}) recvmsg$kcm(r1, &(0x7f00000031c0)={&(0x7f0000002c00)=@isdn, 0x80, &(0x7f0000003100)=[{&(0x7f0000002c80)=""/114, 0x72}, {&(0x7f0000002d00)=""/99, 0x63}, {&(0x7f0000002d80)=""/212, 0xd4}, {&(0x7f0000002e80)=""/72, 0x48}, {&(0x7f0000002f00)=""/235, 0xeb}, {&(0x7f0000003000)=""/213, 0xd5}], 0x6, &(0x7f0000003180)=""/14, 0xe}, 0x3) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:30 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x40000000042, 0x0) pwritev(r0, 0x0, 0x0, 0x0) [ 694.211504] binder: undelivered TRANSACTION_ERROR: 29189 19:29:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = dup2(r0, r0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x1, 0x1, 0x995, 0x9, 0x7, 0x7}, 0xbc}, 0xa) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 694.406537] FAULT_INJECTION: forcing a failure. [ 694.406537] name failslab, interval 1, probability 0, space 0, times 0 [ 694.418264] CPU: 1 PID: 21838 Comm: syz-executor.2 Not tainted 5.1.0-rc2+ #24 [ 694.425602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 694.434998] Call Trace: [ 694.437675] dump_stack+0x173/0x1d0 [ 694.441393] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 694.446657] should_fail+0xa19/0xb20 [ 694.450578] __should_failslab+0x266/0x290 [ 694.455037] should_failslab+0x29/0x70 [ 694.459121] __kmalloc+0xaf/0x3a0 [ 694.462723] ? __msan_poison_alloca+0x1e0/0x290 [ 694.467470] ? ip_options_get_alloc+0x68/0xc0 [ 694.472164] ip_options_get_alloc+0x68/0xc0 [ 694.476664] ip_options_get_from_user+0xc4/0x6e0 [ 694.481647] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 694.486904] ? init_wait_entry+0x190/0x190 [ 694.491211] do_ip_setsockopt+0x3290/0x5f10 [ 694.495628] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 694.500901] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 694.506171] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 694.511430] ip_setsockopt+0x134/0x2b0 [ 694.515411] ? ipv4_pktinfo_prepare+0x650/0x650 [ 694.520139] tcp_setsockopt+0x1c0/0x1f0 [ 694.524195] ? tcp_disconnect+0x1cd0/0x1cd0 [ 694.528594] sock_common_setsockopt+0x13b/0x170 [ 694.533338] ? sock_common_recvmsg+0x290/0x290 [ 694.537990] __sys_setsockopt+0x493/0x540 [ 694.542205] __se_sys_setsockopt+0xdd/0x100 [ 694.546598] __x64_sys_setsockopt+0x62/0x80 [ 694.551083] do_syscall_64+0xbc/0xf0 [ 694.554858] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 694.560114] RIP: 0033:0x4582b9 [ 694.563367] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 694.582353] RSP: 002b:00007f8f4aaebc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 694.590130] RAX: ffffffffffffffda RBX: 00007f8f4aaebc90 RCX: 00000000004582b9 [ 694.597455] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000004 19:29:30 executing program 4: syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x400, 0x100) openat$urandom(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/urandom\x00', 0x100, 0x0) socketpair$unix(0x1, 0x800006, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000180)={0x1000, 0x2ae, &(0x7f0000000080)="ab37156669a9ec6c3aa89925388fd813bc9736fc234715ff0a51acd99cf80d63a3ff207546b89ded1b5cf3493920df270afd6fe07245b50f845c56b97c1f56b3470591b845f4020b01cf9082a9bce580327387", &(0x7f0000000100)="1fdbc8a17801bbca4fcce0837276da58bfd19f607185a26875d2e0dd2cce8b224d3ab92aec258ec1b24b24da14f0e8cd525e06028374e5e2b2e55d428b28d609e897db665c35cab04835e3f68c", 0x53, 0x4d}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 694.605202] RBP: 000000000073bfa0 R08: 0000000000000006 R09: 0000000000000000 [ 694.612517] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8f4aaec6d4 [ 694.619846] R13: 00000000004cc220 R14: 00000000004d9ff8 R15: 0000000000000005 19:29:30 executing program 0: r0 = socket(0x11, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r0, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x59d9748d465b0e14) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x309800, 0x0) mkdirat$cgroup(r3, &(0x7f0000000300)='syz1\x00', 0x1ff) r4 = geteuid() getresgid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={r2, r4, r5}, 0xffffffffffffffcc) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000280)={'lo\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\xce\x00'}) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x1, 0x0) faccessat(r6, &(0x7f0000000240)='./file0\x00', 0x2, 0x200) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000340)={'lo\x00@\x00\x13\x00 \x00\x00\x00\x03\x00', 0x101}) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={0x0, r3, 0xb, 0x2}, 0x14) name_to_handle_at(r6, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB="82000000fbffffff54e93911e409c600e093f3273fbaa417a0ee0ab115a03480224d29b9bc5849d15e92e757e19887830a56f023e5c7bb2a9fcfb40f5cfce22f8d052eb98e902ebc92c6ce158d06d56df2c8f6a0f9efe27603651a5a60757a8071272395ce4c89309a0278be9c4d3b9cab9b361bd804e8cb4e690000000000000000"], &(0x7f0000000480), 0x1400) [ 694.718644] binder: 21845:21846 ioctl c0306201 20008fd0 returned -14 [ 695.202884] device lo entered promiscuous mode [ 695.473642] device lo left promiscuous mode [ 695.617314] device lo entered promiscuous mode 19:29:31 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x0) 19:29:31 executing program 5: r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x5, 0x4000) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz0\x00'}}, ["", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004010) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r2, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000008"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r0, r2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r4, 0x40045542, &(0x7f0000000000)=0x24) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = dup(r0) connect$rxrpc(r1, &(0x7f00000000c0)=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e22, 0x101, @local}}, 0x24) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_FPU(r4, 0x41a0ae8d, &(0x7f0000000240)={[], 0x20, 0x0, 0x7f, 0x0, 0x10000, 0x1, 0x5000, [], 0x4}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000000)={0x5, 0x0, [{0xb5f, 0x0, 0x10000}, {0xbfb, 0x0, 0xffffffffffffff92}, {0x9c4, 0x0, 0x8}, {0xbff, 0x0, 0x4}, {0xbdf, 0x0, 0x3}]}) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:31 executing program 2 (fault-call:6 fault-nth:1): mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:31 executing program 0: write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="258ed6a218d6e29a959394f45aaed9e4e4560163592d9bd2fcf63e74a8f7d7fd98b700360f40ff6e0fceeb6f9752d240c47250a243451976bed5bb67c0c4e68c60c2ea140c4f8bd46d9352667a55e22f3312207734277f12d1092d5753eb8eb43e593d713ef03f575932e04229187781a6faaa10e589ef926fa09feef22e23c57d17c01108f46d909eba50d98ce0d35e2344018bfb4e4414eadb7290cbc9f864bc0d669a3303da116824e1d408acf0018394"], 0x28) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x8, 0x2) ioctl$DRM_IOCTL_RM_MAP(r3, 0x4028641b, &(0x7f0000000040)={&(0x7f000000e000/0x4000)=nil, 0xca79, 0x1, 0x10, &(0x7f000000f000/0x3000)=nil, 0x685}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x246) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0xfffd}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x30, 0x0, 0x0, 0x117) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 695.855832] binder: 21870:21873 Acquire 1 refcount change on invalid ref 134217728 ret -22 [ 695.875079] binder: 21870:21873 ioctl 40045542 20000000 returned -22 [ 695.895958] binder: 21870:21873 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 19:29:31 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000000)=0x100, 0x4) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000100)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x40000, 0x0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r1, 0x800455d1, &(0x7f00000000c0)) [ 695.903677] binder: 21870:21873 ioctl c0306201 20008fd0 returned -14 19:29:32 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x4, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x200000, 0x0) write$FUSE_DIRENT(r3, &(0x7f0000000100)={0x10, 0x0, 0x3}, 0x10) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0x7b, 0x0, [0x70a000]}) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f0000000000)={0x7b, 0x0, [0xbdb, 0x193, 0x1f36, 0x10001]}) [ 696.298683] binder: 21888:21891 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 696.306118] binder: 21888:21891 ioctl c0306201 20008fd0 returned -14 19:29:32 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xfffffffffffffeed, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044000000008"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) r3 = open(&(0x7f0000000180)='./file0\x00', 0x80, 0x1) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5387, &(0x7f0000000400)) fcntl$getownex(r0, 0x10, &(0x7f00000004c0)={0x0, 0x0}) process_vm_readv(r4, &(0x7f0000000ac0)=[{&(0x7f0000000500)=""/175, 0xaf}, {&(0x7f00000005c0)=""/176, 0xb0}, {&(0x7f0000000680)=""/124, 0x7c}, {&(0x7f0000000700)=""/206, 0xce}, {&(0x7f0000000800)=""/92, 0x5c}, {&(0x7f0000000880)=""/84, 0x54}, {&(0x7f0000000900)=""/170, 0xaa}, {&(0x7f00000009c0)=""/225, 0xe1}], 0x8, &(0x7f0000000b80)=[{&(0x7f0000000b40)=""/3, 0x3}], 0x1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="d95911f776d1c95a"], 0x2ae, 0x0, 0x0}) r5 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x10001, 0x200000) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') ioctl$PPPIOCSACTIVE(r5, 0x40107446, &(0x7f0000000480)={0x2, &(0x7f0000000440)=[{0xda6, 0x200, 0xffffffffffffe691, 0x7}, {0x5, 0x7, 0x76, 0x10001}]}) sendmsg$TIPC_NL_MON_SET(r5, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="7a2151c1", @ANYRES16=r6, @ANYBLOB="000828bd7000fbdbdf251100000004000500280002000800020009000000080002000800000008000100000000000800020007000000040004000c00060004000200040002004c00090008000200ffffffff0800010080000000080002006a58000008000100d0060000080002000300000008000100060000000800010000000000080001000100008008000200060000004400020008000100000000000800010004000000080002000500000004000400080001003307000008000100000000800800020003000000080002000400000004000400f400010024000200080004000900000008000200060000000800040008000000080004000200000038000400200001000a004e2200000050000000000000000000000000000000006e9863f31400020002004e24ac14141d00000000000000002c0004001400010002004e21ac1e010100000000000000001400020002004e23ac1414bb00000000000000001400010069623a7465616d5f736c6176655f310008000300090000004c00020008000300810000000800020000040000080001001d0000000800010010000000080001002000000008000300feffffff080002000400000008000400080000000800020000000000"], 0x1d0}, 0x1, 0x0, 0x0, 0x10}, 0x10) [ 696.708995] binder: 21910:21912 unknown command -149857831 [ 696.714891] binder: 21910:21912 ioctl c0306201 20008fd0 returned -22 19:29:33 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000200)=@nfc_llcp={0x27, 0x1, 0x0, 0x0, 0x0, 0x0, "95d2f20fdf1464c5c69edbfb0fa9f742063dfc186d4532384049d39ee6d276afa0b849e526346909282c70498ac6a55ddd3028068ba95d698504cf9bae25c9"}, 0x80) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000000)={'filter\x00', 0xd7, "4644db6053d816a4ad82c49f5b369ee8ccbf2807aa375b9d2074675651be001ffbbe6bb6056636004de053cff13770e613b8c926211f710c3e81007e23018ba1db81d5611d3ca8b173f2aaf96b0213191a1f4d9841b9e229aaa035d8da6951fb4763d699e4df49048c658a2892bc78e764203e2612c8afe7737ffaf19348b67970f96afc936afc03ea62bd621f4b92df18f3b455114dbb712cd94fd40ab30da8551ab9d68b3a11d8d49c49d164b9ee423e939342ef9978d631756eb9c952c293e3dddbe8a1e60604dd37402b682ac7d769815b5dc0c483"}, &(0x7f0000000100)=0xfb) 19:29:33 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffff9c, 0xae01, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x5) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, 0x1b) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$F_SET_RW_HINT(r3, 0x40c, &(0x7f0000000080)=0x2) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x400002) ioctl$PERF_EVENT_IOC_DISABLE(r6, 0x2401, 0x5) dup3(r4, r1, 0x0) 19:29:33 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000340)=0x1000200, 0x6d574447055914c1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000000c0)=0x500, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000080)) r2 = syz_open_pts(r1, 0x0) unshare(0x24020400) r3 = dup3(r2, r1, 0x0) sync_file_range(r0, 0x8, 0x7, 0x2) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000200)) syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x8, 0x10000) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) rt_sigreturn() r4 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x0, 0x300) ioctl$TIOCLINUX6(r4, 0x541c, &(0x7f0000000040)={0x6, 0x9}) 19:29:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f0000000000)={0xa3, 0x0, [0x70a000]}) r5 = dup3(r4, r4, 0x80000) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f00000000c0)) ioctl$DRM_IOCTL_AGP_RELEASE(r5, 0x6431) 19:29:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x7f, 0x8900) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f0000000080)={0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:33 executing program 1 (fault-call:5 fault-nth:0): r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 697.360102] binder: 21920:21922 ioctl c0306201 20008fd0 returned -14 19:29:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40c0, 0x0) ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000080)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r2, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x4e24, 0x10000, @dev={0xfe, 0x80, [], 0x15}, 0x1}, {0xa, 0x4e21, 0x7, @mcast2, 0xfff}, 0x4, [0x7, 0x9, 0xffffffff, 0x5, 0x1, 0x100000000, 0x400, 0xbec]}, 0x5c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:33 executing program 0: setrlimit(0x7, &(0x7f0000000000)) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000000040)={0x0, 0x80000, 0xffffffffffffffff}) close(r0) socket$inet6_udplite(0xa, 0x2, 0x88) r1 = getpgrp(0x0) process_vm_writev(r1, &(0x7f0000000200)=[{&(0x7f0000000080)=""/123, 0x7b}, {&(0x7f0000000100)=""/250, 0xfa}], 0x2, &(0x7f0000000500)=[{&(0x7f0000000240)=""/242, 0xf2}, {&(0x7f0000000340)=""/179, 0xb3}, {&(0x7f0000000400)=""/167, 0xa7}, {&(0x7f00000004c0)=""/60, 0x3c}], 0x4, 0x0) 19:29:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:33 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000040)=@sha1={0x1, "657e27b60148515852bc3f982e6c5ab75cb6158e"}, 0x15, 0x1) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 697.645434] binder: 21933:21935 ioctl c0306201 20008fd0 returned -14 19:29:33 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x200, 0x0) recvmsg$kcm(0xffffffffffffff9c, &(0x7f0000000780)={&(0x7f0000000080)=@can={0x1d, 0x0}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000140)=""/194, 0xc2}, {&(0x7f0000000240)=""/121, 0x79}, {&(0x7f00000002c0)=""/56, 0x38}, {&(0x7f0000000300)=""/98, 0x62}, {&(0x7f0000000380)=""/157, 0x9d}, {&(0x7f0000000440)=""/228, 0xe4}, {&(0x7f0000000540)=""/170, 0xaa}, {&(0x7f0000000600)=""/221, 0xdd}], 0x8}, 0xdaa4344225099ab) stat(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000880)={{{@in=@local, @in6=@local, 0x4e23, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0xa0, 0xff, r2, r3}, {0x401, 0x0, 0x5, 0x10000, 0x6, 0x51a9, 0x5, 0x80000001}, {0x80000001, 0x98a4, 0x6, 0x2d64}, 0x3, 0x6e6bb4, 0x2, 0x0, 0x1, 0x1da505a8b217a547}, {{@in=@empty, 0x4d6, 0x3c}, 0xa, @in=@empty, 0x3507, 0x4, 0x3, 0x1, 0x4, 0x8000, 0x4}}, 0xe8) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x4, 0x0, 0x6) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) dup3(r5, r0, 0x0) 19:29:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f0000000080)={0x3f, 0x2, 0x0, [{0x7, 0x9, 0x6, 0x6355, 0x200, 0x4, 0x800}, {0x9ff, 0x800, 0xdd, 0x3, 0xffffffff, 0x7, 0xfffffffffffff3d0}]}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:34 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000000), 0x4) ppoll(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0x5, 0xfffffffffffffff7}, 0x20}, 0x10) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x640100, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f00000000c0)={'HL\x00'}, &(0x7f0000000100)=0x1e) [ 697.958690] binder: 21951:21954 ioctl c0306201 20008fd0 returned -14 [ 698.026997] FAULT_INJECTION: forcing a failure. [ 698.026997] name failslab, interval 1, probability 0, space 0, times 0 [ 698.038595] CPU: 0 PID: 21957 Comm: syz-executor.1 Not tainted 5.1.0-rc2+ #24 [ 698.045926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 698.055439] Call Trace: [ 698.058098] dump_stack+0x173/0x1d0 [ 698.061794] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 698.067059] ? __should_failslab+0x266/0x290 [ 698.071533] should_fail+0xa19/0xb20 [ 698.075349] __should_failslab+0x266/0x290 [ 698.079738] should_failslab+0x29/0x70 [ 698.083695] kmem_cache_alloc_trace+0x125/0xb50 [ 698.088437] ? alloc_pipe_info+0xdf/0x8a0 [ 698.092833] alloc_pipe_info+0xdf/0x8a0 [ 698.096890] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 698.102335] ? splice_direct_to_actor+0x6c/0x1140 [ 698.107238] ? do_splice_direct+0x342/0x580 [ 698.111624] splice_direct_to_actor+0xdc0/0x1140 [ 698.116431] ? do_splice_direct+0x580/0x580 [ 698.121097] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 698.126523] ? security_file_permission+0x268/0x6e0 [ 698.131614] ? rw_verify_area+0x35e/0x580 [ 698.135828] do_splice_direct+0x342/0x580 [ 698.140063] do_sendfile+0x1010/0x1d20 [ 698.144038] __se_sys_sendfile64+0x2b1/0x360 [ 698.148509] ? syscall_return_slowpath+0xb2/0x650 [ 698.153431] __x64_sys_sendfile64+0x56/0x70 [ 698.157807] do_syscall_64+0xbc/0xf0 [ 698.161592] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 698.168322] RIP: 0033:0x4582b9 [ 698.171925] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 698.190898] RSP: 002b:00007f81bb558c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 698.198680] RAX: ffffffffffffffda RBX: 00007f81bb558c90 RCX: 00000000004582b9 [ 698.205999] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 698.213404] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 19:29:34 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f0000000140)='\x00d\x00\xec\xc1\x9f\x15\xba\xcd\x06\x00\x00\x00\x00\x00\x00\x00\x03\xd0\x00H\xd2\xea\b\xde\xab\xed7e}CK\x8d\xa9>\xe7') getdents64(r2, &(0x7f0000000df0)=""/528, 0x7f355eb8) 19:29:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x3, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_KVMCLOCK_CTRL(r1, 0xaead) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000000c0)={0x3, 0x0, [{0x0, 0x2, 0x6, 0x7fffffff, 0x4, 0xe6, 0x80000000}, {0xc0000001, 0x100000001, 0x4, 0xff, 0x4, 0x3, 0x9}, {0x8000000d, 0x1, 0x1, 0x4, 0x2, 0x1, 0x3}]}) [ 698.220807] R10: 00008000fffffffe R11: 0000000000000246 R12: 00007f81bb5596d4 [ 698.228395] R13: 00000000004c5227 R14: 00000000004d9368 R15: 0000000000000004 19:29:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = getpid() getpriority(0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x1) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:34 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x10001, 0x0) sendmsg$netlink(r2, &(0x7f0000000780)={&(0x7f0000000340)=@kern={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000740)=[{&(0x7f0000000380)={0x39c, 0x3d, 0x1, 0x70bd25, 0x25dfdbff, "", [@typed={0x8, 0x6f, @u32=0x3ff}, @nested={0x1c4, 0x38, [@typed={0x8, 0x74, @u32=0xffffffff}, @typed={0x14, 0x2b, @ipv6=@empty}, @generic="e9964682a0b45690c67c6df10d695378251243a9fe8943d9786bbe51f5897286c0885a6c55eb591eb00b5ee53bd97ef7ba3080d08b7d257222309208ada62f0df8613d95a5e342e82448714437f43089429f8d0f7f593574a626ef828453d6685520c71f1ddf3b08e90d106b7af74ed002f178a3f9c22e0a8563a62a57dfcf9fb207dd1a80b2b0399c0747839c62def0", @generic="2ef0efb658409861402f7e05db76c3fc6526f6bd2773d2d79f928d5bf41b74c8aa341b5059a3be66646d5519d9e65614038183b0a85767f867fc6bab787dc8f744859acf2e199131ef460a1769e183", @generic="5754c6d23762df13f1802b31221dac8ed1d01130dbe696ea3e62109f39c4e29da38024a3ffd6c080f152cb3f886322e91ca35e2a5bddc8b0b209caaf0c07dfea1759d02c704f1a5f1cf775dc45fe718dec6b89f6661e80ba85a8827243035c41bfa3773254554d0e13916032c363bc7cc18730bfcd7f3481c0927dd9da46028ef58e7dfec535d1e91c85f09623cb30de1488031501e87b25410b89f169ca30adf73e3d3106a27cefd2500b1a", @typed={0x8, 0x8f, @ipv4=@multicast1}, @typed={0x8, 0x18, @u32=0x6}, @typed={0x8, 0x46, @ipv4=@rand_addr=0x3}]}, @nested={0x14, 0x25, [@typed={0x8, 0x78, @fd=r0}, @typed={0x8, 0x71, @u32=0x5}]}, @nested={0x10, 0x2f, [@typed={0xc, 0x37, @u64=0x9}]}, @nested={0x19c, 0x92, [@generic="3edf738f6fd79c954e2f32e167c3e263b888387d4db2f697ca0f84415d9e638f5baa77a34216bd81517963ce2cf1c5c3bd7da05e74040a2530a1285fd69c667b39e86ae56b27a9c7f439180dae97b612bace3cef1ca7ffbdf738b326036fb2f08b5f381e5889a37da47af778460370d2514dad2cbf8d9dd438b8901c83448c", @generic="e9bc162b5b5ba2", @generic="8f211b3732390e74e72355a438c5ba723a55add269616dc40e4f231fdf496d58f2d77c640076825fa26a83bf3abbd8362b5154574b2de998fe0b216ade7b9984ebbd630ffe32c5445e04f523d4994d8d0dfaf9f14d11e038782eab2d6bb0aa7857e4057b1456e7a35fa9de89448cb37bb744d0fe11be90f25b59685eb051a50ef1cdbf9aa7b2b14a2f0164f78a6aa4fb8c9bdf32bc5b479ee1bb071071b0669945de221337b2126f0b3e8268face415a12b18b94f1d70fd24ebb0f218f11255d8f82f4bb410c1fcdc57f1829f3265c36ba3c698623eba9238607e662ce96727709a01232142f5e0edfd87af549e4035b", @generic="14317ba88bf46f3fa79fe8c497fc6e5ce6a2fb7838d6764752d17f8c78621d0d"]}]}, 0x39c}], 0x1, 0x0, 0x0, 0x80c1}, 0x4000090) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) recvmsg(r1, &(0x7f0000000300)={&(0x7f0000000000)=@un=@abs, 0x80, &(0x7f00000000c0)=[{&(0x7f0000002040)=""/4096, 0x1000}, {&(0x7f0000000080)}, {&(0x7f0000000140)=""/179, 0xb3}, {&(0x7f0000000200)=""/234, 0xea}], 0x4}, 0x40002001) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f00000007c0), &(0x7f0000000800)=0x14) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) [ 698.435335] binder: 21963:21970 ioctl c0306201 20008fd0 returned -14 19:29:34 executing program 1 (fault-call:5 fault-nth:1): r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 698.477790] binder: 21963:21970 tried to acquire reference to desc 0, got 1 instead [ 698.505489] binder: 21963:21970 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 698.515086] binder: 21963:21970 ioctl c0306201 20008fd0 returned -14 19:29:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c40022cb000"], 0x2ae, 0x0, 0x0}) 19:29:34 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f0000000140)='\x00d\x00\xec\xc1\x9f\x15\xba\xcd\x06\x00\x00\x00\x00\x00\x00\x00\x03\xd0\x00H\xd2\xea\b\xde\xab\xed7e}CK\x8d\xa9>\xe7') getdents64(r2, &(0x7f0000000df0)=""/528, 0x7f355eb8) [ 698.692516] FAULT_INJECTION: forcing a failure. [ 698.692516] name failslab, interval 1, probability 0, space 0, times 0 [ 698.704086] CPU: 0 PID: 21982 Comm: syz-executor.1 Not tainted 5.1.0-rc2+ #24 [ 698.711418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 698.720905] Call Trace: [ 698.723585] dump_stack+0x173/0x1d0 [ 698.727289] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 698.732579] should_fail+0xa19/0xb20 [ 698.734426] binder: 21984:21985 BC_REQUEST_DEATH_NOTIFICATION invalid ref 11545602 [ 698.736385] __should_failslab+0x266/0x290 [ 698.736438] should_failslab+0x29/0x70 [ 698.736480] __kmalloc+0xaf/0x3a0 [ 698.736555] ? kmsan_internal_memset_shadow+0x104/0x3a0 [ 698.744529] binder: 21984:21985 ioctl c0306201 20008fd0 returned -14 [ 698.748581] ? kcalloc+0x93/0x110 [ 698.771369] kcalloc+0x93/0x110 [ 698.774897] alloc_pipe_info+0x571/0x8a0 [ 698.779039] splice_direct_to_actor+0xdc0/0x1140 [ 698.783885] ? do_splice_direct+0x580/0x580 [ 698.788296] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 698.793744] ? security_file_permission+0x268/0x6e0 [ 698.798834] ? rw_verify_area+0x35e/0x580 [ 698.803080] do_splice_direct+0x342/0x580 [ 698.807353] do_sendfile+0x1010/0x1d20 [ 698.811368] __se_sys_sendfile64+0x2b1/0x360 [ 698.815853] ? syscall_return_slowpath+0xb2/0x650 [ 698.820782] __x64_sys_sendfile64+0x56/0x70 [ 698.825179] do_syscall_64+0xbc/0xf0 [ 698.828961] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 698.834277] RIP: 0033:0x4582b9 [ 698.837528] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 698.856686] RSP: 002b:00007f81bb558c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 698.864460] RAX: ffffffffffffffda RBX: 00007f81bb558c90 RCX: 00000000004582b9 [ 698.871862] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 698.879176] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 19:29:35 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x598, 0x216200) r3 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0xd21d6700b6f5093d) inotify_rm_watch(r2, r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r0, 0x0) [ 698.886493] R10: 00008000fffffffe R11: 0000000000000246 R12: 00007f81bb5596d4 [ 698.893820] R13: 00000000004c5227 R14: 00000000004d9368 R15: 0000000000000004 19:29:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x86014, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x1b, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="03953c1e536308406b3b68e45c1a9def9758074481c90b6e100904b9cb9c5109463fa3dd561a2853c4efc8bb4642c9c007cbea6b4ca73816fdceef18550dc1c135dcae1f41c034ec50b39652cac90b9463b1ac96e45dfb64b4a8142e2cb70ceb3afedd3e58f5b56d1e197a44cc0ba6a8eecd1aa5ac21b14f35d5a61b22a0f0daf2ad2c179b595f53041c310439fd6f0eaa8468df45bdf6e0c6b490181c4d113f53cc2b54f8638c2110f78ab141fb2fd71ab6601bf646f39a7279b64cd4f787fe008fb535d7202a57a731a90d2c", @ANYRES64=r2], 0x0, 0x0, 0x0}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x0, 0x0) accept4$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14, 0x800) write(r0, &(0x7f0000001040)="e3c6fb5f1533d780ee4f22d547530d5a91bbbee1110544b7935e026637f103405c41f6898abf188e0d67a70cb04a5d9f737416711f2d5dbcfe213f15cc642ac3c0a4b208a50eb4cc8e39c10376f976bab14be01b28eba7e9e949947eff534d184894bc81da75173c4ccff40c1a05baa45b2b1106abbf10e1121e5496938ed1ed63daacebcb1c1cfb89a3935482e9d42506c05cf3b3fe3c4940df73c51683ba7d8c48944b3154e252ebc1a0210a145e638b0278092c1420ff4e34643d5894b0f158db0a2234eed0cbe19422c6d2da08c6108e3b43dcbf9b88b5d11df3154167fc143595fa47b5beba4102e895f529d1b2babdda89ff5aa42b9fc52d916555da07ee09197e32c735898c41e78b1abd9edd4f127a5cddf0391a3f33984169b363e5f8bd12c56f7e24545f32d06d305917c6a9ab7524a14b1da5e5dbd9701e0f1176fe3366302e84a4a06d3633ade17aa3ef7bab8e467d95729d61cb5815592933d025edb4c478428996814250d9ffc85ebb285298764c76c720828c72d163342e0e684af4cc4ced89d0e9dd09c0e23bc7e8ea32c9c441d9dddd306651b296431ec076ba57afbe7c0ad1acf28c0aaa737f1e31345dc277e960ce8cea9fdf7affc9cb81a47dbdd637bbc9ed1b4e09e9794500262e822545d5deabbe8fc039612c395bca2cbf407dda2faa33393afd39d23747c2c8c6ae1794c6fe0d0e2d3c8e58b6f3c3b2488bcbfa8a7c4655264887ac48757a68c06652294f34891bf71c623be8f58480bb8888ae8fca233ab49bc34597b524a522c362c5d13c6f30db5d5866caec40a153e36e448651c58957215408eabeeed86c88830ed72454a10f5059a8ae87b5760aa37a541560ed84a09f696684c58be4cec5cabcfa1df583a988ca0309bbfd1edb23356504d4882a98231cc1d4a1827fbb13faaaaa87f228f2d5250cff878c9d3b6ed3f5a56c17f26ac8ac0cfdcf0c56d67f9b6566f41a41708c5df78bc7b2eeb638388e26ad9d80f7b9e434a324f793ab297de719cee742b1e297ba66a9dad31a4d4261d0684e51e343233552401c2720723fba23708aa6ff5080f44fc3905713f802f9e7b2c0ae2f3850ecbc41f63cbb75a0ebf9d9b0aa937fdd389da151848bf45422f530c8ace1c9f76b02f883c0c498472436449c402ec9dc2b41abebbaa069792180133e57c6d0862a1985a91a2b523e136f2617f21abc762f10d8c708569e50b99863653c2c2a0ef786fd9930d3e793b36f559485c50a53cc4c7c829ea93e44ee10594fc5f1d9e1e2c9b36672437d6e530aeab0619bb6332e37d2d5e9afe9989e4a18bd25d6d450c9fc7a321ae3b903459307376f07c4f1e0dd23bdc01b4ec224fce7376a1b7055bcb3b4194b6402aeffaea93910525aee13430c6eeb60f81706b702abf002941d5fa251dca4985b261f3f01cfa0047a8641f6c8fb74d7dfef498bd06216b0a9c4001281f8ee198ae163c8739c5f8da9371ab73ee673f992ac5bb4e7f5ffb47cf82338c4cfd3aad1ca33ceb3bf89e643f631c7cd254301427276ce6a7ed63e689c14720474b168b7fe401f8e216c9454293c1edd37f2a6f64cc88fb57c3e3ba269bfa48a41886ea8c89fed227f5c588f65f7ed0a7e55b85b96227e92904821894feb827122a5620c04162a808a2a224940acce0a54b956b1c1f5a5cf730882efbf1dec26aa417232f86fc29fbacd762f7cff50b2f13dbe5e0e19a6808bd70f702a76a568078b86e50bbd41f16be0f3e6735f77b0d3f56f9a68b3d437d3d1346f1bc2b4c58b2aff5aa2c18daa2b9ec628a01de62fee18126b51cc8b56f33968b0878411021fd1f37244553ea512d3a20ea14fc7c56fae265119081065f4941972dedb3faed2919c7679c6299c29a6e14b375fcd1397e920ec329a9b1c05a3cc09794872e4f446b540fc95e659107d27bf5cecd8035b87aa6ab1e5f2df3c50a4e540e67e1419f36746e246a240600fbd18da0660f50fcc7cc3cbbdd0b6ce602650fa68ef71cb43edff80cd671ad3be12feb491966d2bc30edb2e842969d850fba9745a317825800c94c5301bbcc18ec5f91fcff6b42f00e0c2ec90d328dbe7f8852702fde9e2c42452117e6f3a0651e2633d77f32707b1c9cbd31b1691b65cbad5c83d12de231672dded729d84986e88679d539589af3a1497f9edda4bcf027217f19c97184ad2d116b1e5d3c2c5fafd5a9064a7cec33b1fb696403d75102d43f8ca5504e111d4b1d451c8b1497646ee088521e7ad99328ab47c31c9d58d2c3affabdab1a9b72f44470c729b6abc091d534b6f116d58cb25a48a88664970c127ebbf6f6dd0f175128ccd79598f3fcafadc00f7246588128514a2962d973f148bb53c13ca2fc9b99d47f699719040b5a41c82c23515b4cc8560764f37e6f11127af1226960a1f937b0d1c4e124ad66da425e69237696bcc76595c54e698fafc302eb8c35a373c9ea9a862dab2528434765e7c140d7b3f9b20bb758f11ff8328da314ebfe815cc69becee1fe9ca0bbd8a6fa819747679879c833d39242118c1b5e48848a7a3fcb216d0c07bc8c94184631ef17414e88550830e03057665e9ad56b28d036cdaf5a49212b73d831a8560413b7574106d7d7806e198725ff851baab60aca3ae772d8988d2c750adbf4735454db1d9109a0c2ca9b961397c88fa424baa4d75d71313f4b3e69fac82e781c13cfc93b8734dd7e17c62b94dddf4d24583cd9b73fa6f7f72489fedacc33573e215fc21509266119eaa6d0e291b676330cbf1d65f4a6295b6a0c82f65da8486318d0839bea2af192c9fd2cf30f2d4f9b7b52e40b64a6515cd213589ffe9446a7b7150a3418b96904b9617565339181b3ab8571c66c85d8bf2d9ba089dcaae4be96268ec3e42d13d9db45ec520a6875f1b7811b55b3106de7a40d8d64ef4f049f51147d187b3ea940abe45a9cdae4687b11cc59f2142b314d7a5a425e9f926daf7c38a99fc35dd4612415f5478a69e70510d9dcf4692029ee495e5b8c25aa97f3a411535e5fc396adec30861a5055abf7e66b4578b4aa537294e04c7be65a8e8aa17e4b097f2b356c5f02d5aa373d3ea5600b9a1e3f6945b12fec18f3462655941260c2fb9eed402981d9062fa4a1c08479210b9dc6b3de915e31b2427efc727f51600a8d7762fef5800f960b5ca6180a8b0490f209ba1b67a556caa64c9e6d19965752dc30ca2e64e1e7b5efcd96d45a326d511efe488223a100570fd6c3d13657c80734fb813aa5448d11efc1c29cf6e54538b459ef4da654e9613a65553ee295dc67ad8c1c7b395dfd6ae24a874900cf7fcc4172b37b48ea5346344f2c699df26f486e008f6acc6d36cfd16f9f159589ae866888d92a3e1ff2f6f3e32b25c0ac0b5b743cd0b8a3b67d31eece3737b251ec96ddd89f8fb81bf93843a6e46ef129d68287c73d005ca37410a4e145f464f5ca4f81d62e867f8d8a75addbe09443b91762dc241740c62049743df3cb42004a1d2bfce211c5d9b7ae4e100a991514d9543e9ca66675a82df4454a0b0da1973af53867ffa8a24a34ea095e39d5c32cda553f1726e639332dd1eaa8859ac2c6566f0f918327c153eddfc2812225d4f5baf5825b4460626dca71e2e9c54df6def5752dfcda25dca5b1c7836f980a26b5c769e023de4b8216a480dd7068b4f0b93479e7cc53de784e4db69d6976912e0116dab4e5fbdcb734a95fb97ac5d0df14226435b4f4d84e98670dc0ac7c545eacbb18716b969bb206840b44015c581cdc42c7600e84aab75cb144e2203dd3d688c7cf04121c82e03a9c769512270f607fbe82c896b2f88a7bb6e5d3b0364ef5719c9e6a13dfab90aa9483d1ff17c3e5a41c950ccbfc4e058a247cd59ae88abee6129e7b8bc079bfb10a3ec89e66b590fb801fccf347fad9098879702ba49997421685feb7933414014c0994419c787a233774747f806c98691f46c430cfdb2fd527196aae7ec351432cf30f6623e3aa4d16c592490e23f1c09e7cb460e637cc483eff02a45ed81b5db448d2e015b114b2b9575be9defab2276c6f262a0fd5ce86118756189782425a3502a56aff4beb616f68f8b22e7e005934016e903d970637dc299830352e7e932579fd816f184b43f1f3cccb5be34206f0e546aa569a3ab1b8aa74ed2b00e4155a1c262da787d4a608941077c597caca8ee3aae53f90ac52ee07f0c8261dc5f7b285b7424f4ce37f1f2307f2ec0ae9af9d8b77b52b3c8391b07809499bb4f2bc07556aa4d11f3d10d2a97c542a5031dbab42816f83d4a7b9d202a6943047567c7e991e517199fd8d0d6606d5e61ab3a28cc2b6702230bb343b99509997c032b8b29484b8fb11dc7af352164dbf449d08f17b041aff38f883a1546239af84cb1eb4e3c7bf6d87cf073d7667024d01224f48bea70bb5d9ddee07f96f82d0172de0f85717acc4d29c25f62019d93f58d62f3af784c890d340a657f1c33d1290ebcaca17ea33dd3475fbac0a26725612d32f5aa9e8968b95cd12add216ab16ddfae787cd56af5e46546f2ba076c8cba44e31cbf7859dbed688ea80bc790c537dcb742a485d70b51fa4ceb624bbe5a175b52c0572323397adf89f97918f9e8e9e116dbbe28cd30d4718c55811878ef35311a301e975a877a7a804dfd7bb98d70a8bce514054a87ee354653b9a99588dbbc30c62514954a0670b9a2b7779e68076c447255ec1ce3307d5d8c948644ce79d4a5634882e6c42baf7ee186eddd7c77ff6a746ba1a6acf8f3478a26e47a934888e5498250f6b5905cae68c3c2dfb3661036f58dc00438330fd14637c78efef69814d26bd88e688f3a8c33e61ce989d909c0323495da7ac3a20576bea3bd260045189477f78d16baa7cb3fbafae854b716f88782d89fe47a048876a08bcf4a6c8056756adf766842dcd65f781b80e4b0efe8434716285e9aa38f752786fa88a53d6007599d89a07bb5681f84e55f1141f09dba603f4a14ce2f1e992645cea81d1a50153028ce26e48f9d16fcdffb28ed8696bbf28171d2f4c4db198f04e812fa2d519b1fc2594382b35436c2c63c07552b37592199498a184e62bbe336a65f0692661d29d13ec0ab6998550d3920001da5a52ac9f2dff8b80cbca9794c30827f85ba1e9c8299e3f7748067b490378f18a050dedb77681055792d74c93121415ea048f310f4d22743f6439aeb41510b0222133e2aa7584f8646d9b1554ae8edc3a988d7e27635de0a4bdc2accd24eb562b23066d0e3fe6583bb1b92963b1fb866ec1b7461f383fd7258f5080da8b8c0cd3a8fdbe6e5abc382052c485105bf866213d397cb83af2582a508fe915b58238751ea11860cdb6ce7cb7038b1fc1ab04e74f64848e997f361af59ebca91072c87cb82ccfaab1eb29c2b82472e695ca57dd09346345c6d5f4b836ce6e12fca1fefb16ff620e6ddbb3ddfaec67281105362b7fb9e8c54d2b4699237ebc4dd1f90402d7e1445f702134237cf296d7618554127e5b3c2148a5a73485aaa1532d9a12b2c7ace23e70a88193dc83a114a19034b497675e370c17e810f2bd4fc579928ada322aedf3dd802a4a172e811301fdadfb7956bc1017b83eef53860af32b750dd2e1df47999233ec141c6031f4775874e580bc2b7d7998eb22213ef6575ee85d89dd1a944763bc6fd43af2ccf9c97af58d21cfbb4655e2b0e0e3912554a8f88802246182da60e62c7981bc7a24e8158689ff6520903139614a30b2b23aa40c1d7370c8910e8ce11f7fa160a7789eb63bcde30fd9c7103518f728afa62af4e0d95562", 0x1000) openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x10000, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:35 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000700)=@newsa={0x144, 0x10, 0x621, 0x0, 0x0, {{@in=@dev, @in=@remote}, {@in6=@initdev, 0x0, 0x32}, @in=@local, {}, {}, {}, 0x0, 0x0, 0x2, 0x1}, [@algo_aead={0x4c, 0x12, {{'gcm_base(ecb-twofish-avx,ghash-ce)\x00'}}}, @tfcpad={0x8}]}, 0x144}, 0x1, 0x0, 0x0, 0x1}, 0x0) [ 699.091084] binder: 21994:21996 unknown command 507286787 [ 699.096948] binder: 21994:21996 ioctl c0306201 20000100 returned -22 [ 699.164681] binder: 21994:21996 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 699.172068] binder: 21994:21996 ioctl c0306201 20008fd0 returned -14 19:29:35 executing program 1 (fault-call:5 fault-nth:2): r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:35 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x101400, 0x0) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f0000000040)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'veth1_to_bond\x00', 0x1000}) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:35 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0xfffffe88) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = accept(r0, 0x0, &(0x7f0000000000)) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') setsockopt$CAIFSO_LINK_SELECT(r1, 0x116, 0x7f, &(0x7f0000000380)=0x100, 0x4) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f0000000140)={0x68, r2, 0x8, 0x70bd2d, 0x25dfdbfe, {{}, 0x0, 0x4109, 0x0, {0x4c, 0x18, {0x8, @media='ib\x00'}}}, ["", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x40855) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @local}}, 0x1c) listen(r3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000001600)=[{&(0x7f0000000200)="4bf792c5ba6bd55b443e80ec0f1d142d47105290f1bae9e531c3fcb129d4ca7076078393514278f416b54136e1b31e7fc6523ab5059958bdb612e0ba682664c3ae4849c2e135a7eb677e89c2a5a021eb82bc7e071cd484dc7d99cca89568692bbf2bfe0fbdf660802fd2eb9b2179bbff49ecf060c4fcd2796dcd6e574186f4f70c5b05a97febd8df5deeecfc7a155d225bb0464698e55e5fe9867ddc4d035999fda1310063324297bd7ced85faf0e60ea9c2d4e9444c7fe4b81303e56f841c881a9ad28ebb1d0089ee76eeeb", 0xcc}, {&(0x7f0000001680)="5a420855471bb1dc2c61528c37585ebc33350b6a4da82fe7f0ae4833631f43ea5ed2765612899c83f2edff23936053df217e223e2deb954a483bd721e9156c856291eb53c963a23894844ce8b748ac3d89949e61119111b6a851e8c862e82a21aac446f8bb03385530be3cd661a7edf19f7f45753b41a775d992182f1d631a99566ea8b44cd5fa4fc63800bf42a5ce4ac2205b97e859181ce8b3167eabf29af4ceb6e8beba87a55a80be55e5b34a09ed3afa3b8039163d6ccce46a60d853447057b46e7a513b5e04cc94b2003ab7eb4237712fbafa54403b7919c012b8ee25d8f6e3ce06eaeea571d62aff6c87fed1225b7d638b26acd82f5dc0a0b4e9eb746154c84602fd55928682e54b37b36fd178fe43645c3a1a7f4b1f9553c41d0126926500796137f50ce989ccca1e42752640bc303826fe3df5fd26b2e35c7874036c5946e2bbb92718907554d3621491e01f8fe138ba3c05304493e4db1025afb864f407cdd6fd956046406d920bc09115cb677afa8ded588e79c95e02e268a83c8ffe6d0af3333f4507eca8a316f8f543e6e44e016e6fb8ab569405b9eccf60bafb92d273eb88a342fd4dacafc8a880bc0b6bd63a7b0ffc00997035008bc6676988b48d34f186d36ffa23dec525c9feb7081fa0fe315b86e34a6b4a1d75a5dad9d7c4f3f037d6ced91db913e568a72157519821e1ddc4e04e26a1a9159b8e00b9d06c486ec34f227f529d2a2ef8f570e06b6eafceef81e82d72e370d248b1c9cdf3d3af8aaaf52079de35a5132f12205bbf8f063279c46a38a3a606b95018325b34ea7e04226b4abddab53ab5c8ccfc918b87f3187076d728a27eec43bf9e12b33a6298367fd6ede25ca6e5701268836beb9a00721b7f2d7d50f488a1f62b037c739dddd10c1689dc8167c9819543bc885e0d20ac38dec98a8d42c4ca8d2b647ba578d0a1cad212f03fdbe0ed71357c9d43903033847c9959eb4f357512b0d3a167cfb2cff67f48523057ac0c6133b4590908f90370322d48498d3b0ee288e3980e76c7554a0756d6a9836c0a5f1b74259bf8208ad990efebc1d0d092915a4216260880df9c65693acfe5f68fc9e698eef4caa7c9a7da8d8f4b36078b074c3ae03720dd291f2be0ecf90696710cff9d0b0465036984ff355cf2f7f5b8cc1d37f951a25d0c1c686adb0fcea672404fe954b7b24d092bce447a1a9b56ef9fb4405ee553cdf515c5095daa88ca24f72e708ab27ec6f4719a553901f2faaa8d148e16d0ec1361a9118b16071cbfa6e36c514438a4d604cf4a0c8703334a26fa0a4629e1a4f0dc665ff75900e21527de1e0b840a86b08bddd002568324b6f11220ede1924b5d07311adde09a58e14135a4c59e09e1c93fbc4f0ec11b8e598f750a7043577613ec37b0773435f1315106d8ccca7d5c7836c402b2ac6baf3c59dabfd56fb76e6b0b127cd3ed396e7f983a11164d82fd42fcef996502ab05e58256304f21a282ff984f7b4988b32afb2c5506044200d81e0e84a60e2a5844230c16e7d974d0f7563a4053d8531506dc5e60ed75899173843bd0fdb7907cb8e441014108bac1002011594e4d961845ca4ee50f94abcc9421bd76fef37b411b5a12d5c0fc645d610871ea9113336ea70529bcae6f4ea5d71e8d2613492fbc0dd610bf16c8862eb6a8f9701a08e73c3ee913f2f69bd1b0d4bd60523d889ad8ed26d5c5f0d146e6a2bd3061cbb25ffd6894c959968bd97b93bd79865e982dd422f9d86d3920383ce7b3d655462c8f29e510eed33192cf5178224bcb003b0577f9bbbf7d6b5372424dfe4208d6f2f2874c9cad8e575d1900e8a206000000be3c6fe392480eb27d1d34cc397c37eb9659571147b60a8958299c8570cb7cc39215ee39deb5399e12b9c82d6816da7cb8adc44f83278a0d756cf0822fcb2f3f659a23e5986eb9a2039b91125320a1393786757348ad279930fd8568c9c8ebe6de99cc20d1d19a1ff0cccba9bd40e857eaec82d88c661272cb00ca60ca8d7020ee062b645fd147f3a7c1f103e43af690ef59fd6380175fa96a7f397cc0d3c8b4952382922d88c7335480257ecad3265b9a3222a3111d04367a83c5ad972fcab704b451f71221dde8ac5cc58ff4668a1275a04a94c8dd44bf7e58dc13eb822162cd2fc3740b0af8195b7374415488abc35a3be88d219add89f05ef8f3d8db130b2d76163d3dafcd7c38ef645ef0d40b658c70171eb119360dacbc5fe77389888af90725b3e78651264ee1ce3d89bc2143b0f884474040b681031c6f31fef26bc887e867e91d2a43fdfac4e3d8fc95ac9e1c7808a27ed37fd0ef8598d40e43b9073ce28c5af69ede77bad37f84011843356f91c3c84c27d89e61f1a5eab842e6f7814331a5e4a34eece79bf8209b0be14973040d07c3bfbebd7c3935753eb538ad206b12e1a5815968632c80598d1a21164aad694ce112985cdf2115463b41d119d7dc4d7cb6e6dd009ad8e5cd1f81c1ddeb735b5721cfd04d375234e31d1b79d44232ad21a488f30c46ac0f850c5c9d2a490a6eac87fd0194eb0b4831a2a7ceef8f7a5d5d5d7c5d6ae7d97006c6335d33280e62e78aafd0d601b6233aa7c56a2adeaa0797455955b38221d77632a393609210f61e525646e9a312bdc9d0b51a22ec36a2bab8e4f5a05af18854bc5c4928f23f06beab0af346696d7406c85ebb0e340497ac81a016faad86c98441825d59e7eb34c6e1324e0db9650d8b7aa49e963a9da2aca968cfe46f04f5cd9506c78580fca7026077b11bb9d252ce1d63af2e0881290b2e5b61538c7a50663b20e396eaa5757c61c2590e4b8995e0ef703495df5a8fcd1b8965e99449227901ffaf17cd3a1e7b318929abcbd3872398bc0659b4dae3c959a9016539b05b90a1afe416d8bb2869c2780f2855181e13ab682d3f952e3904315e8c7f29d059d510324dcc9d9b344f315614108a1204c802606580d6392c661d0533958498e5edf1ab7abc22f1cce57ff2b61a4377886189a743def55bed3bded0af22fc8f95df2b9de5dd96f7419ad3135869e2ae7a3418179731b513d9e4479b68ec3942498712f6d4d24c71b36428b9907b589e5ad4eacdf3747798046bd48eeeaef42def961574acc3492124f4d2f7499e21f8c1161046ff4bccc03c5d846493214db7c4be97a44c171825ab6c082820442c880ffc055798eb386879f54d5148f2e25acc4ee72b53c1f0d5f86d44d55ce56d966166ae709172e01a61f61a937ace9583156e1a19ff38fe987d31b54045f985d5bb3dd914b3f11d9b7ae7263fb1449d94cd56c1cbd43f213ab0926c948a0cd8b7ea7aeb5bdfb6197eadcdac10782956c553d6e2d93db3fc8d200a66b8de1863a31aa6cbdc1fd51343c09d32b644eafd60930135cbd9f1009ae3e147247dbf8b09eb330975a853891ef5432ebf1fa09b84554067764bbf4017fa649318726aa35c7df04d7c21b27c5408f9be7d6d139c2f158c787d2d86856eb657c11a7791c1b2f6bf4b2f9798faebdbdcd8c898a490a94d7e725a6ef18bd37fe86878aafc8ec1be8d1c52b3801bafd22c0d1f23cecaf50c517f62b17fd76d2e5a279b5e0257f0e547f385c18d5e9381a1d514b9cce96363f76d76f5116f871cc16dcbae33a0e85232d2ca4807b927a3ac8d1694d174d63cf65dbcaa9d979318dca97f4efccd3274bdc6f661b499b108cb1cd27d1e55fb30eb7a9a72adf137f9df56d5bb43fddee8eb92e832f18ee05679b3671d17c8be34bc56aff3f7903cad831541de9a031b743e6a620b6f20399e143fd4a3a68f01defb65574145eebe6e269943cfa9b39f4d58a1cdf621f96c7e1769c6adf703894a6e9cc73943a4493988ec7497b08b25919e34bc5c23e273a99528713c73215692215d300c2e903b86afef30327a520ade65950a8b230465b7c684d165e43fd849d083f02400f2cf14fae69d9a7c6c25caf61e72d72818dcd802e91649532f4686fabba0490baf828754991fb3dac4aa79743d6cc2c2d2ace4a12601ecfbeb65a6ead71ee1602d6494acd5ad5bc05984d2414ef6a8e3061088652ef27130569a815ce819b75289921e4ca079b7ebb5b761df5c0c0d52c7522e1472d0a350c7124c03059220318a0b120cbaf861a3ec83fb0dd009a110930b23d3c3c6867b2ed172350a3fa22daad1cc0ba9c9e07c5d7a7bc956450d5bc39c8b1a36126d266e06763032de81f3af1976e5d047df109b1d30154bbb9d4d8765e66b3f315f95111e26c66a0eae5cbdc554f1b9a530e47c0c8a9b970583954c867fb56e0ed1cdffa84b45dbe0c9cb3bfec94bdff73b0841bcc9974da4a3a154fbc8d27753b137ab81b243744cf95c97ce339a1d60a80a052505d22a533944f78b5f601d31c343841228eccfab5d4e9551954d19d0fd7bbda9f3c33d8a9ffd0fff91a1cbf87b26b665d552a4ff767f50346bb0008df4c9203be174e2aaa716e50b33f4615a45a14e19aece56511d7dd9e3149cdf210444391a451ecd4d9ada592db89f224ecad679287a59ca7ba738a4abe7cd5311c354aea38e392c6bf33bdeb29ce9de27e736788e66f663c9f2fe93bd7be2eff2556a0457f2081965d00fd305932a4ced5fa7cfcfda86c53fb32e8934e9fcad1dcb62b1855d9129757dcf965cda93c55d4cc0e55b07eff3d94a7254baac18f83eb8846d4c01ec13d202c237ba1633118cee3e928b2b655e87e848eb8d83b4470f033c5c3c20e600d06fdbcf41645c0b5ad4c961974763033781c97f7d3b4e914fac164e6277bef65acf62b34d18191e7eb43d54077a76b3628a91cc24fa773e6574e74b815cf3c57c288e5b293754c64ae02410a7369d152bb657996d60cd1414340a4cc88eeb3a1914ef29be843a9dcc1defaadf041d3cafadc73fedda8d4c7e0f235a4c6ac94f725fad482d1116bfc54219ee2fff7653e4be7dcdfdfe3d6296139dedd96ec202711bb951c1d1eeb292421d7d505af79a3a965a1be5114d22ae914c2bcbddab90664f4639ad08adc33399fa3323bb67d1cba227a06368845ca6daaa3a61245e3500340e0edfd4e32b6664268be37d33cb94c5b1dcae9fe67bf09d8a5cc2a17721fcd46faed2f9c3e5a6a4145b82038af5ae2d2da124321e023b3e51d5eb33df6887cdce4fff32a95d621dabbf99a8539fbf260b617d98f7115a87f6f91d9ec81b5704df8d94f672caef9c2069fdc4d13fbed8c05d8fc355b56f55e64a157a61f04e6fade2f8cd7efed757b91c75b45d979867a940bf0b9e0b9b48db999da241a7dbacbdc7d08ea585c8a4c689309f0fc8c5f2afe2b3dd12a3b48f6355d0a4e121fafaa48901f25f97a73762b69ca7c51420eef59d665eb10fb7d77c37c36f28443414f088d385349cec850b75a524a826389ef4f2217a5cbf8687489dc15ce7d3c50781d93d4c47ac44dc5239a158882727ffc7cb8ac1c4d580d1697d7eec96989ba398b76fd8ecd4db986c5a364966b6d42a5ea497cea7e1b108559ab8142cff737ec38a7cb7f87b4efc24acdddb26b8b3f92188fc182be815e78af8c085bb25a1825dc577b0a983009919812483fd4f039fef6d11493e81ce2cf85d89e4c5a1af99a801c1ebceaf8938b67e92787d987217ef2a1d475ecdabeea51c9333abb766fa1af658d92a1cc0d89ce2141356a3326d78e1c248cd0afab0ef47e624648bf1534ed91a08a45c83d89f0b8c6db90dd7529311e9ce0674ccb1832b4488e2de280f18b422a1fb7d2da6815b3ce0acd8f2fc53de6260d1b2ab10df58e06e741a85e6e72103373a2201a076779d38baaa1386ea782c8fd2aca749b3b53ce0992e2577", 0x1015}, {&(0x7f0000000440)="fa43e1070000007456189e4ebad855ff0f2f09c83b7f000000fc28c33737e1dacd061b640cac4491db7aab3c79551fe6f7a29b1f27f300139e55f936860127ecc108015de043924d3c726e75f4504fea535f0c645e2c9a208a9465ef46596a1578b28bc826cae29a4a48fb0d7fb3b10b40d0ef00000200002ced647c06815a40c0e6e35d9bd4bc81eaf39465e85943b2ab65c9f837bb58af5d14acf57c1fa946897250a30772daec6297ca32a6971ee874e65672e37431a64090cb868c3f5c385ce95d9451604bfb60817061e359720706968fac3beb8db1021772a8048dafa034f9f4e4fd766584ba6253ec22e90938bdb8d996a7f23a838a983f72ebf59f6800ba4d2f11451ce8389763d2a692c09bf7772edb2fd42cf1c02d2b016f508b33ddaf9b00"/302, 0x12e}, {&(0x7f00000000c0)}, {&(0x7f0000001300)="24724dc266d42ee426e3877b6013d973cfdc3bcc34dfee0aedda0ea2b171e105654067ee5dc7a4c1eb56ad3ec4e7d26ade725c978e4fea84a4b6d2ba80dc2faea711fa0dd83413bda71a19ed0cb7642263b1b1dd9c6fbd13b16923b585ed5e077d84348cde67cddecb86cdf8dfa2207b45d14fd8c0c0ac97c608401efe7d878784afc4246d07e69a56719910f7ef37390d35c99bff16daeeb165f5461c7f59aac635ccd67038135614229866d36d787be8397fb7e74e872b2e94d5112901babce51f7d9203fd59e71f719d695ce008136bfa0d868609041863c248fdd63df3abfe24755c733aad587ba833d8df59633926b48c92c221b6c363", 0xf9}, {&(0x7f0000001400)="5b0b8debf3830acfe4513207338de42c268a5179238316e5900eb5dfed7c7e40908d134cf29367b7842c5a3d061287eb7ed82994ff87c9640689afbaa8764e6ec47f0d74ed3c38d34838d3ea1dbd38f63e7d2c324d977e0b5616b6e2ea9f77a3d1d15813bc0cb372c96b1e474c68e7b52e0385d01f6caf52d33d3578cc71a2612c8a5a877660c8a8b1eadd6d7063ea54325521baf5fd91866c3a12e04a46b97f345b7a298d5b0ee3a3a4735ec7517081b4d58c31fc5a47b5a577ace008984dddefb64ca08a01eda158e3cbb4d2aff011f2d5d9adb838fddff2d5af04f8ffc97ed8d0fb8ef9531c11bec12b05b8d93ae6", 0xf0}, {&(0x7f00000000c0)="84eed3a24dd722176d", 0x9}, {&(0x7f0000001500)="db3b3a53a71a773d290a3778cf61b2719366e2dcbce1b102d38cdfeb982ff6c51c0e00575795888fc32a22e92f8b29f5d35f7684b5e711ba5ab897cbb0363d9958278f00165507882645491cfdf71ae5c46215cff8c74d489c3275d3f475139a5c92e37750a59b59e5df85fbdcc5721bd8b6ab4528f0f8d9e751b7760c225a0b99260f08eb11875b0d1a78fe20cf7ab06749fef538f9d2f857f79b6f8124421d6b316103c9ccef0a6aba7ff8b9fb6434c536997ededa3e38ab5361b825c7eb06f66f13dd09b531e6251d73557866d6912d7f0f31", 0xd4}], 0x8) 19:29:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x80004, 0x0) ioctl$UI_SET_SNDBIT(r3, 0x4004556a, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 699.607639] binder: 22017:22019 ioctl c0306201 20008fd0 returned -14 19:29:35 executing program 0: r0 = socket$rxrpc(0x21, 0x2, 0xa) r1 = dup(r0) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) close(r2) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x800, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400204) waitid(0x1, 0x0, &(0x7f0000000000), 0x2001000004, 0x0) 19:29:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) accept(0xffffffffffffffff, &(0x7f0000000440)=@ethernet={0x0, @broadcast}, &(0x7f0000000300)=0x32) r2 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x40046109, &(0x7f0000000300)) r3 = syz_open_dev$cec(0x0, 0xffffffffffffffff, 0x2) ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x40046109, &(0x7f0000000300)) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$VHOST_SET_VRING_NUM(r4, 0x4008af10, &(0x7f0000000040)={0x3}) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r6, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 699.756325] FAULT_INJECTION: forcing a failure. [ 699.756325] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 699.768572] CPU: 1 PID: 22023 Comm: syz-executor.1 Not tainted 5.1.0-rc2+ #24 [ 699.775932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 699.785349] Call Trace: [ 699.788011] dump_stack+0x173/0x1d0 [ 699.791716] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 699.796993] should_fail+0xa19/0xb20 [ 699.800787] should_fail_alloc_page+0x1fe/0x270 [ 699.805535] __alloc_pages_nodemask+0x4a2/0x5e90 [ 699.810373] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 699.815805] ? __module_address+0x6a/0x5e0 [ 699.820131] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 699.825570] ? is_bpf_text_address+0x47e/0x4b0 [ 699.830328] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 699.835592] ? __save_stack_trace+0x99e/0xb90 [ 699.840172] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 699.845422] ? alloc_pages_vma+0x108/0x1970 [ 699.849811] ? shmem_alloc_and_acct_page+0x9d9/0x11b0 [ 699.855068] alloc_pages_vma+0xd26/0x1970 [ 699.859311] shmem_alloc_and_acct_page+0x9d9/0x11b0 [ 699.864450] shmem_getpage_gfp+0x1b6d/0x4120 [ 699.868956] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 699.874227] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 699.879479] ? generic_file_splice_read+0x730/0xac0 [ 699.884561] shmem_file_read_iter+0x505/0x1180 [ 699.889305] ? kmsan_internal_check_memory+0xaa0/0xaa0 [ 699.894662] ? shmem_file_llseek+0xdc0/0xdc0 [ 699.899226] generic_file_splice_read+0x730/0xac0 [ 699.904161] ? splice_shrink_spd+0x100/0x100 [ 699.908917] splice_direct_to_actor+0x58e/0x1140 [ 699.913737] ? do_splice_direct+0x580/0x580 [ 699.918127] ? rw_verify_area+0x35e/0x580 [ 699.922354] do_splice_direct+0x342/0x580 [ 699.926915] do_sendfile+0x1010/0x1d20 [ 699.930899] __se_sys_sendfile64+0x2b1/0x360 [ 699.935842] ? syscall_return_slowpath+0xb2/0x650 [ 699.941687] __x64_sys_sendfile64+0x56/0x70 [ 699.946478] do_syscall_64+0xbc/0xf0 [ 699.950434] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 699.956304] RIP: 0033:0x4582b9 [ 699.959610] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 699.979007] RSP: 002b:00007f81bb558c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 699.987039] RAX: ffffffffffffffda RBX: 00007f81bb558c90 RCX: 00000000004582b9 [ 699.994365] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 19:29:36 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x7fffffff, 0x800) r1 = socket$inet_smc(0x2b, 0x1, 0x0) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$bt_hidp(0x1f, 0x3, 0x6) r4 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000400)=0x0) getresuid(&(0x7f0000000440), &(0x7f0000000480)=0x0, &(0x7f00000004c0)) r7 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000002cc0)='/dev/qat_adf_ctl\x00', 0x280000, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000002d00)={0x0, 0x0}, &(0x7f0000002d40)=0xc) r9 = geteuid() r10 = getpid() r11 = getuid() socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005b80)={0xffffffffffffffff, 0xffffffffffffffff}) r13 = socket$caif_seqpacket(0x25, 0x5, 0x0) pipe2(&(0x7f0000005bc0)={0xffffffffffffffff}, 0x84000) sendmsg$netlink(r0, &(0x7f0000005c40)={&(0x7f0000000140)=@kern={0x10, 0x0, 0x0, 0x20200}, 0xc, &(0x7f0000005b00)=[{&(0x7f0000000280)={0x134, 0x20, 0x4, 0x70bd28, 0x25dfdbff, "", [@generic="017ba37af8c03a4ccae3d1f5407503", @nested={0x10c, 0x8c, [@generic="60280b1ec4e83edafceaa6bb9fe6607d62121c04a967de75526832c7d15bd15b1c4164eb1c4961726d07c0319c5a37e77069161dc19d57cc46e49acce8199801cadbf18382637e17275f7322a7e803763253ba9864ed3ab69ef620ddeb32b16d8cc554381ad570a93a7fb78698c2c879797567b8dcb1de441166bd90a457f3c9fe71950aca37b824a494fbc8d51d51d13aa0b58fb45361cb4ae89c76fbc860", @typed={0x8, 0x4e, @fd=r1}, @generic="f9361b3d1df828678c950b50d72d8a650db91519fb5f59402ff1c2237224cf02c641bddd863a70da1d8784691fce680712a8e678950254596fc3e7ec6b8033278020a58e85d51fe685379a", @typed={0x14, 0x68, @ipv6=@rand_addr="cb612bb11b139ebc212d198965c07c33"}]}, @typed={0x8, 0x33, @ipv4=@broadcast}]}, 0x134}, {&(0x7f0000000500)={0x25b8, 0x34, 0x400, 0x70bd28, 0x25dfdbfb, "", [@nested={0x20c, 0x38, [@generic="0435cbd6306f394301f9455bcd425294296b5d19edf448946f6e1f178ca33cffef4e73992bcbdfd9e77db0ee2f638c21af91ac7353252758e0a466c83e8f23", @typed={0x8, 0x11, @ipv4=@dev={0xac, 0x14, 0x14, 0x2b}}, @generic="52adcc73f85612577b43ae8b62593fefa15456673fdb4835f4aab6a52a89240a6357575b68d297b3b0694ee577b006b6cfe2a618221bf01cc901a18b686b465d682207e0e521672339b9999ec68b233c19a6414042c140903b75eccc1062907aad9d7dc21162cbe30718066546e67cd582d9d493859caba28526cbf7747e80a39801b8fd043d94754134ef021ec23f15d6243720b82f49c1e666eb3b76bceb64d3788f5daf77914da19bded86b1a98e34e782cef2f7b06bb3e42f672c04105c59145ee59d0cf624f1fbe2d99a83f3c3be40a44796a575ab1741886f501f5a432b720ce6b87e8213ed39afa50a2d193e2e02e07ab", @typed={0x4, 0x23}, @generic="59760af8f20d380d4419fec6144e17fa96d0e92aa9ccf0e030e841004f5fcd8d8708d5cba19c6e0e7f274f6408dc91fc1920d5e148fe6b8d1b2d2a8917c347733999e1208c8526933959b00c0042253d4059b11fc21db3ee0dfb691074bfb2156fa29112db4b4906efa3c742c308ed6d512b0e0b98e62124102fcdd27c872659065ef89356c1bc81862537a37042c60b268800cb7e5152c76f5fdc3c4ac37ef5f39f28cbd7303a7b683f94e680d2513ff8c285309737db2671fdbff15233", @typed={0x8, 0x68, @ipv4=@multicast1}]}, @nested={0x1140, 0x22, [@generic="df3a601c359043754be691f60f4fe0bea722c57d68a7561c4f9da0eed30d19a2b346da9cbb3c39198fe77fbedbbe0abda245143149da3d995fefc8b04df9ec5293db866b93ef7fac30e78b187e9a18eb086cd32441f09ed267b853e8afb31f4d5c3de3b371139a88044f3f472dc1ed6534cbaa515d44ee03257c67b0fed41766c17ad80e8b0153f0f1b039afc3773e60617a7054a9001513097dae7eda48cff500ab1a2dec4c275f44c9bafea5bf49506f0987dfd3894b69cd72297ae9af1fc35d0dee907e00d965ceeb0baa67efb80bec6535ebff786469c0353560685c12a5274778a124602d70ce010a2550139f4fe28cb7e43bc7d40caa61666e10af6c1d2d8cc72fbec405b89aa2e8e70e732a20a4e159235b4b6768ac6b9fc040d13646aae2998268cd7bceabad4c178020aeb4808bb2f4349f8ab1457e16fac496fd4db4140555370f6b8387b8bf98129d18ab7f2d83c5a8cfd48af0a951e2732f0e3071fd6ec9c873a7bfa1d23f3c09ee86b947ade0b44654f4c88faf8ad5d99cbf546954d580592bcdac5d9b8660a30b0d25aada789f23d9184d87c19964598f681e904abb71a408cda39b11537a1f76b6dd7427fb7f36c8dd2379659f9b47a42ad66b9d3410f797d0bfa3665449076fd6b2fcb7bdfb91c12616a6279d2a6c84a3a718e7cf465fbe2b7ad963c7483bb3a61895cb0fbb652d4e9bc2fa0f16bd3634c35f115a8a60c3ee2e13095afac5d16beea452c46a9f018b10de22a3b46660c6f18f03be956d1fca5c5b4b946a98700cb1afe9777f033b1ebac76d327dafb7fbd5257e4ba3466775589217e322e1bbf792a0645227c2edf010673132bd81fe51f8e6e049b856eb441f70829f613254eeb553377ad6711e8ff75c42c112492290390022499bf0806d83af0e6e6593e45961997d861e5b97c42c9c264cd45a905ea00031460c8fa286483412da18fe717b708b646efd6143db355beff9022d3ec3131b58da6c93d051e272b9accd5d35095fa115ee9155e59af63b0b17521e1fd5982dd5c548fce4b118c7dfd760a1abe50421883c784675d234f787e1a2900ba9a6c4aff9fb078d8c93657cf8b4d50786a4cde7f12e13ac2dbba03c8344aae494c9fb92e3436b79675afce9cc0aa31f6bb256c4eebd0ed2898a9291acfcc7ab1634f9288b9ce030acedbbd29382904e07dd62dd63876b1b741fb9f986f3d24dd8251f689311ecc8a68ab350194131ab1ff5da4003a504bd54f08b0f43e033689b9898ecbae3a3eced3ba4a95a4132f8d711c5b2167d3b7b32b201c60932fc90310d769fd3bd2ec61b4be45cbe5e71733cdece83f7eedb642d76f286f54d470da2ed6df92e377009027d089b2b02f0b3f80bc0fb0c21c08799e092fd8e86691c8a73b4779648bc2292f892c26cba5e2b448072a675e922153239d9614330f009c9754eddfae08114186d464a01001847e81dcdbf2f2fc4e5b006f80418405800ddf24101f8e9c5e46bd121f5868bb380979180b88e7404918f0d819914398f47c7839a260a4e7c394c62ed5ad9e8b06dc3abff08e3f1c92ecc6ee7cae950b9c51267efbc67c44b5949882814f44bc53d3b7d77e3d3331377d984ad56057fa1f79caef998d671c4ce1ab03c1f7adb503f194a82106bbd1fc2a6b4a9d7260af92ecefc9011565de5b0d3c5cae5e9eaeef423d271c9c796ab1ed7837d171a405dc36b22be173c4dda1f839df992e727a235c3f525e8d09f5600015fbfc9ad752581edf92d0997fda22e0a49ef0063226ac37e24f13a95f1e0814e2f1ede96c64abdcc45b2b9b2048ba85d664cb47942a26b7954dabdda5c245d4a745c3f4d2e3fdc5a0376a82cc20015c823bfa5d2757562607f0830934ece60daa7dc3848a4aa8919c56646018b59b6aa57ed59f9b5e4744be80cd69e51c44e6d43e9cffc6af35913885bf804ea7e56c232ebe07fbe584069e04ee0ea7b707815e9c5ac589e30590637105a273eac7ad2d56e7a61a99f0da9f373e756e4434d58ac41e91c4186677312720dac4ceecbaf62873c59b658000c31daf398c1785ad08dbf51d9bb38c719423a05dab35f51a98ad497594beb7cb94562c2bd400a2e100fad3c721a903dcd5ce1dfcc748c433ba5081a0ae06efc92b2ab4487d278d4e10c0ff9335fb39cd1f5c3c5f8c4b8fccd338cdc3d0739879b9ac8a9a78e68b81f50ec4102c0504458e74e08f54b6526da520f88423ee238e81afe82caec4a99f65a204e2c3c92ffd514f69e78507161586c6948f3a6d0ef0a8c6bdc2f24a08bf084b8318aeabfaeea9ac607b72066ddbcb48eebd015b1db77e1488b28c8d02f5dba360321d8bf3532abe247c9b05fdc4936df4b370c1fc7ea86f09ecf2cd03c88546e82b4f1f0669143197e36d21e8fb046071bd1ccae4a13731b56ff767abb3a962d708d137c6b67fbed42b7e31ac1e2f9a1b39c9ef9744490260d38ee2b38d657e1d916fb42882bb2de3934810e24df4d2f2817c359aa88506c4d9deb3633f8e47c2e24040e3cf922c401a26d834b99abf2f8e42153d76e43be8b5ba4e2907f4b4ba61d9acba4a95ab204f682adec5618e2d469a4f5133a7dd01ea74b4c66869a1bbdfd67bfcf31162496806c1b55e2e65b837096ff1123c64f8c9059d1c090764b000f3e639d34bc451ee0bbcdfef23c3831732d553903c458a163db7db05119f3dc190ff20cdfed89744d28de98521c600979963a20b53adb759598103a84266f27f0e295388c51cdf22a28e27a9375ad683899663c4f9e1ab8d0fa208cd399150485c525c2d26f6c1f407dcc3ced2577ad2fe553e54cb6dcd8bd285c2faba7a5fa52cdf7ffab54eb4e4ce468fd0d45d14282b608ec7c9e9a341e77cf67d120364b6a9e2acdbdfb5d19998cb7e5957f21d6e57d041b6dd3165cc21ac754d958fccbb41ce86d1aa948993ebbf68c1a53e2a4f1091784ea0c1c6f4501b1befc045454eef9e2c36f1b5d9c92348f880c8eb4269d6b645282dd5aac68f840fc62f2e08ee32433d006e78c475049559ff31c53880848c5ff37fd66edac4974ec4ede7d3bf1c371ae2151cd4decc802570361a1361afb48da26dd70546198c2d5f2736a8c450c961034abd954c507f969a6ee6e63cec1d2a0c4f82dfc16cab4d2fe4ba63852f84750d615a5d1d836d8dc406285e51937a19da31afa94e810ad2af724299885ee1a85912efea5881c04a5668af3dd067194e2869cf2ba7a1d21f0517bc88633721c9930951dd0073c077fadd83c081718e83d40d8515d8f1447f17cc3efaee961e96c165b15cd40dddcaa4d7b0c9969ad912dfd41b7808769f3cce3fc2cf99f34914336c94550f15325900b2b2c6c1748a36a13db69fb87c967876d89bcd92aaca75d7546defd1aec44daa754ebc4b036fba214c572e7eb33d9d5ea3fc37023d3ed6f59ea025d6f5a36ca0530b2e7dfe7d7ab2cf1707599392f88f21e1e9e9ed9cb7af04b73f0c07ceda4bb4ef7db23451ebad7833769ae97c78adff1ee7da2315e065c09160eb7e3c9a60f377c1a65a8314b152fb608ac55e729f5333e9ef50b43808a2d8f48bdc6a9ff46572da32fbf0fcfbf6da3943d985689cbd6b2e3c09caa2134538e1ce35d98b465ffe3001f99ae6b384a4eedcb27c8db19c3ddc2cd3ddbbbacacf891db5c513517f3701e933c473523f233d2f69c0d8852f3755e6661ad3d81e98f0465f0670012b53eafafa8210ee2d1fe64c8c0bbf7b14176960a4215606571f403873eaefd078e5fa1562fc715318ba3a018e1401d33a41f9fe099a3154b5c5eb1a2e1bff428cce3b57a3b57d87c765a475f201832cf5a85a1e0c2ab46c7898d02a928c13c16a745bb09022b4d574af8dce901784f969bddda00561624a163cb87b30436baa7337af6c667319603c3f6c3572cd017858c726eded656529ce27ca3d1aeadea8a976a599a3ee66a5efa81f0e07f9c9c73b1e373b0c5cf437b99c1699b3701fd773a3a80a4923c6e1a6250a4e7973096ff0c3736f867ea8581dd1c2624a304083d9ea9f6f96fda7ed5a741e0a288864959408cf50dadc2d8632198bbeffa42731245d17bcffb4433d974a30a2186e0b87cda3c7221cb4251a4ffa105a0cf3f69d0ed498eaff2805639b6cf8417cf302bc0f63c49033f9cdd704659e47ef48c8d983f3e884d72c6a15603dde61b96aea3f055c583ea0c7e8ea1c2c64b9b85b1245dfcc79de9842dbf22318415cc10af2ec5d2807067b160a194354812c92edb20a3815f8d11fbf92ae9144bb7bb8cd920f96ba49dc9b3d68a800621661d8ef6d64838735255b68282430c5715dd01369f09a835083365b8d6b6d2eb416ccd2457ea6a8d07b8ce7fa6c7b203700062c2e1ef65b8dcb20399997830710888b03e3fce7c279cde29b2ffb438e6c87b0bcdfa3c7c3d9f023cf065ab65effea74c87cda087e4bbb51c7d824507b6d55346830e4ac4299117791d788767918767b93b46b75fda5b0bd0377a9cf2ec6d2d68aa592cadaf17cb8bad2c033148aae06904471f3115cf864a75bfd0a4194f808b7cde810e9da4e9faaf488ae50743d68296c0592f04752c0b1a605fa0268f0c567c6265d393d1dfffe5923117340c547b0eb6bc2574d79f2ec7912c37d660f4094b0ec4c2214027b410458748c5ed997a8102ecdd201ed8218c5200da4d808736c0c631cdda541401fc4a0cd10f013d9e3d4c464f643f0a5fb31021aeafd442e51dbaf3c7448d5dcef2210a933ab674361d6a14695c7f43e3999d5c6ff4c93459c8c3cc40ea0673357c4fe231dbb77729f65891a6d5d7dde8a64f602d55cf7e43e8fb7e84fa94818560f81b0770510d5543fb498445ce2453e837dbd70b791f98503a53ef96d3c3f556b857b81810113270e8f7d5a4a987a60983d34412eb3266b25e88ab26237d4922d8e1685f094ac3ff8f23528a6da02d2d88bc2eef28c9b73b129b95a126406e5cbe5f01a6c65f4cbf4c50af6143c45f561e49009b4cdb84a6ceadf96f77173c0c38d8851b55548097e44e034b6eb3ee566748642ee084481e7257b2610a2a56af2e14c726e805385a1dc2f86ac4d941c01f7b90e7db12edcc031fc7bfcbf06a00474569c178021e05c03c5355558857f8dc36554af5434d5717d5b90626321a6d19a37dd512572b2f10fc409240bcf6b7c05b3a47b8b8adc80000c7ae083d96bf5d224b6ec29da29bd2650b8bb262012c28ab1e7771b4d03632600160f7d1bdec61674ce094295dd71eb77b8b74fd76f50af03d81941cde2cac653475a6e5770cb5e9c343b937ba3353e56c67dc40fbcb67df983eb350ced249544de4a1e7bda6b5ef4eb557e204fdf37275f1acf778e8f9b04c6ed32e0aa5ecf9ffc72dce728c595092aa7bb5e0ccc500c3c8f5c18cfbdcdcf2d59ce0d15f18f3eba734686236e14c4fa705631a0977a15c278d1544b70fce3a56323f819ac0f055c94ac3bed4f136b09c3b5620a48928949e5ffab8fc2c7e1cc9b5824e2dca835e947d0a999c7f25fb43e470c44f44f5f6d7de47bf6d6ef4f0fd5d4817f160ded695a741b940c4926b3b8557f6fa0f4f6506b967f1a6e00bd120b1a7ba5d8e9aaa99e981552336bbe6d4eca7d13a4b9cbd80a4da6a5a49d05c1514edf121a45fa281ffa979c6d73cccf5f8bd1236bd533a0c528f8cc66ce23e92c1fc1fb5b2d8e000e862a0f4e76f50e94c0893c91bce991b08f5cff4818dfbc7d5ef323f51e20849b5a24d3140b1c85c80059ff29dc29da84ed4d7f6609d627ddde2683e547127e6463fe465dd453b", @typed={0x8, 0x94, @uid=r2}, @generic="9e2da40c428368fb720317107401b67effcdeb6f52988ea919dd1ef2d2fc78c0fcef5182980cb69b06f0d4b29a711e3619337bcdcecc476b6000e4e453dcc72c8e36a7f656000135f7ed82361bd90395a334b459489a6ee802d9bc5479464d7224f91ad70e30f7236838eb49cc4a22cfad7b99e2f00021407a31598b05dc1839ffe90f04a2e3b3be4884fdc7a66e6c401d021ee5f2e23ef5613a22128385aea68613378501434ae84ee9e8b851002f6397f21bbe649363ea8ec89f06", @typed={0x8, 0x44, @u32=0x35}, @generic="8ff032c751f7cc6e7d462b9858227e335d785e324c57d137448ec6e08ddf23e11bb59716bb24c0d80327410a4c457583ee4bed312ab5d0501f3f05084bda41c5945a75ba919f1afdef7ae1e46cb3637f482fc023ebc7ea377f670135732eb09d4eb2588cc2ef154b8dce4297e3"]}, @nested={0x124, 0x69, [@generic="0335aaa1424d348b593fe13506d8031ee31646ed07bbbd8d4d19843063250923935e2dbdf40f6cf1b59d6d17ae22af766e2baf1f94b7081382cc71fd77fef7766e0bbbddf95655ceea4cdc8943de05db812b732cb779eec503b784317ee0f47a9924f83626cc8d4d08dda4a196629c8bbaab3b8e2f", @typed={0x8, 0x75, @fd=r3}, @typed={0x4, 0x77}, @typed={0x8, 0x2b, @fd=r4}, @typed={0x8, 0x7c, @pid=r5}, @generic="4d6f1eb6a318d44dc99304c1c165c835f2bb955fd0f7dfb74df84fec58140ff98ad8d5089a838db50c73a863b392c712251e7cbf004ecfb2c1ad659385543ef79611902d7a301a96e13416fb91cdb2a7742808c2a7963251189da3bfbd65cb9494518aacfd15dd0fda121a8687df8949041730be43cc18521bd377a2b13c780bdbe6e16969759a5d6831babb2c"]}, @typed={0x8, 0x8a, @uid=r6}, @typed={0x14, 0x14, @ipv6=@empty}, @nested={0x110c, 0xd, [@generic="c8c8995ab8e5d7298fe98226d1f27a45d49a7b019dbb6d70cd82de13747a78c204fbd255655a087ec6798e8eea67518a62f30c6859668f05ca5292b4dc1ff3a82750c29ae47251a37c8d6389fa1382177422d2a19ecd75a0d5297223047606c11ee506b0c76887f79725acf491d5f8a257fdec36a6e16a27e0d91ff74055584565f9cd4bdfacd8e225a9de2a1f34a351d9385e801b0a92e4a9224c35ccd7b9f2ace31247d5bba10d1a23d3d7feeceaacf70e95c85c07e8eec2ffc26e166fd5171e0773d06faff4100a0168c4f5fd679779ee03f00319060af709b272eb398b832f1bc1025c4c7e7c48896fa1156dbacf87cc214e18cbdfbad0f9687bae09f56a0371774ce1eb3458181d24a4291c6c7ae1e14dcabedeeffabced163f1ae15e6cfa710892afc06ae4dff832fea82b838b44d16ccfcd64527fecd1346b8841bc2074afcf95ab376c6b86f5c5be6b550db9acded4f418c567cb3ca08599afc6a1cf2051c673370169005b81640152fa30dec4c7d0c7d6552ede45acdeb9ba155bd375c06d43c009c808fb4c324024420e3cc7e2db21b79046274f4d69d09bb423177cf4c4f471ba9c716e7e3dd9823bf56f95c5b7601068bf63ce7feb09caba82497ceeed4c155557d547d70fbcf9ef44deb1a29528dce35758c39cc87be9137a2797c7bdb5b1b07f9a904b48aa08fccab9fe603558e39163790e153b16163e757c771efe7366b66e9e7836c4fd10ff93a267194f8626f406bae0f8a66ea9414c2bbdaef99fe5915692acf865211b01c3c7d5700c65fbe07a2610e92ad2f2ef7dfdbdfeb611481231163dc63df02d66eceeb68b8ae3c6e56c72483e18256d59e9d68145388ddaf0eef6b4bfc7568b290c756a9b52642fa57237833a95d87ccabc35d9961d3622dfd3f458d43ac8200b9fbdc68229c7a94f0e935a8d000e6017ea358c8a7cc0930834c2b4b2d663e41dcb97394f9563c1e65b729ae1a1425088fd14559c767fc8976057887a747cdec25cd9476924942d7f7c37af66cf4f125234a9d77fee74d5b5c57d01a2c7e8af8d65545ff648d8bf449528bcdd811481c2ef779c11a80b14859e7d9ce2ed3a0300ea6c8a0ce65b7a4fa4319e3ba5db6ce616b2a9daeabf361b0510bb49bc9c6c11d9c619c09efcb9ec9c4e9c5e6b515ba784f3e3977368b2795dc2af808a3f3facbf04cade4ccfdc27cd0210a642ebf923d0f0602dd76ccefa3e84906de24241d9d3cbb7ce10f66bc9ebaae4cbfee138ea9607e7732e02249a89512fb5383d04ff5601064666ea9a755ec0c58c40c30add2b136c9618d5ff16bb95891f4c6c646ed19613617e9585fad47162394c852a85edece800c2cd642be7b7f4ffe2f33c8167c1db25644cd4f776a50466342e913995d29ab4ace59df5887783e1a7f391208ffc8bb2a0a5051bdd14cb6b73629cd3a4e24824eab9935cb503a7fab703507631843d5471b874d3e96cfd88ebb7f48549675a7858fbb0d124eb09adf79ecab0c4c8553e03c7a28e73c9ad84c4a5b0e638708dd7764fad38862d9ae509744d2661835318f057f915f36cd7eb96a07db4293623c852b3854bc54539d4a352ea8dc5370ab0b4fe61d5b51f7c37db8c838e049179b06ef588c15c97a349ed1ae2fbb26b77f3d929e29ec09a3a5a872a2d81fd13ffbd57aefdcc8c9c86027d6d29f6cbe19ff779dfba6b8803d3a145b9c54d4452dc4cee588673f189302990d8af36fb57883b65f173d6626af189d75ebef9b64157f85b872ca7ebcf793e2f553930f65c55c37c5535ab89e20584ef070b7c561c87087334ae3ade91c7a1cf577f686ade31de87aca0efcf50e4483c078c4d8a8721b3d43a50d42b72e77104c97a515f90d07e0c857b2d09d351d8fd0af1ff5a9b4843b3d97c670b756b746d7432153a9867d6b036944261430a1bfa8a363d9dfd94fc2404dd9793904ec4259aa06821b4420924cc03297c6480deaf0f3901406f12f46feb1a66e6706839d3489d5d541e5218ad28e2240ff9f60e9b48c167ee9603eb5c8ba34061701ac499c7d7ec86c7f24c8c34d6cacf9c42c9ed7790fae72c0f766348d9f9f01971b6e387939919fb21ec435a22711ed5542f0bc8c3453de2cbb63d898bfd27912029c6dc5e15fabd87bee3f6fc8b68b05cb9023932654463f26d987b6bf040120251f05375dc12697d059ef92f83ab40cb1426f9dd6d5453dff3abecd787a6c34fc73c7988f30e66ac8500a831c7792fd81ca095020f24f9457d63aa7b03a48cb4f9cc8e2a80fbe64ee8e9b9f5597cd6e0dfd60947d7f783bc528f43934945093ec11e4a0067c1da5206b498d8c6049018397c1a20ead07b2d9b05d49e27158611787d7ac0fdca95ae15bb11798d2f93f52cde832ed5cee2f5c8685a616951a9deff82e96f22eb42aef44356a196ac385bb165177c0123a99044ff127f9c100870e51cd8055632f1dcc475c41d8e186d504d426715982a93ac90e2cb1b7f09c11f4149eec475b1b5d5a4e020284b9762eca754f45d5c28fa7bdf6de1c28828eeb3d9272b30fe46e35a6b4c53e6f4f413b3470ab5a1b92fefb66b5d246d200cdb6a5cecd630d9c4dd8e44e51fc339f2984c2726fa733f34665f080c2c501c96f36e0871dac6f96c79bdc1d3995504e5aa11a400d70a819c83eec11d97f3d3eb4478b0365672b1b6286144fe2f33629a2a517bc8ab988beee38d2640056c0439ec021c03f66b7f7aa1fa39208001a8fb675f0e826f791a9912d861ef387884039b0762a01199696e35b8a5fffc9cc3ad5bc4d88ab8260c207f3ed3f820ee3427fafd814c06809db566b3b411023cfc0091e720f555da45c544e54caf8f2b03ff80a62395dfc56ab77cab59b8c4f02b78ffd0ba8a0b56b20cb5a1312f846089bcb227866f2be1e3231b46081343ac91246ab8a050b725172a565abeb4264dd70e65ca97ce9e4fbab551dbf9c580958bf6610a7525af1b6dbb8f93cccd701ceacb12c11203840f6efdbc2543ff09b7b8cdf3ac7042a33f0a5c5ee7553d3f899617e8fb01f876b41dea19888cbb4d1a9e13b6589ea914c3c705951c0d31d5b7da25e9f18df4519ea7f19b698dcf71cde6341108a2b206068f79bf1e5ee39c84a634b0602b9dadef7501e7fbc21be491f55be37ade6ce8e991ec2a8748e99245e2cceb1de3238b20e8e77385f36bd1e7f2c53f347a9b6cf05118e201b889b02a5182110a649ab553a5db735aa15d281d5b97f5ad85a7c3b5934dac4513b31a2e42d556ff52a4fa2d41f4baa9e488d11b0cc217648c9eeb2c048db460461a93dfbc9a9550d479550e5709071acf82d1b565445eb20cffe437794d61e1bec4e1ff9e4c15a25364e925cc23913374ecf6bcb44db7ba160760e13868789c9324c191e0a780ccd39c72a186eeb7ca34a924347daacb2f06b79930e30ca085e6b1286e277a7e134475daed88a493da012cf40ea972711017886790d30d51a475ba1f8e64d9a31a7a7c78ff72093681f1f739a1695046556103a82e8cf8f0a919590fb77c39d394b134df9a9fb94e6f85781cf4df0c1d66e58ebb160fcb7599c6f9d7d521dfc75c377007ec6af2131c22388a5825b8e1208dd414d0ecb7b3d549d9d6ad20f69f584e97412d24c80651440f50dddb9e9a2f890bca074ec1338ea20576064207c099b0931e88e26a40697148578fe04e81b6462a539bd39cee53ca5faed5b4e6ea8248ecc54feef6f9bb9a82b40d779e1dd02d5eba9b3182c4c363f84d807866743d2941e8440554af81afd6d053b64a5f211d8bc28accdc48757e5af6fb42e27463fea50654e534e89a4b6646b3648884f438f49048a918375fa87248dedabb3484139c98d58d903394a37f72d75b5785145c1dbc835cd1f08cbe3080d0b8524c474dd8b7c519a6807c646674aecb3391723ec6f8a69f35d65ca05b2ff619c9feab5b362d6208ab34036937c6be0932e8690e3d7797662a117100bebc318dd6190dbd3ac389d2d4b376f12d6bcb0904717dc43680d2194e504e3bd65532a9c6bb7e52142cb3eec14726f973ed68cb813b3a351d8370a1c56cf8f22172a812f158e651fb7df97647f790b0f27c096da9946f2a0ca2589d9a3b0d6fb4b1f6e3ce9d6f74278cfb90ec2ba94b35135a4290cb01db146eecd1b9b4f59c42b68ced4b9b349a73991a93d3f718f8500f5c3fa0958163e3dc80a24715a65e2d66e500792bd858211a5d6b3a4cac4c9e2ffc2c91754a8b747ed13e062cc6b86510527fdb2359b0cfbf4272139c2535e364fe7a848153ffe6089ad2ba2b672d8dd49c284946d6e718b3804a320fd888946ad9698bda1634c3c701705a4faabd88c52a97ad4d62e6863ceaa19dac03693a602682d32b7b1065695081c27ecccf00e5e704dc9823b2a4d01f8c68bed5c757ca353fc72ca00d0d2b3b7e645b0d1fd1490e4893dd72ab3c0aed62b4e28e317c799861f412e5ba65cc6ab12a1d4069879f9c000c02e2066b39c620a3ec801dbf918c947efd267b3e2edabcc47acdaec13b556103297c94fa9d51571122253df3d297db6f01e15eee0e6db78227c177a626c4432923dd6d2832ca769b03b029133bdd831d4a593712bd4cdf30feafa4991ea763a1cf9e8c73b88325ed87dc9d88b8c69ddffd41e573598b1fba881a7f2cdea7e0eee780f8063beecebb5477ce74403924ac3d7ecb78605d988292b74ad17344949e0feeb3cc985591a3eef229306021821dc1a97fa20a99bb92296b33ea0a1979ce1b7953c72b83f6023ee33344aeb01b964fd6e9aa4a705462c45f31f74ee4ff3e7287d73a7034e7b367c445e68f534130fdecaf23d471187426e24deeae076f7b01cf207eee9e3e64a00e6ed452a8a0718ac619873e531570f2275672f23b5250fc4f3ba7f11d9c03ea74419c2a07d79d3e5e9a176a3e17c30a1447b09ce489335552dddce785b5ae12d8b4f4af936ed7994de91080cf64b2a87264da0a1eab218dbe80c40e4e390ad949e5b8f361382ea2aab3fb608a3cdae2241f5415a612381398b47f8ded5f17d3806b8f881d47766f4a63d486dd36e462b3a5345a41b34f8596a0e5d5cb97e42ede5579ce9fd60ae89b62319dd75cbe6aa6583a82dffda67771783fe57cac57b75f4e98e8849dfa211a5f5b62fe3e21696c7007e0d6f9626c37ee9d2b95a3643a4df39bd0b86fd954a64a9f3ce18e365e254c0a1027008e92e373ec0d750ec477901cad1530da9bf611358ace6f61bd31700f53bc578538943c6aeaa7cabbd446b97f21a832027ff1095d66e37082f7100a458aaa729ab50fe99ba405cdf3f9523b91c149fed89b1910b7aa4699afd3ee7c5f5490afa070baa0b922d6a1735132c632f6679f9ca84809fdaf9ecb12b4d8880a210d556461ab37a5504db89c5f002017f1ebf01514197186c3ed446f86d84b279254cb476b54dd72959efd7839958cc7e011de5efda8bca95d32b5fb9694d37874213240a5a9750e1bb4c3c5e39a072f10011fbefae75ce5d1ca04373572378b2c3fc973847b19209a4a31ba939938e1b040058337e137af4efac317351b851f67df65567fc70873e3f4ce857c298856ad2c9244c13712867d85c8083830ab7a27c68efff51449d9610dc4729fa064b5be04d8edd50e7ee7b55afb2d803378b1ce06a7717406c844cd9bca24e9bb56f0d4ddeca398a1bf0c70151e411adb9f2940c8b979da6b398ea54885fd4fe25d51b2fd31212a37d427f776ec11657989382531b9ef99f883b0efcd3acefd2819243528e5f2a2c0454e0f8e647ca674", @typed={0x4c, 0x61, @binary="a2f2825e8d3fd626c2a3e1b93dedf36503af21acf967d1febdffecbb2981b7ac6bc0d5df798b6cd55a61e3505c706fa6f19da808b95b45b71358d2929cdb72bf2a1b0ab6dec6144a"}, @typed={0xc, 0x64, @u64=0x2}, @generic="f2f35509ce811d851a92a8461470ffed07b6703f1a2a3911bb508cef2381c2d88c2938bb33b0516bf93220bf987e4362ab6389200f74a53b604ce6db", @generic="9695fe3a590dfd1b124afd6068cd261381877581c61b516781ae2901820f086001fbde7b367b14ab1ae624e3b8aaf84c3f70a3546feca1c45d15a9422fc0f1b10d09836ab567a2becec231c0581ff8aae1583338e0a355ea945f4f32df076da4cfa8c39a028b5bea54dd825d", @generic="091bb2ae0f3d"]}, @typed={0x10, 0x58, @str='selinux#):@\x00'}]}, 0x25b8}, {&(0x7f0000002ac0)={0x1ec, 0x18, 0x438, 0x70bd2c, 0x25dfdbff, "", [@typed={0x8, 0x11, @ipv4=@multicast2}, @generic="42748ca4f1bbaba80e1e7e1a51f1fec578df4f3b16283c1a8ce42120485b19b42945edd4803426f65392c3f84b23201818821c70316893f623ab832c1ee8043a2f0ef06c1adf7f14eec1ac9b18351b91bc4c16d662337bedec8ef3e7def548ce8e355c4f34a62b0a65b58d94409fb348019131e2ee5c1363241f12cd6f9868b9c502d1218749e29375afb5e6f75879344f5719caefb1f3d0d0c7b089c9a73fa9e723855f8339ed35f84282bc4b5b3cc198ccff731e9c396d0c46d2d42c887b77", @nested={0x14, 0x27, [@typed={0x10, 0x5e, @str='keyring+a-[\x00'}]}, @generic="c37eb4db7c5169053c21a3e9c4e59ad480bb5a378e689188a86baab00f8296", @typed={0x14, 0x1a, @ipv6=@empty}, @generic="67a40fe01d3c1a3dac28472f8bbbfbeb08b6", @generic="7b812bab762598ebdf72283cdf529849d7501eb6bcf48b41468c3b1e71bd37f60b6b02b7e228d68771823626be802ab3a0f021049caf4266a87fa847ecedda95a9571d0f72079ff0acdb23c9accc3e42b6cdfcd3639a6d8b6403adf492a787cb765690a8dc5e01631e086356f3ff0b44b3205165764f62a1172b577f1ae4524f260a8fc2911169d1af600549f596fa3e603781d7506db2b22456d74632ba4bb675289c751c3b66d9935b350849f05d7a626c5d590cf0782c0870"]}, 0x1ec}, {&(0x7f0000002d80)={0x26a4, 0x1d, 0x308, 0x70bd2c, 0x25dfdbfd, "", [@nested={0x1fc, 0x7a, [@generic="082690a0e18caece63673a5d10e0f51f3272c9b3e336fa4695dd51b9a26233650267b24ada9449f2513ebaf3378d46a123e3c02e2f10f15c8a99ce16fec262cf1cbd436ff78092fce2d81788feffc3f957b47a782c2ddf34dcff450491efe77c7cfe7e7cd1bbc2d4d10efade0570d238b8f57370e1011a1c3f90378edaed14ebe5b6ddbccc96a4183e2bb3ea5e5acbd8eb4e6d7dfd887745b5aca65de93be322c26539034aa6446ba8d8392d", @typed={0x14, 0x83, @ipv6=@ipv4={[], [], @multicast1}}, @generic="cad9e29e95a0806a3b6b52cd18260d91553a1f0d8861dd3ec87df9a54372bae691a8630a431bba63cf2e8ec78c25fc00ebc0d73c9a8b307a67bcf7d80e13e3547700a43c31005bb8e0d711c18ab3b74610bb71f23f95e939cbfe3f4269e14f7b129f8908236ff1b1a21b4ab665b3ee012ed90da9c204052247cc1115bd6eceb3dfb0a660056417f4f68b300b55284d8d2af458c528ed20070229b079b69afbabd1712e3144ce8b94d2ef15fa3b60423e172eac07b97968d97268cd8b897b09b1e7f8d1a4d4e6981de16cb5886787ac90aa087727fd69f8eb08615034361fec153df3ae72c0f0b42346f8", @generic="977fedd89265290eb8ac929331463e81904a2bc665f0b71a93291f38dcedecda5c7bd24d64466e03994e75fce2f31d436fb7b56eb43c822b91c53432c8883e5964c3205ce00b05216e72397d"]}, @nested={0x12ac, 0x9, [@generic="ecfb917a6ffdb636394594bba5e4b3566088d8a2ea9a23c836b3502c624b224b869bcbf182bc5bb9a4d63ea8870318b511936e5077b81da60b26f5c6b5e51415a04f36c9d79e1ed99dd524368b1b6f891f84d6e3bfe542b83a21c1ff3a331ae8650979cfd56690ebd7c77af1ca03e4f7e4270585da67cd67b3dec375a319955f51940eb2cbc4a6887ec10950520bdb91d304f78a7a6c06839e66490e60c6c6ba96f5ea8be8eb3a67bc", @typed={0x4, 0x10}, @generic="b66dde87666a5590e3a5df746f676440411c87001d647f5b6327fb95433b776d257ab44a90be331b242bcf30f28e3b0da608a1c9828d5903a90029193c79e7742f9b429fa6431f4644096c15b7a5268cb90a0aea1210586ae1af4186a1291a2145b5392f5e94888348f7e1f2130d3c683cee4445a5678259abac63da936e7b629f2b5fbccf51eb0d5cd1cbf63d7f0580aacc0826e0868d22afa1d1c99d85cf772cec802a9c363057a08a7a3cb7bbd1a7cd6bf267d1bbab255a7e4e4245cd14a9facc26428c90530c0767d6d9a7a1251e321aa2dff24fb1c3586457b7567eddd964f74d74e901f96be1f6eaf9ed15aa775cacecf47402b8", @generic="b7fcedb49965f102b8e0f1213dc5ecf87581f0836d1d3216b01c9e95165d4a5d0eb8e6d735f0cabc2638e8153623304ac01877b0f100d5ac2745f499355a198d23bb3954de6f44c6f5b707753ccbc39ab54d5f35ea50c1c71a307838a84854fcb6ffa8e9eb640d4a5535b178010f8474d861bf7e1707fca2300b7dc3dbf686e14556eff5005aababa5fab35aa304853c72970d5cf7babb03ef8019b05cf12fcb440474f1ffe26e4181c8b8ddaf360faa334b399a3c05b072813cd080e987b829621c2751de99de80bb1fca1ddef6acf54940c50229ce4dd10acfca90a8091e9ad526505fbfcb29590f6895d864c763a79a218ef49cb777391b83000570838a65ccceb9d35863b17d6dec2ea71da0f1f82186d25344843cb87ca9aaf50535a914fdfb5b5750d4d110d926c0b82b76afdf6cc083aa7ebd6e8bc6768bf3f0c8f635414a92e3b6749f3cf635a6bb5feff10e77afa3248e462c79e6a4c59b1e66b6b1b749a5822ca0be9f4e819acec98cee337025660d2a2c80954b729a30d365367f0a1c9c37ec3c81b0ecc0cab0dfff21561238e42a03a7624d7527880c5d4d04ae55af11f4d02756fea395c339f6a0fa9be0fbaa9a7db9ed782b94d9104790e55131d47553bc82bae9a2e0d05804327e991b752a63ba1b8722c661864c7789a30fd0dcaf4164c9faad8eda21b59d05dae99113a555df6998327fefef22fb1369357037a65e6bc9a3f764b7b9305c100d04a283898b7b25cea3e53fa7d9cd771f403b6754e7fc3e5063fa0939fe020d9c80eda49d807583ef73f0cb75727b83da0696c23e6184e2b4bcffaf77855ed1bee12f2f603d5a12208b306a385f474d97a80a65633c8a7f48e45ad7c603610b5e2c32a8cc13a05fb66fbced17b12b14e9fceb57fc9cfdf4e9a6ce3387d05303aff79881cc8d37c1e9a8f6e159000bf88d45124b8cc39a486e57047c9dc5d821e7b9fbb5e4fb4592ef712e1cce6c824a9db09b89e596ff8b0442aedd0cda1fcb05bdb2f0538c5ab825ebf51fa3ab4f8a14c4ef0b6b2bbd65c62d1d79bb2a51fcc515a7dd38a7fb1fcce92da78a7da6ccd01eee0605a5384eaa19fa37cc9e580abd9c80a9d2e3641c3b24343538a3b714396f21c9d5682459a68ac2b05c85cf796d688100697eb54a0f5b33c499e20720a872a73e045c4c9fdcfedc85a3da3adf2a742725b7db18fb1cd03f00b4e708e9378bafe902b8a00c908e775e1255003945b92fddb8a8c1c738c48d05cccc380b1f5b288eff1de8727090957ca54227daf356bd6f027a596c7fb01d592678984a39f0412a648302d7fddfde9d9db8f0fc0605f4b5701b09c6c154fcca18bb2b8fd29f03a138119c03323ef2c9ea97f9707e0ed502960fc27f214fb4480de03f564b0fd94f273fc9dc6912acc0d083ab71e126fcd4366fd21fb33c55a586197856ab1ac4b9d209ce511e6f7ff1e1811ea168b01a98a1825f25c6d6add448142f3e5bee71f6fd8e661f05dd05048e3cd536ad55e54b2d8f83ac7c6cec49fdd30f73893d453041cd47b0f79e36547a37e8e10a3a854c94e4c5e5d15beecba89feda3149aabce8322a4bbf38188f93111f815eeda0e39747ddd6faf75ce1f37dfcc1f7a812184c4b5e6112b32cec703ced9d48b0dffc50f75a0d7e5605c0bef21c601e18a18fbd0875c0e287f5f95df854a572c681fa268bf9523632d4a16fce50688a5116a58f2fa9b51ab1c2cc2cd7ac689bb0447d0b5d8705373ee2b0a7a15abe36d6966d29e9303ac26ef823c1961e3ef4ee391a6dd5f01b28560f305c0db7b38b7f3718997d0b74177b7b9f36a5f3b6010a7d0a9b4179cbec24c8c4e5d63cbbc520339002ea00e636875b3baaf68e035fc0edfc58257478b0afbfda9b0ddc7e9fa9d605176ebf54ada99e6a8744ed0d488301a7dd73ded149a2545c0d22103b800f8408af2cd3270fecc93bb6a00a9ab3f95447eb2e73fdfe027b6c19ce82632850fa3e4a298d684fa72252aa507593987fb818a0279fff66d5ef767aa0aee8246324c03215c147cd6c2e600e52900f07608afcfd7e98379df687f147de76e81e2dc51225b09cb25b2db8b5d6bfc1f4c41d5ee2200b4c1d3163821f88e0585e6e5e49347ed9e4ae0e3086bd14ca2f09f392bd9694df800835c4449a9b4b2ab1ddf8f0ef629df36fe9264fd91beb0d8823daca9e1a4a09779967382d2ae95ee0dff134808ba511bcefcb51676e657d449ca2806d00ff1202fb21dbec09aeebe2b45d55d07054b34b09db6bbcd2c5b4ea90ff77197c0490aa8872f3e6cc1eca47bef4de9ed87a68e0b841a162741f1c26c691b91e10d51f3f946aca1dccf9a3f059ab18b410d180644bde62c44fe721ed4886b5ad174264552f0e6bc22feb47be277cc2cc3584a2af794a3b3729e92ecf8bccb7fe0e7e741e6d8c48d8e9fd3cc158b22d733f27ba477fa6761b02575fd5c5bf015c5a039787b9b80fac33c381b99cd6259b2d8e7c5ec06e40024c768da11f4e4a9a2bd8e76304140135af213a4d1295127aaf0aa072802bcd9282efe09d885ff3277b5bf029a2cdd7af976c4397e94a7049cdc40f24295c235504c751faa1247e3fee02aa48ebc27bf918c923a42b331faa464139e461e3559d8217ddd0c0fd67c3a6606feba1091bc7ba9a893069c81800967778a82604022a9ccfd4cb423bff69e04236451581068748b0dad156fa31bc0821bb45b6ef9665044afcf3b1379760e9954a31140ba8fdc21c65b1971e9bcd1bc69701fecd78e3071cf890313914a0300455ec41cda648693a24aedf1fc5671ad1a5740b36c7ff88f497e0cabd0a0891a315b859eb029fe994ca8826cffd5b75e77bd72eec0aba0cb9671a2954eed5c2cd7de334bfe4cab2fb6ea204340e8cafed20b4cf22740f883f3031adad821fe937323e69082d056109d80ebb4d6228d8081e5b475b83ae6f595107a5383ca04509d13097bb6bac455d15c048ea58fd19c2b0b879728f90c337c31736d8d9a479c6496fa8a67de0e8acd9abd9c1dcca5199d05901e0e227a2c812bd0b2456325aafff120f5e312d13fba0a4cc86cc7b1ef1ff260066f874ecb5f57783d76732ab1a24b67792dba003f02db151170807b5acd0541c7fb87bb38706f6b11e3807c1ac712f74f2b43501c154b7851fd7ed2a98f51e2de3302a677550eb30882de63c3a0139eec55484f93ce4e19bd3611ada12176186bcbf52770b82030edc6d049dda3c9ae59aae3a9554678e96ec11245a656cf73d7ff70eb3d1baea6ecc321d0b23fb9e41080b5e0cb50088f3cb10b147938eb1d4ef233f6cc0df9dcdcc99cc2c6f8fd8035707b761e112fddddad36a2eb168a1aee7bdb822d2fe250e938484c5f125c4cc8aa82ec1fd74e5ac594378af1a38c99b763900d0d94a520bdcf9582641c37316d9807993e6500bf78b6e13f659c4186e32b335f475f651d94ac6aa8dc93aeaf88c60013e005a20ba9381ad73e4fe86a9dd205dc7e1d0febeb8daae781598716d284763064cb760bec91ece8f4a549733871d40f4d69ca6e38489b83f60de1aaf346a78db4256a7e562342607f78fc829852a58cff630962923445ab024532b6d2faa717edccd29219aa978cb34ec3b685e8da5479de4a8c7bb9c5128b051beb4e3b85038e8808a0a34234ceeb097f6c51907944294a5cb45fdd3b2646d4be89ce77f1cd42749066dbb281fa39846bec41e010460d90b3c52cca096279ca49d6183a260a3817502691d202461e6b5e4e7409a306df23f12833e692cafe158a1d1b88baa0aa8d8059f6e05c150449d1ade9a77ffd2f4fe0544342bb32dd79a5bd3d9ef08930a363f4c3247d07d4e71b45d781d2339012790f984380b73cd44a73d17be190aa19dbab08b832c48586e9a524f4fea3b28f9c29514fb796e7e5c63f564b4314ca58b593da00f98ba3e86ee7197a9573ed0b9da8f4ca4ef402cadf75af5253e58fda781ad213afa0790886fab25ab6e0875c37e3759926b254c54612e1c838f76ac4579b89fa8b6fa2dde7f91f50e2fd589d3c102382a6f86ffea76cc299df0c1378631aeb718bdd48bdec2955c39e618563a47e2cacfb5f9e0332c496248a668c857922873e10b0b9483d20d688266425e7be3ceab2a3b486d74f6fcf29e96f56e8b22eda3ffb0c02e932d80f4f7e86aea4695c2393a2230d01c9061d651e9e0e5e2cbe0179e4a7486793933918201db913f44d2c0b70dd193034e4f05a6ef10ade6d3ea4d0ce725ac86d02d66288ee244f39997b9d3b96e1bdb8573e2b8d3d09b34f15df338f1d33296ca96a8aaa8a7330764a3f45a9d51f5197f6ae1a8d76798f1747e00fa28c44eb347c48b52fd1029fc564a77dfb31f9001e587e288b1aabfe68247562811b579d397f84b5d88660353390e3257d817c8388db40c7de9622c31c933466e225706b813fbe6726de6f1cdaf64f301c8d237b73bf24fdda8c2e58f5be28c439aeae61b9b7ac71780344d612f5db4d509cb5d4348b5c5c8bb5ed2e87627f1f818ebe0544a0ff486e13bab39c120b166641e0c073014f011cc1fa3e0a450ea58ddca779ed0ae62eab2b2fc12459890adc5e71913eacce602358350a3a86202f528f49787fa8ed93604d15fc07a025379acd87e5e6898a9102327ca4a93079d7b33fdfb26aa1ffbe28bc8ce90792579a656c97d9e6a9475a13db2ed725396ebd4c7dbd3b976f78804d1d88f29faf8b60c6de608f5e06f82945d9ebdd4ace1cd94280b8e3a6434d7dcc3daa4827ba742df969011ddc8fcac7caa3de16c80d90ddb12069ea6ba255d63acba2c06b115d835ae5f050e13192124db6b9e737ad0affd19695aa752519dbdd62e8663b6a574f768d74f5739b80e569e2c89c729bef66bcf3799dce54dc3e59e452293faae42517f08d6671063adf54818b1dce878497f3aefecdeac9c5ee63a2249fbd36f10a052be0d93e842e719438b1a9e4ac9799bb95a7afb21434f5c4493ff3462439c3e4d86798e84fd2d603b736c72be1e020439db7babdf6d80817b0d6e501cdc31cfbc141a9b987071e5c371bb9a7080b3c41add42b6c1fc26778cdef23245245df9a66aef11f87c9e67258fcf631447f5ad221a6ce91356881186a282477c66c5870233d713be56fdbbad5f0f95d07ed044a2c926dc6471a75523dd45561075339b2d07201e119bce24cb45bb9074c20ff0f9fd024cd29e6c1e44f557e4bdf2b0530ca96b402f44ea4f68961518ab0cdd96bce2aad74f851596cc917fb2c56c16ce7397601780e1bbad57ca86ebc7310c74b875c0ea6306e61bdc49e66141db8a1241629728d0fc69f7a91fa195de6fb2ab9b48d9991eaf6a774d90fc39ebff9e835706adc3a0e70c0aab177c755c644ba51a3deab39e89740eabd6ad3da37f74662245e2bbb0cf7f5ca12efe12a107351f8a23a2fb3a0b6b24a8bf840123113e89ab33f12d73b80e6c0add729aa4481986ee3de2e9a0c1b2a3487550396567b1a275a068d571bc66ab4940fd255f09d1f9750d6a7123aa3989846bff88cb5a25370e20579170da22e508114f98fcfc49fb76f0c0a7059990900d5a6fb6992ace6dd702e2f2bc5532c9acf2da04d68b96d86e9ae3df750711be2a0d1890bffddc6436ceb073d3ec01bfd4ae0e009bd33728d5124e1a3cde45586773d137f1af66bac3bd83e3f3843bb1777acd5131e1c8937bac09f98a6eba30263f73584b53572b72da9013411d05f8a3c75815f8d26b5dbaf0d3830174dcaa4fddbb6723aec5babde0950b274c7ecc275da395a5fceeb", @generic="49f480fb5a97eeb1ac181c1b787cd87c78b4e2114aebfb34ddeca9cace7d4262f1270b30442fffa11e4ee3086671d57cc67d6ce31ee16a4f80e47777bfb8df14c3833024de1b8b7a109f180c98e0d9f98f2f1a59ffcfb4ff660098f1e300450d7299d9751afb3fa5394bd4ae5f0566612b923a400c62fccbd83fe8ed7f08843fc06493476c96c3f3a466bac02991c45ae922672c2bf0d39a2f90f80328f3d5dab14e57b31258d1a041e85cf7e543005205fa5fb0310ae230445fa01a060b7d5fa56725fa270b6df5f8b53e244d54ce6fc393e74be12c63b582e6518fa140e2da1df9856b3c29a138a2d720f90eee51b08647", @typed={0x8, 0x6d, @fd=r7}, @typed={0x8, 0x1b, @u32}]}, @generic="0f921346d42c0a72", @typed={0x8, 0xc, @ipv4=@remote}, @nested={0x11dc, 0x62, [@generic="a6c7f7e4929d5a094f81b6ae15adcddb4c3e2ab7dcbdd9e3170bd0d07a26eff00a6ca5211269043b1b08ad2fe5cca38bc7f4129713808b964057e4ae19c035c8d3694f7ecd6d1d43e495fb38ad647494b700622eba0314d90e1197dc2bfefb00a596489404d95879676b6d23c6ffc472afcb27e4324b740af94ff1bff08504946dcb2f11adfcae554f0bc35f9469b006b1dd9ad70c87f77639ad8b6bbb5295f6390d43606eacaa36020b671405022e82feecc082c418d20e2ce9185cb9a168870982415f0a93875f123354532ba1589a8360ecb221eeae72bb462ce8c4ddedfc5c36ef0d739c38aec3bc6b26445e22d9e3c88dc5c886", @generic="0ba71f340914c2997b1e60c39b6daf4c214eb44e6170d9d25d3931d0ed493913a0342a76016f43b685998985c8b23ad561ff50ccd4bddea2b684c13c8be6ddb893bc904130b79ec0a5e1bb62e2fecdf9327ff0de5eef3569f1b7328734def3bfab12681ccc45dfe338e5d9a67abcf4edd294c7010919867bb63561a19dba3173f79b877dc6ce787216ccbfd5164cb9186ce8cb350b814339a71704bf0c0215b67b9dfd9fa1ccadd1891c82c48c8f7cb5fa111eb227e858eadd73fd21973d6e91eb2ece4031f3011c2d7cb985ec0ca8e8de386f10cc", @generic="4b6a9d56f0d688b2182eb4045cab3acbc8c08ccc27f92bd260ae52e2ece85af254eb2d31c0f0061d86505371268b858f66aedf5469c7e0dcf3042d8a7032b5fb3b523f5ad28abf60d268998671a8bd456a88bc3207d15126c22155fffbb2d01ea5dbac8a79cad00e55baba7142c050e6b249970710b8f04fc6f7661ac754b25e9342c74d6321e7ec963216bcba5596fc60d649d0e13d2e74755a2715eaa7911e0eefc197805dd3ffbda30fedf0f924f220d848caa6d8d539212781542051966d84aee04061ad8c11fc1a028b6bd354ac8826e571dc50e6aab2b44a61143584ad34b8d786d9659d8d4cd73d1dae288eee337278d77a11a5dafe0ff5ce05a3a2cd4412af05faf705f7d99d28f514606706565c179a054526937677c31db5635c1865a0cd13c49e33d95dcc69a477e2216735b559dadcf7f212859b5555a0a889724fe873f72777f3c9f44fbecef2f83c383c9a5dd2e2329df2b526943bdf0c2c1e321da9aae07a8c9752abe633edf80e070eb34f49c2278d8c7a7bff19931ca4187377111e06128dfcf7e62b702e8aed2d7df30563ba136d083a4a81782d9327f43692a737191a50cea9a0d028842d5e16b797758949bb3334ff0e6fe3abce9cdb77e114d4b1839169f6b168b20cbf113b4f4011c23e2fa6bf90edf9607aa13d4664baad1950cf0f92bd1ad116a7f419bc920d5e5142ce53702214d8463734a3442494141591ab859d76858cbb9c7e16b99903e7c552b30f72e0a4d3337758990f1d5b1c249c1afba130731764ea6234e635e86559a240542eeb7c7e918cd0ccffdb33d7f1184a88de4154dc8648a2c5b6ef096e6003cf60d10264608ac82d1f87a2daf14da96ae5b521692af1e619d8f4dfbfead1a40c4ced45a48dd21b47ea63f23be40f3ac84414ddcded25a419ab0ac752cb7be5e6ee810124709ca2e4852880bc4dd8ed7a734070d4d0f320ebd9927cf2c4af096a4013f0ffa0ccda544c04f26321ee5419c988efb980b1a4fcb54e240fe9258ca2d357605ccc3006be1da47d168e74e3261b3cf1a6aab3b5119d9d1cae8a8e567e4485ece42fbbbe381227ac54a4dfaf16cd11133102c9405b27c31d6d5fbaee67e5a6c4f7d9ac0d33eb9a6779434973dfc40c8ce2303e07cc05223502ccf97583c5ad567bd52c996e10689e0c6e3fbf40cea10528992cb91bbfff72530a5102bd2586ed3622e12aeb6f09c89e0e685709c7396f2a5a75ea303376e4ba74f692cffd5b2de487df5443323d95acd2ae70d8e5aab9af4905b53daf20194c16c1062cdacaaf32238dcd2d8bfbf33a4af3f3d8b0e3d1bff26394de1cc1c3dd8f2f0a8b6c2966040fafff4c090cb0269ca529950292bed7328dc4e95b5ab741ace315e1a64404eed214ce481429c5362def381a9ecb3e8ccdfabaf3eb9a98837a4987512e5686731fd747dd05d32fc4e6a4a9a74dee26bd0db3e91d4fc9be22deee9ae34acc208215ae98dc369ea53141103e7fd0dc582da9e56b1e6e3adb793c8278199e54f98543abdf441269dce21c1cc9851582c827927c21b32aa376fc5eb10d12b0f0b5de6ed1615d60e49486689bfd875a9b0c79f1be5f40a5090db064611c677ba7de425ed1cd843f50d100df11108e712ece4548714289296726fb0675efc406d0263841d6d6823d8a53f03e2e0b8e0b1c1e8bb96c2f93e47a04629a4ec253a9b2483149bb91b466bf9cb42a389aef418d9291f5f6c9d741e8cb9af841b1768348374ca94ed4af4d4e969c51e6ac5af58311f113772d7953db7c91b112d6269b9fefae286fdf401c6b57e55b68c3fb919f2a576640c3217081c6f473ef0ee9bb3dedc68ae8083621422de0113207646b3a86a034b9aa4d2a5bae8f57ceb212d73139245dafa489c3ec5169ed20a8945690fba339f9bc7de22f176771739b0e0b0266f7e350b534dad6f81bdb0ec7db24c422b8a7af2d89207d51f3405603e32e1f92e626fef24ada0d8351fad740e073078a0e80659dd2a674539ef95494d63cc7a9a372e2df53f2c874953ac5b6bd650bf8c065faf19582afde5d4241eb3015f852406de3589f9cad1913cbf257898d18dda2a734ebc42b4a7a10aabc07974a6f7219704a3afc15d7959e48681997203cf781515f8b84cf669bac5d57138724a5b6347fe1a4b9754716c684a5eb860a6d5ee212bd4efc02e048e61566f33024f8a33a07658dcc2d20a862999c84117c79141f544ed26391d983dac42614aea8702859b40202be76f091db7e8fe851dd15bd061f18a38f245b70cbb27571d7eadd031a7b80d6c15111f3fd0b1a1ae8fc31c074aacd6d05fe98f9d70976f112a7444637663f8c6428c6af93047ed6d3bf864c3ccc921d6185b686bfd473f1de356d8dcdb960aab03c835770bbc3d9aa5804ef3b20949509f768c5d24648d767ae1bea6792c657517a163546f93fc946cc217244ffcc23fda9aa5e7d74e759d3316b5b3b7474b92b15fd4b5a21bb4a78c518b4bb8bb3d364633bd29b13372d1f674774385728e1c80e2356d9da69e61ea3433170a1af75893379a9b11446f89538529ea89ea371b4bc9e94731eaf5534beb7899931d13dceb5f8baa0a34b120759b4c5be6d29fe1fb22775d5c170810932b9613cd0e27c569af28142ee55b684f0ccc4e575fe58c0fb7b41cb33767103761534695a3ea14743170666ec1a04d526e9f84a5cb3038f472c790a0911da5d4c2de57bf1108db7bfd6550661b791ad05f8aaa9ec701ce04ed71f73e07d07476e3111c6c675de8ce053ebc9e357d1e4acbffbd38cd5c870e0ef84a1e10e23fb2bd1d39117bf5078cecb0a759dfc22f7655f089943f117fe0a2cfb5855b4c8ccdbbb79dba1114760a0699b45afb69187406fbc279d6a06c52cd7d00d60caf5922b6007d93348be6377ec80981bc699fc17f5839e53f94f11374c8d74a36cd085ad15f545dd89689cff36af3f3026479fa330d1fae46bcd52a64a960308bce233445135171df9adcd854ed4d32cd4f7a6afe9eee11d759bf19db1b906e8d9dbc1f14fafd7a3c4fa5aa04462563227a695fb1a4f3ccfe80bce68eb7a9f03712b804f3b094c992f179468cb063d311dc082cd7487997ef4cf03a750b1d4964a086ec3c2fec9c19000403cbea3d2e95154f224714b8d469d372f9ed351f7e3fe3fcd166d33a6a0fadbc609d9c68e17d220cb4072083ad1a323783f7d5f0ef473d0e27db19bd42c61539db490eccfcb4693fe3a6888333c4bc284e3f8d957088960ea8b30aaddbb3374fd2ef1aa17563831a3ae15c89aa08b9a3879ad337ad8e40c661e8a3a836b77f7f8bb95ca015cfd4002f1085169ba97b47d9a4b91d0fa7b9f0db858eb5cadb7cf318e79e6aa3b35dc497ab98a8c3ffec2bcf1db27af3c13f39be9e159909092ffcf6b4662ce4de06e141490f84d7a1479b6f834b78006875c644d84b4810e0cb7c1c6238b1eea1579853415f97775974ec9bcdea0c7adb227f23c2fb1577cfa4a6af62993a0294dcef93b87a874c81a50fbbb7d8ad7485a54ca0759dba6cbe8e47a47a43a3e12e7d466b70eb79059a38922f282e3d09ff22f6df825eefa4b5e5ae34f9484c0c68521d5da285b88444841a174d404cc4cd38d022f4b2f4fa91ad7a2d7cfc1bdaed96e0da9860336b283a455edb2928b2679345d7482a6df59f00468038422d177fbdb72c526247d7483750124b7ee1fb625ca1bbd6be4f27b02f755e6369041878c02e07c757f89c7b47dfc095f87477430c807aa8292bdd5fd6239a972744275d60f0b916d80ac89dfa4361bf9bb063b1d661c2a09d6d5d7e3b178eda873e7a74e2700941e7e98ecdc5f5d0c5d2694dbcc49bed66a2c17712365d31791b1cd9ca559d7db2b10cfcc17ece71bb02f7b79050ec048ea5f4b38c374f0401dd4bcfeeff04fe55796ab8ed7b74d65c1443daf3d6823a1c05b50bf7038f2eef9bf15ee6074fde27fbf6cef1a62013300691b0bcef4e597d9f21d1845897d5f17a6ee1ea0c5b1737bd875ece04a757529c6a5bbeea7847add2ca3308d4aad2fb440a95d474475d07dbc78827d6943e66393174547dd592460fa50dec7202a921186b9654a230484469e213e3d86da4dc08d99cae7778d1026523bbd3cb2acedb377dd7fa6d4771c721c33496f35dce7dcec4c27823c2d96cbf0ec2380d860cce6fb18037b1f57257c73916d8c604bc47f786e62475be058807a2b50bc0dedd6f20761cab716c37760f66c1633df56af3f40ede1904043b834bba162cbe6582e7d7e7d5ce81a22504038da60b1796d24f79eda445b533dd499d8a4b745987e70f0e02e5329c29d389b38d0e70e3af4d08ec06dc71552b12d93d73b673985582bc7a09368d9c82f6d404dbb37684044fbe9efef48726bcd0b4f22a45ed15a911ab067d88d8f545e92316e8647bab03d2f1384e09c8db43d9abe7808d6dd60b8d86b24599d671cb8827fe83f98206995fe97ddd28df24c524fb395483b16df5ea90e7d3b7338f52013145d05be61919f5f803e9d56b40448f9c35276244dd839600aae634802f50154ba49656f9982fc17ba05b23dcd97ddc20a6eee9364e1478154c000fb6427d756d80a42dfcdb9164c5e397b9293bfc1460a1ecc6a786d88c82482b6c3f09bd2b039e1458106020252ea84b99ac304442c27160fbd112a671598df46296b5be85b5231c58117a3a5db9685bbfb9ce7990765b3a9f44ce15285825c5d1321ed2edd3d62a4525421a0085b431a98769a101acc8c857eac588062cfa6edde38c25024a1fab07b151ec0535eed1716f5b3f61fed822df67fac9e37ef287240118b97bd592a672338df93b941862f28914cb491749c0184219ec8ada585fb7352a4c0cd28298128868b558770b338291abd70fe40b78d93090fc1549f2a9ce49b29d4c6b63bd5f38d91bf9cf321f3ab255c19624f0a282d8fc3140d9d746afc60d11b23612bad2c193f2e070fee8ae872f238fea813c77e927aa6cac33bb922660adc34623d683ba0545465b471a939ff1e319da02504c55967cee84d028735ba1b29c09fb8849b1d5deee68e07428d844cb469d67e81828f047a97e2f84f7312605ff9fdd2c9dcd3a29191c6703ded5464a66398dfc47039ad4f1e87d8a002b299eb5152a6ec36f8197d7801aaea49327596e9fd46b2f614938eb1338d4141d992eb9257be693c31737d2df75df08893c2b82a949491a0a8910a5b5ad4ef09f0c0b9f5df2fd469c56699b29c94ce6ede1faf0fefcc87528318a606ee4841c87e794fa16cc6fe4843473fd5d980c62a99d8c4923ebf12b25346692ac04dbf5ac7dede994a8ea3499625c1aceb70015d48b221cfb8aa67c30c78e83c844a61c3dd93064c5baed2291032d9270961916e26ae04a086d961b513dab55e1318b9ac2e0173ece705949d48567f89edff3f54cc98de332f8d4be87d64df42a78f03a7b45ba28c73185e4f3ba651d8d15e8ae232d4a66918c93c424a5b6bb5147c332e892614df44dd60cb723cff39a240736306f7c512686263fd605f2f165848d355a41ad1e91bc3c7c99ab96e2536ef89de287299514501b2b61d83f9008a55701176c29ff68d39e7e6c2499a659e746d65a301da858164ae80c246c969588a7307312f44510aa0489d70446b04f4065e367b74983d249abd7ef4e27e2efd4cc1d7b630961dbda6e24a91e700aab1f07550a67c6f53364c13c5e85ed26732e7e35402088049f93ad2ed4f62ff59f0bd747c804d924604e941dc38d2867951a6452d97fa75badb5cccef47d377a980", @typed={0x4, 0x57}, @typed={0x8, 0x74, @uid=r8}]}]}, 0x26a4}, {&(0x7f0000005440)={0x6bc, 0x10, 0x800, 0x70bd25, 0x25dfdbff, "", [@typed={0x8, 0x80, @u32=0x7}, @nested={0x3b8, 0x89, [@generic="815b4f46be1d9ad557a15883a7679d4656cd1451511d86629c3e876b97230fdd8659af15bf70c842c4751c2538d651a921931168213d3f771fff8e532d2c6d9ba69a3fbfcb1442d3a57dc7184297bc975d30fff59f92354737c96706f0fc8dd6eef27210768cedd4559a6f5b2bb24e478adb9c425a7fa0f9661160714e830ab5d92b82106efc0156c273b2187015808d5606f568eea13285f3f5d0efff0d0331852477a75ff917d0df055c8db479ed0e1f36b0fd37f63f618bbce8e1ae519959c84922094f8dffb6445346b774e9c6a0c5dd10e8f13992f554099f39b5f97364a722a2097975a5f9a79ff1ae8fe2083519b74cfcd438df6be434c0a7ab", @generic="eb10b2ca124b7c7e42c65c64e7f216d57be63a92ee4d20428ab344e5f6c0c5ed81fc1fed23b0a8689570e5f18361605127e2c464293ca3f6cbea8afc6916361d1b5d924b0b62b0a27e17c5a0bc8f8f6bfc06ca561813e79877c04eb134055e8631179f242b8f1b1470aa63b84cf1af44f472ec729acbfcff4b173965e8649a3409d47601e1cfec069c68ece5f2b3328a7820f5eb69f96f0887f1b80322105e1dfd9a71fa5cf5006900688e0e139acb812667a3a6a4abbbef870f9c794a5a5c38a007365bae286c8f08072c3c17fa655e41271b893c367153b84cd390b0afbcb4ef28dd69d9aeae", @generic="9ce63d9f3a4f9c7aa81c5b1fbbd291a215ac8aecaff87dec2ef57cdbfcbe742c98829dbcedbd484974d0c86b471ca42a829cc3c4ac7cfc265229c320c497db770d8e863157b5b6646c3301ae319955a479ef9704663ee9c6a3e48be7f2d74486ae3f01b3b9f1505c82de8835d8de21aecf296ba88d11c64b4d8873b2e93f3ad043f618d14bb4544668f042b2f1b753f815fbdc5bcf369da387ace2620ec074673c", @generic="0dbbc81a3c973f20460c052bbb19125f4fd824b8e0c1ffaccc15854f0afa9adfa8bb4efd8f118c923c3732676e7e0aa170ba73997719329280", @generic="6ac72c99a1e7143c4a90da4f21d2a169787bc021b03e8ac3388a863d8c33c76a6543a6313c13bae590cc0a0b33a10445919bf441d0bf731421081573f09bd8ed30c92578facf2f2de966ecbc3d877b5c0d46d43715b6076a52c35dc7218b6febe2f7868a65725a0c0f4362561519a17bb1c387f995ffd7596ee6a9a6a7d839465309d2a03a80f536c3781d6b53d60c052d5afa9a9aa5010326942a04b31aa57e12b71c827d08f701dd3bd694f474f37eb63ab7ddbfcdb173348ba0eb1a862738e9995d3dadf7186208b0e88659d9abff63a688725729195a6647faf0c3c423cacc77a9a2ca4cdeee0ef8d4e74444d5d4003efff965da"]}, @typed={0x8, 0x53, @uid=r9}, @typed={0x8, 0x63, @pid=r10}, @generic="522bc6ceaabb8a3e2b60c655be3b8e4f6b2ff2ac285f80afa184f54514257f6e8854044f3aae2ce0ecc10b7434099253a435c0c2f72616bbc5b3d16277aa74677a2382b19bd66588988e584c468ea8992540399557de23f48efacf1b", @nested={0x160, 0x7e, [@generic="f111658abb3d61ef62c24832798075c9056579397b4ef3ddf58199b76c242c4053192ac703a487ca16e858e2ee75d3eeff71215744271ad67cc8fe7a2f492aa15b9b2bd0ec010d3c6c0e9376311da7353ad184702ba028819dc37b96bdbc479398db5e9d605a3e64594263a7859b38ee7cd2cfe473f2f4372036b391982b7782abbe267e1519cb18104baeb9213bdd646d925ef9a5f792fd163ff08309b30bee74f3f006336435978c398196c5f7227d4ca6d35ae9f6a861ca7fcad0e03f41ae4d500bcb632f790968fcc09d373e3e6c7ffe43a79c78115e46a67a36919e30ee5834e1eb6e153c93", @generic="c5d720f663e7b02bedaf07245947f178201b16ae7acb8703e2443e8721c5e256fa3b2a0480f425b369cf4cd856303381bc479a888b3cf6005126ab171956f050c8e4568b18fc91a0a52411eb5c022c9e604c413931b621fd9142271ea161e13a59863e8c8df770b4cc", @typed={0x8, 0x48, @uid=r11}]}, @generic="7eaafa21d84371cc803464ffebb16aa28db439fff3e765abac3062f330ec746385aa10ba9e3eaa9276674d17a0321afdcb5482f6d0185f2d55c77e4f881986328e91ef3ac33609e61164f475cdcd9b05960abd0ae3629bf02c3f1c6e106af625b56e510395cba9bfef3816969295e09f636e7902ced6928b59f9df1425ab253ebc3381182b0ba7969db0161deaff09afca686859e2702450164c562a3c6e667bfe73534bf319d7a0cbb83270119b2861b2c6db26141c04", @generic, @generic="5abcfc22f10e16f22ba8d302603c5c9f6eabc68d263b9b078b272d6dee1a7048d82f4ebd362b9597847d8341d03300d1fad5d4bebbc4e4a037d591fc267e9f5cfa6f0aad8c26577e3488eb45680ab6551b260caa5c9f7cbb8fb096f9c0887e29b3b50f2a58cb2157"]}, 0x6bc}], 0x5, &(0x7f0000005c00)=[@rights={0x20, 0x1, 0x1, [r12, r13, r14]}], 0x20, 0x4040}, 0x4000) r15 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r15, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r15, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 700.001961] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 700.009282] R10: 00008000fffffffe R11: 0000000000000246 R12: 00007f81bb5596d4 [ 700.016616] R13: 00000000004c5227 R14: 00000000004d9368 R15: 0000000000000004 19:29:36 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000200)='/dev/cuse\x00', 0x2, 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000300), &(0x7f0000000340)=0x0, &(0x7f0000000380)) write$FUSE_ATTR(r2, &(0x7f00000003c0)={0x78, 0x0, 0x7, {0x7ff, 0xfffffffffffffeff, 0x0, {0x6, 0x401, 0x3, 0x0, 0x1, 0x7, 0x7, 0x2, 0x61, 0x80000000, 0x0, r3, r4, 0x1, 0x6}}}, 0x78) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000000)={0x0, @local, @broadcast}, &(0x7f0000000040)=0xc) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f00000000c0)={'ip6gretap0\x00', 0xb}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = openat(r0, &(0x7f0000000080)='./file0\x00', 0x300, 0x102) write$P9_RSTAT(r7, &(0x7f0000000140)={0x69, 0x7d, 0x1, {0x0, 0x62, 0x7f, 0x0, {0x80, 0x2, 0x4}, 0x8000000, 0x9, 0x0, 0x3, 0x1, '/', 0xb, 'em0em1-@-!/', 0xd, '\x8ctrustednodev', 0x16, '(wlan0cgroupproc}self!'}}, 0x69) dup3(r5, r0, 0x0) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r7, 0x84, 0x21, &(0x7f00000001c0)=0x1000, 0x4) 19:29:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x2, 0x840) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r2, 0x28, 0x1, &(0x7f00000000c0)=0x5, 0x8) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x1c1001, 0x0) prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000180)) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) close(r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x4) 19:29:36 executing program 0: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000002280)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000000000002560b700ff"]) ioctl$KVM_SET_NESTED_STATE(r1, 0x4080aebf, &(0x7f0000000200)={0x0, 0x0, 0x1f3e, {0x0, 0x800000000000000}, [0xffffffff00000000], "77e7bfe633acda23f1b06f373ec6aa115fe14b94b8d3f0ee587701070cb6c8b632e4896fc361a32b425fc2d3a72ba5e41c39319a8b69e9e0d1993ccea759835116b5ed328c550ed7090f5ac8a605667dd6f58617cca67d2a6542ded170df79b7c93346cb499623c2426e80b1fea86ad656cf344ecd98846356ca7a910d087634344ca0633793c598a7cbc43df3e0c3c175a9b37ec4e34af989490bf928dc1b4975273f429806247bbead47d84381101601e22e11c0647042a3f82ac7abda2ac1ec51573f150772f95f92d0ea758228e3292ec2f8bb20b2406edee5d063d6527eab89aaca53b8673318a9a480ea1733b397b67c2c3b64f6bd3583bb42106a0af4311262a6656ca121cd71c65a901eced5adf239dd489a40334e65aaa4e027310500e90abdcb71817d6e7db46fe2242f785671cefe549e155c8008416c932cb253ef98f3bcc0ff137758bfa5e812504111dabf503766f00e241148141cfd1dc719a3eabeb111465aa6b7c51179c13a7535e62695d2ce20eb3c64250e6c639e5818e4b50a892d4d07cb01a26dc9bafe4e1fcc8c94a0b728fda60e0bf1318a76920ef62463507b2ae205ef7faa7f7772a77821305922d9976b7c32f4b0d77d4f5bf7731d5e96303ddffc8794850a99955361d33d6ab29808366a2d0ff7f66039039d6a88cfcf995fe1d1c82f675da7bf59e3dbf40747271089c3af15eddd10d68c84b3c177f266e7e1a49c2d8272be9aa91cc832264dfd78875ac1abf469d29d21dc0ad33de26b13d93d96034843cde69c16c2de9b15fb70708725a07eab0931705fec937506f06a813ee0aa322464e4b86bd6b8c3aca5a6643cb13110898252adb9f99aa684e44114ffd4807f53e3a72f27faef7e77850234b21eb9cd1d2f89f0a8196f965834724c2d9b27f8b59709837551164f95f2162ed8643d7015233d5065d4b9bf20f5c6ff06b669d39837f0f368047c3c30f7f8544748ce501a5ff12a71ab68fca3b9fd5aadebb2a6af7fe826b2c7a86c2c2fb4a035c60125921310ca88ae74a0a2465ea0dd35f14cead724fb79461d0693b2e3596b1ad3288f39c308ce0a1b379f4e4c8c4770f6ed315e20ed8e66e2d23757d729859cc7f42d4de95b956e20723b557071e7ec92956aebfa804b0accccf9021d54481b7bd3ac1a1f6547a06da9efce63a38830ca2169c23de5071668bfb16be628b6c19bed438f6fd9ea7d395e281846c831ad788ca1a751275aac3377ee1f247462657e25607b15ad2f1005ac4ae8067fa330d329af425f024719e86eeaf649cecc35dd938ce1495c720d44d21095068e86970a268365644f2b2525f1251103ea114ecb85d1b6ff0a9753c22e4e76519f0c0d59481155d5261098413bcbc3a439bed2fa1f0a4dd8000a67d131997a3680a1d833cbdf91622f9715421457ca4304afe92723d7606933f19da96e81bd94e949eac453a002e13b2aff643d1136b9c8be3c21ce6a81ba1861acc578037537d3b11922d18ec3a14a2fd3d8d20a438bdb9ff6e389f5a3ef97ebd3d99c6559e3ef1c7782d87b6b7302413ca7b4d0ff5826539d1ea731404fc199c98d5b26984d8ac4e4430eabdd398ca11ca3865ca0a0a089dca2e15e3ec92d312ee915e302f8620a66aec2f246172b700eac1aa8ba588da544af7e33e1b2beeeda8fef5e547887ae776802f8709ab5332ad1f077b7fa423fb8a793a9d5121d49c5cca9d6662503be91ce1e6879e5270587d239b350ab04bec6da77789b467d407f2e9a6f3d0fd2d5e5cbb0b613d04e5120b76724b0a80ee4df4949ee1de2c80351d4630a1dc94aba18bcbf5ac754d2376edad9657a12db32183bdfb2912c52e793fc07f70e9067b471e2d04d53a76cdf0918f2a7b8156d9ab33fb4e59e8e29f9a3737a1869e469119143ce601a9e68de09da6c4e49b24f09f0a012123e74420d5c7346031c8b9f97498b5006522ede287b9bc4b3fec1d2268bd9715b9439cffac18fdfdbcd12878d1c710ccd58bf1437fefae3170057407d85395adc12ac5fcbddb79be90b5ee1be6f66194170c6bad4579a405a447c2f484a64ac92684985326d89f909be7f2bf0b844483afafd6dc97c3cbbc8fada88693db62e997e2614370a331c22bacf4e3491f089bad79d8e9729ee1891b90cdc08b37957920070435c96f3c8fd2b3e2fa6ee05ccae526d0ded2942f9740d07da98859d8d755ad1ec26f99d2850b71a1fe98c604d3588b83ceb28cfc7cb9c484f3aae90ec1d2653b2d4b13bb26cde38b745ce7e1e4647cd253f3cb8ca445c6e945238b41a2fca4d900688775b2ae233fc39ce434014f3799e42729a847dbde54adcb818f6d1c16b908aeef49e39ead173ec485d6735fcdf69a2d2949a2267a8b17e70a567afbcf0aae8109a5f3cfbf074b8005eb5c55015ed9b7392889b4132b17fdd17975990315f8361b2c1d8a7cf41138c580f8acbf4eba2d6f3e599a95e08089299a28704272e9bb3921fbdc15ce5ee17ffa975b1a99722e425dcd77a487493e30f236a6d958b6827184c6d0940bb5371b572c72cb6a46e2d876b7ff76e7ee74e82aea1c16fb6d2b9d318609911c66c66a406065b81d773f8335178fbbbd9e5c303d8e87c05f8bc19c23e05db6e1e35055f4700ee74a5d38c185f6215ed1d968e176c3c280fd176139fc2e80ea629ac0ff70fe2849c84ffe062ddd63cbe651474aef6d2404560323e7991930e259abbbe896649792d4b99a3e09c574f576b262bfd4206c426d80c154dad0307d1b942c23f06814e25ceb3c27de8a9ef4afa64581370f33993234a0fba96a527e1c9fb0a2e1eea886f59db1f2665bf9a7af5cdecfeb3a4c39aefad31b5cfb2ac31eb257a9f67fb46185f2d9596aa201502da6a2872dcbb21107575da800ee7365c07e4f9fc509331276ae203677391ea388905b81d47db11b2e811f7269029fe235e362c97bda99f2e39330f759b133b217b0323953e842d6fb9e1a715550b484aef6ad54dbeaf850a9d21aa3254f811b776d1af5cf1477032d03cc654158aa144930c9c5ac5bea936fdfbb90d14cff0e83faf4a9d6d69b470c27e9c08b294f15ba7f174c1e37e8a7d30890106452ddc5e5f494baba78c9d2b01fcd4554d7a8f069c39a44a448ad4e96514c4e09109719b23f1f7dd6ed0cfdf2b572b1ea7cbdceb83c8a89827636cd8d595e49437538b71bd821300ffdf5618fa48cfbe604f910e673e2a5434b0842c3cc242cbd8365b5eaf5ccae14e23ebf00170c7f5d3a51089badbc9dd382cd00face907621b501ae7dbe4fb9156e1c591abcb95c5401a602b4c165ec7a713d0fd54bf04ddc03988072bf1d0cf1ec1d0cdcaecc52f325d7020109202cc0af02ec5929d0683edcf53bdddd37af9b72b451173c43af69f5d38cc0be78622241efd14a0fdc332d40cf81f2be18e4bfc872e6008b7ced26eaee1b655a65351a4c8eb8be4bbb1ed81ae4fca416af54caa608483394a4b400b209cfa9364a892ab950043fe8d1434b86267ac9d2a5010866d9aa66079b486c89faf9b4833e906bff26c54de0bb908f5e48941fff8779f6b68a9cd0a140f76284678252d7c0c794a780ca1b29d286b15b0a7fc34933c6d5bf8d65c39510fefcedf0814a1729cd0639d49baa4c4eeb09fc2ef0aee12ee39d071c0f45abba39d074231e4e3e5121a7bdf501f6ccaf2fb84da9556f83815116c6badbfab8574d4906c6a742ca69037ca64da30fa60836f4f485f4a8b3805de882c00a43a6d1e156b232b5aa1d6d0cb8ce952aff4762bad878996c2d2c305cefd36d0e6259823535bd32f575658784bf49bb66893182c6ae5a9d05cb9783b92d5d238a46c8bd006f8caf83e3417b7b3fc306a21a5e37ca0381dd813cb43c199da1cc7d17fc5e229bf59a7fbb8398516cf30a397a11a87c856b888ee4a92d0577074632fd27b146c9ce640313374ba5b1ef5e5da560b1b54a404a5d86e7827b306e7a30e9d87f376e5a4b74336d9dd80f72fe23c71fe31a0f8407b2c06984f0aa0337d7411cfe3967b7bad73d396ab159c3d4a96893e50dbf192b4ef67f7e612f9d2f84a673c89534a16e9fd94238d49c2f098e981ed504c0bebca1ad1f788df5bb554dba0c255561560d11a2554163d0b593cad8d42cf3965850b073f9d6727ad517afe7b893b6cc8e8b5e2d8308bade1cd3324a52a75e48de4da5b492627970dc569805559475fc755cae0efbb4545820497cb42730fbdd64c87d512af106fde4141dde6dfda1cfd70eae3fa5165e5b7d83168cf42f7b636b879d3dd4784819efe90ac4f6fecf577376edd949ee374205bff47ea8468961aebb0819c28c164bba2791e24a24b277540fe383c160bd348072aa29cb2bbabd94d51546e86ea64ed92d543b62685fa40a8dcc45ff09f0efd0d875c80cad8d87a05bdad6c4b36167e460b55aa99b578216ab8e16b7371308a0673aae890a79e03f2121d90d090e841994dd13b90dc1f2c13006b8c6dc8eb7da46ff9a08f72f418056bbf2c148ee7afcb4d966930e0d77c976aeeec52b7e306fd71e7c96e84c0475e3eae1bed42f7188e8cdea91aff0550f8580701da5ef1fbe7f563e0d8c996a727a05519f49ace7283a9d23860887be102a729ace27a9d5931f13653128c62a69432bca6001f631b88bf5700f39653896610cf2b5692791d546623c47bd9d29f47942856cf31b94659006cd3bb8b6160122ae59854dbbd9425c41e02a14283444d53c97cfdb0e6ef10d8a9677edb7b058048098ef39db9949129775d3defdbb3c89626562f481082603c5ad7953675bebb36f12226a6540c63206260c6ed597cc642265a922677182e141031db068d43bb3548f66d51881824d5bfd06d31d560a83f0604db77681ffb1980c98325ee70c6793f56d72a2b24f962d7d5b90cd26a3186d1e6d364b1b5fe48d82352c1cfd6305bd2d1a83704e8b0780eccfa670af11b1229fe89b9b9a750c39625362fdef77941c6aa2f31a627ae303614089aee01ec09e6c6140927efd32f6cbf8f7e554a5b760bec32ad00304fac658276d7233864c259f652eda03e86d4bb7d0bdba128692783e39c15b3bede2442e0e37962ade8e83c94a9c3baffd603aafdddbd40f42f304e1ae1e368bf2179a8ec5f3512337f54255013743bb8243e78e64a33661321a62bc53aa4686b82a827de3f2b50616e3cd219e38b62f785824404aced629a7aff7f3d66666f7f43d1b0c2ec86dfda9410a3cfe1d13f1aee678be55568717d3c6c9ef7a3ea7576a657994ba15b9ff42e74e58a8deea871304f0c708a312e3c2212f1445704efb729a83068caf0c5c1e94deba36191789d3582b49ea81a941ef1879f96c775375e16496325982b48e462396dda3816e17275449967f5e016856bdbf6397ef80f2560baf8da4450c5b3890a92f82e29c58fbd2e5680817c271b906cc3335444e88834e9b59446a282c8c8bf40777e6a873767b05ca3695e5b645411941f0f471cebf00c57bd8a3f64d427ebd74f3a44fff07e787a9b82b3be78434f7f7be38d91901f4802f4c01cd3ada749fdfaf6f4eac16cef7ce36aa18c638b54d526f5a11f87bba385e6473032afee437b7ded4c567f57ed392f9e678c60239d9e966d9a66d04465c5c9d5301b3a1463c3ce3fb36dd6b3012e2e82161a5b2a1f960c31e1fa0b9192afd35ee4aef57e496d846acf1c1ecc3ada0b6e573480f7324459f4eaaa9d73f45221d07e7a3d5df78b7b0e2f9432779712e74a879c0e5da28f4504643bdbd44d1a5373c74a470b3cc1ca9d2fae0e6e38de4a9c", "0e5bdb3b3033127607cbfa50e78c6d422eba6b4ded0eeb384bca0febc3259afc098e6970a9259236679ec5653d575f476e3bd7a9283736f01b5dcce63be08ac04b32d709fc3b754e9de4faf072a6eb233b9d45d26883cb1865dac50ecf61443cd42b2d9910aab2c8e6afcf5f5dcc4e754bc8e87feaafa1f58b66a162a4882561e03d5e5d60550c77f8ffd99864b19b0bb448eeb20ba9538a0ebd4c0ffd3b443ce13f29fe73a81ff07edae06e5ad3778997fd39799793d87f8ed6975cc1c17f28f4fe86d3ead94e60ef7cfcc6924e32c8919a02252b33059804ffdaa78a42fbb7a9fcef2f6684a63b8911e3b342ea7bca82432c1d33acd56c2ae1bda485a1036d5afd8118ce8de7d7b79fa1a83b61d61043faff3dcca9d147f9bc6aa36b7caa5ecace5132c3256d0281aff0a8170b09fd357769a2878b97087a0106ba4554ddcb22657456a1385d97ab13381136009313cadd2b0633c2ca327df3647b6c99c17c8fffd09a17510bff021a6f0bb152290dfb15a3ac0498e11a79425238bdb831a386e0e7f7c6079b9102e2232ca2ef5d4c4db78c98a25f468aef739b5c4c232ade5a34c4d13f9d3972d211b10c2cd0e8ec86de3a1ff25e698bdffabe4a0fe73603dd6d242f1ab61b942313bcde8cf4716e6c707b74204059a64d28ac9b2e1fae55662f316fc0910449fdcac8afd8a57c0f1b6dcb2ee3d35a593cb83f65ca5d45a6ea184f5dfe2db867fedab41c89339782b7c781ece7ebabb31191ab10006fe2cd428753f4277646443c4bde3b21e5b90756554960625857e49a93963a2fb31a679fc5bd6d06c3666c5594557a818f9ce808e42f12854f47cbd0895ed4255df5a26fa5185b3a4538d2fe77444b07dadcf036fa4cbea9028957ca110633314c4e339b65864dd196ce49b93ea890901dffa0de5e89102ffcf8b6efcec85e0c2cc9a87f25c188d417aee36ee9630d023746657ba0062d550bb59e4d9820816e710dbd17b4784ac9a5274f3bae5a1b165e5c82cbc5ed0edfbbaca6fbc4766167b15651abcacedbca2cb752a627c1104cca2a639e54e23d18131c12064adac6eb1de15e4f446b3ed703c4d9341c279a3841e6dda32392e7f0d7ad473d953676dd085c8b803e9b6bc6354b9b300e583d5e3338736844ad7f272c0f4b4417f3687d1d9d62044585b0e40893e1f57d47d925ab7d9daacce2f01adc2f914d1339da1c85fdf7e58afcfe9f6c27fe6a71329a36fc6e389c6ee3e5040c8d328e691bafc7b138a6be872d10e316050a07baba1d3f3b4984ab04080dd8699e484bbff8ede56de9220552b42a498c94a3ca27dfff5fa03f9386ab2cf44b9e4a2cd6d264d0a7c4b3d6644c3b1d7e610ab7b9bca3d1d3987f09d3bb617ce2abc0a0928de718d44801e262b3bdb3167a4daf881ff11869c4fea3083863703b10b7a7c541830d3376a98597622622da5286ef24b85709683d89645e9c418fa3d4f26636826e45c34bc752ad9e0b6cd05bfa74c36a4e77c9fcfbb2bcac1fdc98c4dcaa875d0d889ea39ab46d112c760d150cc7cc0dfa2db8d0cf7468843e62d09935e311366b5168b5fa29e11ed2432e6b022fc30eb307b4bf6776e4e94b1f388f1581320a19cab0c0f0630a5c4b50ca7e6da43d9580b98ffc08e88f683bfba09e9df5ead159a2e84968720ed03fd6f4dda039797d8255f1063564397a9057642c29fc055d5542af399f06663a847149a41b1e6caa84b4ead1b00ae52007b8d5c9c0f0d51d22cb1a6e59083313b0f479de3b1e7736d4e8df41ebc4ecb00e313d7d517efe45326d7dc8cac03788eaf32690294e864479db24269e8f7c2d90f1d3874439c578a491211db5d32d04c391ca522e0e7d94def0118838d632684ab26794d15bdc75c09f2294cbd77ce8647182c085ecf751887127f286d7cd812d3f7d57efd3b2e9ef587cfd3b0e4c6c481796ecc0d01b531c48f48c47e11ab8cb1a80c4a2780ccc6a3e87f35ad23c1a34e65047e753e066428d33f56e708a376b9694e171d5215a32e3bdd482b8cc97fc1cf11ee6771b954ff64db42c598cea00d02307177a55fe7b793b7b033304a6a18ec2d55fc33202cb8edf1e1c850b72c8b600b3bfcae61ee32a7371fec1eefc2612c08f83dd2f1067a6761f7767e19db2f93f38d72804e41ff6ed32f5160d7844b2fc645d50dd9e85c6f328f4be0cd6d316caf8f5faf54af850407161bc0ddd3848aa902a160d5df7ad64dc7f32b6d9c56423583a46e2c696c153c445ecedacb6f93a8686e9c5a07363a85af73c128da00b37c343931f6dfa0d088919a8b21f071c6335aef66a86f3589605619aab8dfbeceb8953f7528a98df94bcdef57f26249c757b3865e25b43343b83a5167f5bf6cdaa2cf16fb0eeefe031cda9db81b7ae78aba1a93ee21b87ebb38d49eb3c0af9ccb62701f7ae86e6b7ac48de0d785f2e2e3c2637da8908063039a2f2e71c4fc6da1ed85791ce4ccc7b4ed08127e156c392346d57fc5f66d772277b5a8d2929f8c6b15d856eae88b34ff0df9286372073a6d6df7251a5863a11fd23962f909dd0a8df256063ad32e134ff932f5bf990471dbae51762a479ffe221f17c47dd15960d126a8000343028121cbee5b24666cd3e435f76b17cb7ae75023e89329cfbdef3778b04842ef70df12b721b2fc4fd80c69c6011c9d799491f34a71995d64310dba3a76f736e0e1714754bd98f9f6f1ec53e1a97d18c317ba968cc93105dcad88c3046d615dba3fb65c8065a22ffe3cd788d3018e8c0385f16d3b7a5775daff62bd09b755b27d27404e8ef9b9557852290b977f81c4bcbcfda43f42af9c64479aef2de9f44a6f4478e2393752e0251361621062c37f810d9ff71bc400c5e4ded5874a6427957924a9547a93426252545e9e497d5a003fd7f00041c381f7038f197aeee5ac74f2000768c01569bd5312c927e3ee9936578c1c0521b183bcdc14647d07ab0fd8088a472541fb26a430327569d9648af109bd79f329325c64ff8600d771a877a969bae9ca8f85596aae1adda58d5dbe222b3be011a2031270698134bbf925a0714d0ea8a90956327720e8cbb6bcebe7dd066bb7cf1f57e8f6864d3421d79607a9822f3ce6eaeb880bd14c41313b7309bb54f06a3c0bf436dafa0ef053bd1c33856bb4667a0ec60589665cb59617e91dfe11a2a0a0a498a462252710e190d6f4ba7e3ab639722e9a91febe0ef292b44829fe9288211c8aaf58af81fe1421375dd25e7f00acd1b98c2c30cc699fa1de42595de7dfe22919570311ff1fc11e58f8326e9b52b49e32ab07f9e662dbde5c8e3cf565039197fe973eb9b0c4a6ad5d0b7df31f40f91d442f99191547ab52876106457fbccedaeaddb943bcad9b42204f738c3ebc87ec4195de7c29f37edea6b2d01d1adabbf3e27e5347a898c00b838891403e8bd94497b2bb74db5ce31d6f4ff8113b20b7b0ddd413c091c9e25ebcff2aef978d83ad6a7c4f636a316a1942bdd314698f60df7e0557c9b083c9e173b5f93c3413216dbef086a30668c664d9b9bd2a0da7a0fb981369ca6406f01d0f200eef82fa056e4d829b64118af28b1defb7c228d13302a334774f8771035004020259a4ff0896ceaaad85871ad115bfc351684fdc4c27392f671b93796346f790bf70ae366edbe27ecf554b0aa730902da4ef6c4f82073dcf0f4f94d580c5c296ed717e473cd8fadebc421b12e50970dc8c8b83066ccd2e0a1477fe9c820f8a1cda2aeed437622d4d301da25af7089c307f5b8c4f0e4b7e48a95d8594d2547b1bb4d01483aac16dafc17600d08cae94c9d02d5c43bd9ac8449ecfd958649e2d475882685072b2d7820456460b9346d9bdf8e8599ab6b609cf6bd56431b30280fc179dfe340ee628e8b36297660117afa5d1351c45b524803f5a07e7b261ec155af6bbc2b6b1072e1f4452861ab3ebf4ec366a9752095d574418e89833628892c761e70f0fcc2e9aaf05b380c8ac8659cf56f2b3e0fb0ccd99a4ac85dac7ed49453f05cec9db023cb285b3d139815c54e5a262214edaf77054a3e6762c9b7e254a9bef9595b1b091dfcdbd4e8778350dec958ff9af63c788437e3e402f341c57433afb8c3fe816595a3ae0d18e4e6051e37ac1fac0fd50b9206f2f2d63695ff0deaf0aae40dd30e686329fc061733ed2b81119e3a62b99589c59723aa78dd9aa12bcef7e5560f1ba616da41784baec0f238cd84f373b5d8090c5c0f3d14dc3865d3a3794d177084bd83b95c8d30059c551093268ba37f1548c206c0b6761949040f61fb0f58a5cd73ba43564dadfc13c0d7c31ec8a678edb41efe62c687970db2fcbddf81aff73c996a77319f24ca53675ebdb766fef4a33e268c6375aaa203c52fb8b05e55eb9fd544cab154c4fa1a7066f4cbd7fb57325a68cf9cad146908c63d5356c26bd188a1bb8b56168b7b96ded1cb4c0d8a864e5091f553e51d78c4700463a8ef236227225d905491144f3efb8ab7ad7d8571135c065de5a44c535f111641908699cefcf7885aa29d4a4098da5ce0b4a30481b0ff5c5c775412735d5c0398f61207f166814ee64951fb0feb6369e4ff5db228efbdee96c4099943508d94e6bac769958aab0ae681bfae9ea03f5a8b686932cf540f535c13aab378b657a312db6038b959125f2314c8816065e606e52636e8052a1660b8d9dc968fd08849fd4926f3d3f10ef9825e1cfaf532ed4082568aed10933357c1bb4cd04dda15e03ea1f75460822f755003c486259c61d8817d0cb09eee9575c346d7728550cadc231f36e86e38269f903147ebd4b8cb2ce6c876584045ca2f440e8c3f15a70dfc41bc48cf73313facca01ddad8314b9e030a2b79ff03cc16d25ee0110e9e391ece7a44a2da93c3cb844707eb912a2ba3738567d3511d34636efbd6c552c954199553a0fbe0d9eacda3144eed8625226b50332ec4f7f759e6432e93d93c0831e1222a7fdde18bd936bfbaea8f09e61883ab492c99c7528909efdbdb754aeab8a2f0470763d4137b7384f622adea0a43868424d3e19ce421faa83ce8ca51c0191b5fdca7c4504ac40f1a131258b56810855cdf1bcdbccdcfd6a09c072f9335a0690bad06efa72cd17edb44feb526ca3eba906ca44776aa9453535077addcf29abc2d391d5b17e12a8d8cb10f3d48546278dfaebc5afd62256240257b9def987b4890b68786d95dab04160e43357937c06cbb4a8bb3c73b158cc103fac80b1494472908ef8a23fc5818b1e79b2fc2a594a86b7bea0a25f03a50c54f185e8c2d8df0d8efbc24fbeb28fd28d0649e8ec0b660de563c4960c5e2fa12d1762669cd3578a5df3564f76a2d32fb9c3fd8cd2bc0ed6bf9f2d6ff274c4f1519ffbfb50af77c9ca3a2c98996db1eb419a07f8ec89086be4a874f7ed409314afa4749e3bfda7d05f55552f804f9106f3d5c99c917f6b75b45a7da435c19ad7b5abca68dbe416ef0f945b526678e6e4ebc86f119972b492f824023d4e812173005e026409c346fd856702fdd17c086849fd88da43b63090e80a79dbdb947361b2a8a783a40e8f25d620de99a0e41bd9831e52ae11e6c837df96568801c93172fcadb58032a95d446cabfd1cbfa226a8cfd4c5d11d1221c5f09c3e9691d43b44d2f6ec374cf4356da5eda60edb86a3353d9cdd5aa08e05c6d60453039588e2d4e11a465e90fa08a8ca2d3237c74c0afaa30bc5e67a56b3872c1593478b3710f81dbbd3e66f63a8f57a0acdd6ac2e2d0862d0590d9e0ae7b02048703e6cdfa4a1a8aef0348d2e225da5f466829500"}) [ 700.298898] binder: BINDER_SET_CONTEXT_MGR already set [ 700.304427] binder: 22038:22043 ioctl 40046207 0 returned -16 [ 700.338883] binder: 22038:22043 ioctl c0306201 20008fd0 returned -14 19:29:36 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) getsockname(r1, &(0x7f0000000080)=@x25, &(0x7f0000000100)=0x80) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000000)=""/82) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="d97fb88592888900"], 0x0, 0x0, 0x0}) sendfile(r1, r1, &(0x7f0000000000), 0x2490) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:36 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2000000002, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:36 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x3, 0xc) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/snapshot\x00', 0x181800, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000580)={0x81, {{0xa, 0x4e20, 0x1a08, @remote, 0x8}}}, 0x88) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000380)) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000000a00)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x280}, 0xc, &(0x7f00000009c0)={&(0x7f0000000200)={0x28, r3, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffffffffffff8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7c}]}, 0x28}, 0x1, 0x0, 0x0, 0x8010}, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000a220}, 0xc, &(0x7f00000003c0)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="c7034b810100000000010000a4f7ff6abaffffffffb10c15f8002c000400080000000800050003e6000000f7f69adb4c3ec5da2eab810d2725888cd88bd6b2a1879f956c9c7d4e6e0368cc93cc0871dbe3cc8ae0b002958a6421271ad720eb1fca06d4916361b0a28194643c76974a785dfe047bd11ab010aca2169339521b64fb4a9d3fabd4332559a980e2b85437c77f1abf84f1ab3047611868627fef60f67992f1dac5965c6c0be117fb4b0051460e3b4ee47e966d433d53c5d6e8fcf3f39f0e963ade6788cd2eb3e4db21e4ba2dc5373ae94ec70bf92a64a01f3e"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x40010) ioctl$BLKPG(r2, 0x1269, &(0x7f0000000840)={0x1, 0x3, 0xd1, &(0x7f0000000740)="b2059319c81b9d979cdebf4a88d20565638c73946a89d37e245586ac3f4b69946b00ba708bc2381d61394e7003bb0c221028bbc716fc102ca2f34ada7fc34d1fc5985e56e2bb9d8463e4c9cadbfe138cebbfa8a500ac7ddbe40d6e7ede596c74b11c852866d81caedc94689d82f12ecf1dc766192cbccb0109ecb96b264efc414304686d87ac7328d15a60f9d19fcd6eada5ce2686c87b4158c5f2419430dd7626525fc2f4f82aebfeb111ab7f860a61c8138cee16fb91c471948a2b0e1dc5afbec2921ad29af1ab6995446f092286f274"}) r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x200000, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000a80)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x9823}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x1c, r6, 0x8, 0x70bd29, 0x25dfdbff, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r5, &(0x7f0000000280)={&(0x7f00000000c0), 0xc, &(0x7f0000000240)={&(0x7f0000000900)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="100027bd7000fddbdf250b0000000c00030008000400e508000014000200080008000800000008000800000000000c0003000800070039240000080004000008000063f36046233d02eaff02a293d231b56075af9e8b024ebc417e6ce0b1a2524ec3150be0a64ade1384ca211c36f3a050dc283f868b64a21a03d0c37dfef3f445a8c6fea66732070de3c1fb6820643a7333e22b"], 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000680)={'broute\x00'}, &(0x7f0000000700)=0x78) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000640)) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000008c0)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000010307031dfffd946ff20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) ioctl$PPPIOCGNPMODE(r5, 0xc008744c, &(0x7f0000000880)={0x2f, 0x1}) 19:29:36 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x800001}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 700.751127] binder: 22057:22066 unknown command -2051506215 [ 700.757137] binder: 22057:22066 ioctl c0306201 20012000 returned -22 [ 700.823496] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 700.843648] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. [ 700.849401] binder: 22057:22074 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 700.859656] binder: 22057:22074 ioctl c0306201 20008fd0 returned -14 19:29:36 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x2) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x4080, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e21, 0x8694, @empty, 0x485}}, 0x2b52, 0x4, 0x40, 0x0, 0x2}, &(0x7f0000000040)=0x98) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000001c0)={r2, 0x3c, &(0x7f0000000180)=[@in6={0xa, 0x4e22, 0x19, @empty, 0x5}, @in={0x2, 0x4e21, @rand_addr=0xc3fb}, @in={0x2, 0x4e20, @remote}]}, &(0x7f0000000200)=0x10) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000300)={r3, 0x58, &(0x7f0000000280)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e21, 0xe8, @remote, 0x7}, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e22, 0x4, @loopback, 0x1}]}, &(0x7f0000000340)=0x10) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000380)={{0x0, 0x4}, 'port0\x00', 0x20, 0x1, 0xfffffffffffffffd, 0xb9e, 0x40, 0xfffffffffffffe57, 0x6, 0x0, 0x2, 0x7ff}) 19:29:37 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) sync() ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000000)) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 700.970957] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. 19:29:37 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) accept4(r0, 0x0, &(0x7f0000000080), 0x80000) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 701.036722] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'. 19:29:37 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000400)='/dev/vcs#\x00', 0x6, 0x20000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000440)={{0x0, 0xa2}, 0x1, 0xffffffff, 0xffffffff964ec281, {0xffffffffffff0000, 0xa83}, 0xa56, 0x8}) r1 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x6, 0x80) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f00000003c0)=""/48) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = getgid() stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x5, &(0x7f0000000340)=[r6, r7, r8, r9, r10]) dup3(r4, r2, 0x0) 19:29:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB='\x00'], 0x2ae, 0x0, 0x0}) 19:29:37 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x800, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000000c0)={0x7, 0x4, 0xaa8, 0x7a2, 0x400, 0x3f}) [ 701.324175] binder: 22094:22097 unknown command 0 [ 701.329229] binder: 22094:22097 ioctl c0306201 20008fd0 returned -22 19:29:37 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@mcast1={0xff, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}, 0x0, 0x0, 0x1, 0x3}, 0x20) 19:29:37 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) write$binfmt_elf32(r1, &(0x7f0000000000)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0xffff, 0x3aa, 0x9, 0x5d, 0x2, 0x3e, 0x0, 0x256, 0x38, 0x0, 0x4, 0x100, 0x20, 0x1, 0x8, 0x214, 0x6}, [{0x4, 0x4000000000, 0x0, 0x0, 0xd1, 0x549, 0xfffffffffffffff8, 0x3}, {0x7, 0x9, 0x7, 0x10000, 0x5, 0x200, 0x3, 0x3ff}], "9164a1fcd6fccb44a16ba8628929bad57d322ff1152fb80d9eab62ac515e1867daed9c63c2e2a9226e0f01ca1ac9bd77ecb5fdbde60b860a63c46de61898a35efcf8cfa53782f337ed6d43c9c62d22a7192fde9f1e59063165b64261bb870094c8466b2d49d68d1c016e983c6e5d8096734a9fc837d20f1112f83d0e6796decef657ed36bc74cdf84c6b1225c008629f0d2015bd0251aa70bf0897", [[], [], [], [], [], [], [], []]}, 0x913) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000a40)={0x0, 0x0}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000ac0)=[@in6={0xa, 0x4e22, 0x800, @remote, 0xffffffff}, @in6={0xa, 0x4e22, 0x2, @mcast2, 0x3}], 0x38) timer_settime(0x0, 0x40000, &(0x7f0000000a00)={{r3, r4+10000000}, {0x77359400}}, 0x0) tkill(r0, 0x15) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000a80)={'ip6gre0\x00', {0x2, 0x4e22, @multicast2}}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000940)={0x8, 0x606, 0x4, 'queue1\x00', 0x8000}) 19:29:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x400, 0x0) getpeername(0xffffffffffffffff, &(0x7f0000000240)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000002c0)=0x80) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000300)={r2, 0x1, 0x6, @local}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x3, 0x2) ioctl$VIDIOC_G_TUNER(r5, 0xc054561d, &(0x7f0000000080)={0x1f, "0cea12fc681e0d75a38bb3565b9db402d5405ff38b00cf83d5d3d595bb6ba022", 0x7, 0x520, 0x7, 0x6, 0xc, 0x3, 0x5f4c, 0x1ff}) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:37 executing program 5: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x80, 0x8001) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[@mss={0x2, 0x4e5f7b09}], 0x1) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x10}, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r1, 0x8006}], 0x1, 0x0, 0x0, 0x0) accept$unix(r0, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) 19:29:37 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x8, 0x80000) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x9a) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:29:37 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x800) write$FUSE_POLL(r2, &(0x7f0000000140)={0x18, 0xfffffffffffffff5, 0x3, {0x3}}, 0x18) close(r1) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) sched_setattr(r0, &(0x7f0000000000)={0x30, 0x3, 0x1, 0x5, 0x7, 0x9, 0x100000001}, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) mq_timedsend(r3, &(0x7f0000000040)="91509ee826a30db5119b80a55d72dd22dbd292fc8f9f992c914f0e76f03292c74bb7ad52a988565a95a604c0de3bb32bf03a7d23a89360962c7bc038c6751bb021e5c3baffdd3fe4254c470906581e253bae53bc75b81f41e69196632d0d0130809578200a1627f6", 0x68, 0x800, &(0x7f00000000c0)={0x77359400}) ioctl$TCSETA(r3, 0x5406, &(0x7f0000000180)={0x1, 0xfffffffffffff6af, 0x80, 0x80, 0x8, 0xfd25, 0x7, 0x6, 0xffff, 0xffffffffffffff00}) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r3, 0x6612) tkill(r0, 0x15) 19:29:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000080)={{{@in6=@mcast1, @in=@loopback}}, {{@in6=@ipv4={[], [], @initdev}}, 0x0, @in6=@mcast2}}, &(0x7f0000000180)=0xe8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:38 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x6, 0x2000) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f0000000040)={0x2, &(0x7f00000000c0)=[{}, {}]}) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:38 executing program 0: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) sync() ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000000)) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:38 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)=0x0) ioprio_get$pid(0x1, r2) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) getgroups(0x6, &(0x7f0000000040)=[0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xee00]) r6 = getegid() setregid(r5, r6) 19:29:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x80000000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x80000000, 0x100) setsockopt$bt_BT_CHANNEL_POLICY(r2, 0x112, 0xa, &(0x7f0000000080)=0x5, 0x4) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f00000000c0)={0x7fff, {0x0, 0xffffffffffffffff, 0x9, 0xffffffffffffff78, 0x5, 0x5}}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:38 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-control\x00', 0x40, 0x0) setns(r1, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000180)='/dev/snd/pcmC#D#p\x00', 0x7, 0x400000) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f00000001c0)=0x3, 0x2) r3 = dup2(r0, r0) prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000140)) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x1f, 0x30, 0x6, 0xb2a4}, &(0x7f0000000040)=0x18) socket$kcm(0x29, 0x0, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000400)={r1, &(0x7f0000000280)="c3cbbd66d55d059f3bc4dca1db64ecad937e167e409e45ddd7fb5afd1afa0394bb5a33cccda9c355e7de461a6f84a547a76aa4b50fdbbf111e6eb34ea412d59361e51c241b93a2b51e081f0c5696a744900d2e78f9aa9060d6e7e89a783531fc39e552e7a78a5484f1ac080eeb4817822615ad1fd994f544cf6ee4a6acd941c9126e3d206cd04b2470f1336063887e3dd5b3cb051e3c7a8690ad7a4329aa1cd16d208402b5d78abbd66894263ef8b1e8391aeea43d30f8c8fd6e0661d1f5744a532df88d936440f3c21fd1009f700bade032f39b309d75fd48", &(0x7f0000000380)=""/109}, 0x18) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f00000000c0)={r4, 0x3, 0x5}, &(0x7f0000000100)=0x8) 19:29:38 executing program 4: socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000040)={0x1, 0x6}, 0x8) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x4) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x4, 0x7}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000140)={r5, 0x20}, &(0x7f0000000180)=0x8) 19:29:38 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) pwritev(r1, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f0000000000)=""/194) tkill(r0, 0x15) [ 702.390674] binder: 22152:22153 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 702.398337] binder: 22152:22153 ioctl c0306201 20008fd0 returned -14 19:29:38 executing program 0: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) sync() ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000000)) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:38 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x2000, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) ppoll(&(0x7f0000000080)=[{r1, 0x8006}], 0x1, 0x0, 0x0, 0x3b1) ppoll(&(0x7f00000000c0)=[{r0, 0x222}, {r0, 0x20}, {r1, 0x8220}, {r0, 0x10}, {r0, 0x8}, {r0, 0x1000}, {r1, 0x1009}, {r0, 0x200}, {r1, 0x802a}, {r1, 0x6}], 0xa, &(0x7f0000000040)={0x0, 0x1c9c380}, &(0x7f0000000140)={0x10000000000000}, 0x8) 19:29:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000900)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000940)={@local, 0x21, r2}) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000140)) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e630c4000000000a6a5f6d2aebf5edbc1ed703ad1683b646824342213f684c053e965b8c28162a78873ecc457713ef3a290469e6243752c55d113932c035eb598a78a0a2fd95ce86ce9dfa60422041ee920f6cd6622a1672381924529497e247d4a13faaf2db7b31f5d52a534e2b4e5ee2ecceeca01f8f09852cfda8916d4cec552900c69edf71ba91466c77c16245ae18265be3525ffe7a33f2aec779dafbea833ab995410e31d2e213f1d7791fbb4213951c5"], 0x2ae, 0x0, 0x0}) 19:29:38 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'vlan0\x00', 0x2003}) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000000)) r3 = socket$inet_tcp(0x2, 0x1, 0x0) fanotify_init(0x28, 0x8000) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = dup3(r4, r0, 0x0) recvmmsg(r6, &(0x7f0000001400)=[{{&(0x7f0000000200)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000280)=""/95, 0x5f}, {&(0x7f0000002040)=""/4096, 0x1000}, {&(0x7f0000000300)=""/85, 0x55}, {&(0x7f0000000380)}, {&(0x7f00000003c0)=""/92, 0x5c}, {&(0x7f0000000440)=""/164, 0xa4}, {&(0x7f0000000500)=""/180, 0xb4}, {&(0x7f00000005c0)=""/124, 0x7c}, {&(0x7f0000003040)=""/4096, 0x1000}], 0x9, &(0x7f0000000700)=""/113, 0x71}, 0x9}, {{&(0x7f0000000780)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000800)=""/178, 0xb2}, {&(0x7f00000008c0)=""/9, 0x9}, {&(0x7f0000004040)=""/4096, 0x1000}, {&(0x7f0000000900)=""/166, 0xa6}, {&(0x7f00000009c0)=""/176, 0xb0}, {&(0x7f0000000a80)=""/182, 0xb6}], 0x6}, 0x100000001}, {{&(0x7f0000000bc0)=@pppoe, 0x80, &(0x7f00000010c0)=[{&(0x7f0000000c40)=""/130, 0x82}, {&(0x7f0000000d00)=""/98, 0x62}, {&(0x7f0000000d80)=""/137, 0x89}, {&(0x7f0000000e40)=""/93, 0x5d}, {&(0x7f0000000ec0)=""/217, 0xd9}, {&(0x7f0000001040)=""/93, 0x5d}], 0x6, &(0x7f0000001140)=""/175, 0xaf}, 0x7f}, {{&(0x7f0000001200)=@ipx, 0x80, &(0x7f0000001340)=[{&(0x7f0000000fc0)=""/45, 0x2d}, {&(0x7f0000001280)=""/85, 0x55}, {&(0x7f0000001300)=""/37, 0x25}], 0x3, &(0x7f0000001380)=""/117, 0x75}, 0x9}], 0x4, 0x0, &(0x7f0000001500)={0x0, 0x989680}) connect$can_bcm(r6, &(0x7f0000001540)={0x1d, r7}, 0x10) 19:29:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x10080, 0x0) ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000040)={0x3, 0x6, 0x7ff}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:38 executing program 1: r0 = gettid() r1 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x8000, 0x400) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) sendfile(r1, r2, &(0x7f0000000080), 0x7) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r3, r4, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 702.915351] binder: 22178:22182 ioctl c0306201 20008fd0 returned -14 19:29:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563044100000000"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x80, 0x0) setsockopt$IP_VS_SO_SET_DEL(r3, 0x0, 0x484, &(0x7f00000000c0)={0x6f, @remote, 0x4e20, 0x3, 'wlc\x00', 0x3b, 0x1, 0x46}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e630c4000000000ab0800eed43cb3ff0f1c2e"], 0x2ae, 0x0, 0x0}) 19:29:39 executing program 0: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) sync() ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000000)) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) r4 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x0, 0x2) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa0, 0x0, [0x70a000, 0xffffffff]}) ioctl$ASHMEM_GET_PIN_STATUS(r4, 0x7709, 0x0) 19:29:39 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) accept4$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14, 0x800) tkill(r0, 0x15) [ 703.300370] binder: 22197:22198 unknown command 1090806533 [ 703.306418] binder: 22197:22198 ioctl c0306201 20012000 returned -22 [ 703.357594] binder: 22197:22198 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 703.365511] binder: 22197:22198 ioctl c0306201 20008fd0 returned -14 19:29:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_DEBUGREGS(r3, 0x8080aea1, &(0x7f0000000000)) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r4 = inotify_init() inotify_add_watch(r4, &(0x7f00000000c0)='\x00', 0x2) 19:29:39 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) ptrace$setopts(0x4206, r0, 0xd7, 0x8) sendfile(r1, r2, 0x0, 0x8000fffffffe) write$binfmt_script(r2, &(0x7f0000000080)={'#! ', './bus', [{}, {0x20, 'mime_typevboxnet0)usernodev&wlan0$/procbdevposix_acl_accesseth0eth0{&vboxnet1cgroup#cgrouptrusted'}, {}, {0x20, 'vmnet1\xfbself%\x9b'}], 0xa, "7cbbbbac4479d1c53de700ec6ceacbde00ba54463f97d7611ce2696f34c9f03029f6af8a553e3b838508e030e60d5aed1a1ac50db2923b91eb5589961363d63a3325924e67ab6045d78a11ab94a3b518414344b64545ce0f1c031eda778c7bc69ee1bce9735a4c08dae7467ac4484b62250593e18cf53b46eaf546a589346f40c63e933d3dc3eca524f0"}, 0x105) timer_create(0x800000000002, &(0x7f0000000040)={0x0, 0x7, 0xfffffffffffffffe}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) getpgrp(r0) tkill(r0, 0x15) [ 703.693670] binder: 22209:22214 ioctl c0306201 20008fd0 returned -14 19:29:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e20, 0x80, @ipv4={[], [], @multicast1}, 0x101}}, 0x0, 0x4, 0x0, "bbfea53fe9e162192e187b14f32a934d7dfa73c98f1c6e422e4ee8779250c04d74f231fd329dd51244d87eff93ae6eb47e038fd179c747f05d92245ba583c71a574b1d9849d7a7f3f4ae698af559d26b"}, 0xd8) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) setsockopt$inet6_tcp_int(r0, 0x11a, 0x1, &(0x7f0000000000), 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x400, 0x4) 19:29:39 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mixer\x00', 0x800, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000001340)={0x0, @multicast1, @initdev}, &(0x7f0000001380)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000013c0)={'vcan0\x00', r1}) ioctl$VIDIOC_DBG_S_REGISTER(r0, 0x4038564f, &(0x7f0000001400)={{0x2, @name="8d78812748aeab44de7a490743d04666989b5ab637038b5d3a9b4ab2f797cf1b"}, 0x8, 0x80000000, 0x400}) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, &(0x7f0000000000)={0x0, 0x7d1c}) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ioctl$VIDIOC_DBG_G_REGISTER(r3, 0xc0385650, &(0x7f00000000c0)={{0x3, @name="f86d311209150f9ccf67cf2e1ce43a8ec0a5dde9f822ebea633b2518fb94f7e9"}, 0x8, 0x6, 0x3ff}) r4 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_G_FBUF(r4, 0x8030560a, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000000280)="0306b64b466b05bd6586c3be6ab16a8ecde2a9ae5d084667e4989ac12c7ce090b40af24edb6c51d28ca6f7d250aedd3e21ef0130570feb7a0e02881dd14c3257e1ed7b950d6d29ea7db93fff942472a34cf2e675ef89b6e65403f2ce035b3dfcf6d110ec227e8c1b9421eca21bb4f98d7ebb0bf96eda60ea9d46b3be0a16a435da44c67a89f9dc01011683b4d5ae6a6117f51c2ad8b173ca45ce07659c8afc795312f7b163d40e7d1092b19454663e431e61a3d3bf581261475d51b0ac80b0766642cd6a2b0603cef9cf2cced0aeaeacf896d1b5b3534c2b200ec3ca75c6597f1129da8e9f500e2a2f906bc8115dbb6d0063c5310a62505dfd7b9388b69e507625ca3f99864964b73ccc74767ffdc294c359ee959160da8a62ac2d2e6320c0464edf011761acac593c78f97fde509874336a29fa6de8c3e87ad1370401c8a788cf82c5e819f18820ab0a3b6d6fb9f4bcac66df289e1c597201ffe054adb4fe069891c1545995358f271d16610c24c80e471a42012083e21599d1f7a06d21d33608054bb874b2030b076eb3d3430ccc7cbf951a2e0eb037d5b3e9509ea279eb9a59e0f28b303983693e8f22355e291e60ba46d5178363737f88be72e387f096dcb81baa62422db81db01e20b73195b37ab4cc4cc2e8ed1e76b5dba5f0ce03b9895eda688b6e85713bd7331e720af0f8cd1ba41bdcb085b9e2bb8e63c138b745cfd8c0ad7ef03eecfff87e90b315b9f7436dcf3b413b0e0edf6c199db55937d0664cfbfdc3e526585ac4558abca5f961c973ed9fdf7a23f1640139ccf166ee4c5cfe9f98ea7066f990e884715713d9a895f06dad1133d52ac0dac7566c6259b9f8c262b12693a4d9bef8c4be4a061842cce8423f1f5da0fd1a27c2df42deecb47d193a691d6d71556ebb90a3484e4b5ff5250936a3c8602c110d8f8b85207564ad6a3b2b279c389ab58ef3e9e4c3151c388c3f55e115e620d76d315e25919c251432cb33f796107e07a175608e97807e1597c315193ca317556364dd2bcdd5ca8dbe7a46d6bcc5ef1f8d388f7b9e3864d17f7b05413ce24fb60ade98bbfd066a4bdf13567eb0bf03ca746c22b82777fa63317b946cd6039f335d4a2e3c33c6305e863b3a67473fdc08af98e86e6307e4c9fd1eb1b116315279698720ff82ff7972f24e7c3f2f894e21f56c01dd4f215b4dc0c4d0a24dc0c3f60b7c0d27f56450ce5f2f06345b988c678c4e3dd66925ee7c51b1f742866d2e3c6b26f2226ac75e90abea5aa1cb0af93a932142bd937661e7e74235d7053159cf3ff294a411f6d32f77ebf24f945180d81c49fcfa3e143110144963c943f5ab9bb46e489799c11bb5c94e94af774a7648f483926a495aaa6d2f74cc537a782518d89915ceaf6bb6861be37c89cb40ae1ec3173820379a518a22d9a95586f39aa308ddd632f489d3beb17206357abf4b8e462c14f7e41b662492b52bd9e2243f8c88e74faaa9be53b27edbddd79a8e2150527d0160d2e641e42ad3fe235465b691e35588b7711c9142a365a91f36876d29ac87f92aef7acc94160e2a2cc4e96b09af592e3a9594f1330e6e42c1e039c0bc759b2f22e1eda7be9e9b7042426a78f9812a03960d3a8c3a784f74dd69dfc8f291f5e2981bcc91d27d4bc9d5c5bd6ffb736013a8abe0d260877f2da53dffc14254b04aa87eba8bc49c25fc2525bf115b9f73b65f54f70cf472c56ff76e1db4a36073b94eafdb8d04f8096df24f74659d0ad4c67057fed7c3a899913ac4d0e6e1a87ce164190f60dc90518645e9f852bbad4f9c58969b47bbc54e01458e20a82996f2c2994811c160fe07541b1c9b97b9bfa551a5930a3098efc5acc1ea612be001e975e72b28d4eb7693f41a7ab2e484b42fa8cf369c74005f71a9bae8448444ca73d027f0d6ed11bda8a6e501863e77084542f63059c6aca86c8ddbecc8b3e075d21255b18ff722afa3db19c47f6d1d06a4d863e9114b2ef9d803b8811f7228916a99679ef103895829008b0fbb58317ab1f56597943f8420fa8af85e14de6468743d62ca072e932457217a6601f6cdbe61d8400cce88ebf3a25958beb2279ea9dc491f8442745ea56a08f6649c5920ca539524160e6b38ee53ab39fc49aef8bf4c925ae6b8e6bf06dd70976b1ea025d43d21f35bed3ed8c782a11b966ad16e05aa49da6dc7ac5b052918453b39bc5d98de8a5b5b63c78bae93b6cb6692e38c3c510f9bff3d785f0dbc19273a1079047917b72552e2aeefcef21dbf5b28d0a79ced50e069872797d908c730ad82e78d22a1a6c5b0c3959f83c4de21a54d1584a31c3c2712977e5961d4466fff2b543cc7c57cbb14054276fd8c7a75a8e5cfbf9b0804aa4a2bf67601f7fb571d38b1567d1a210a832f34a7ef014937127ce405b973dce4e0632956924a274fe1ca1d8dbe96aed2f6bb3a3c01671802b426be6b69ee84b92db48c278764e49cc236aba8c9ad73575a117dedae1a4771d62d8fea16acebb1f0a7e0e984b72871f66c442258d2f43e3ab9196d3e3382ae962d60f4d61ee69fade7b1dafdc4a8c6daa8c671e1bb099ed279bc1e2175208662efdd1cd1512c3937e868bf951c850640cb30ed6002c2679ad70020f99ef7ddf720f122815b7bd034b3be3f40553707b8ade47ef73845e67cb143ede5da4d565156ac7d7fe53beed7722493a6d7e0fbbc3c07d429f5c2cf3142306d1f0e9531d02b0c55253caca8e4e8f0b809f2a7f5278c6a84ef43d73a47be2b55e8aab1e49ca17c7bc94e4111e17141f25096e74bbe51f3ec4bfb6a0c3ea710d1c21f26131895aa935fd0ec6062eedee9dfdc80dd812143c50f42526ecb79e286008a1c66bb355f3d12621411495d9ad517aea5572d2f5f099c0b118345302b00e30fb08785d4d0ad969635be45684d3dc560aee9b08cfb1f56ae5ef36e36d2a57d571c677901476f4e2bdb8ee047d862892a6c8523bb10a76f67764348a321571340558250efc4f03af25ca920819606fd693663fc9846c560a24ed6be738b85c2e170ce72891ce9284013b2ae280d4916fd1f88900db3445b094196519efed3265da3468e9fc843263991c10caaa23d2a3835d041492f866ddc62fe8a92d7bfab26b2021ef83406713f2440c26e55055db0db5e67832f9e1d6f13f2d57611c4b62eb88d99d3d5970987237da4bc0071a5098e253f6cd17258dc8c0065a464dc765a5229c351e0decd13ec9c99c1f0e37dfce2399e6d8bdc58336d98417d048ad760e6b8d31234187d78eff2e76f86bd4b0b5e9251a2618f4345692b7a7fa54fa5de62620f6ef8650eda688ca7fb5d5a0961f4df9e24aa101dc182359f5e35867cd19c42b3b2a626545b1866ea288da50f3bb24bee95111dc22e31976239efd53a8018cd905d8c1ce44642fcbd6f4e89496aa84b7638fbfea432dfe52c6b472ebe378381786d2a84968843787eba5e93efac64e312be8d2946e9a02c990dca9bdc21162df1336cb0e1e8ad96b148d21814e32e6ab002762b3fb726a0f1055b3adfab062cb51300af83585eea65f90ab89b962a75caa0a8ff8dcb5755bfd42a207f3b3a5f504bc2f7af048470e9565d6ece1d4f79b52dd6cf22a44d335ac517d88e2fe07edb1ae9552a99454e0a82705420bfaca409c7ff7f14e8852e99f74048dd711e7627fc36c15f2fa5cc1a5868842b26bbe483533307a7604933058a815ee526c7af14fd62bc7232d2cc923a344c352228c97112bc433166de5e96152971b4bfc33720bf42a8b4f7ed7600af76b535e969c85a8c7ce3cb4239b1329015cbe066d2214dbda749297fc0c02d04cdd0582abda73d891599eb0ccb8b1ba01171d4452eb4d3d7aec71ca392c0ad2f14c705128413c538f9cc5330bf6b0a3dcd94fa84b2a0f4ccec9f6c526ad4c8fe4f7238ff34963968585cb8c4eeb08863cc30153eddb81593e4ce381e8d63ff61115459b40c7ca980d12fd411030e03c115099580206e72e934470f46e510a2afca7488698e47020bb906c53e8c1ac51b462783d84d4578df5f0807376529ea9968e6526c975ee3f96e8e9eec300b717f34dfdf7e4f7e366431011b93fce2f5f66dff5ac860661ca0dabaf0e0ca144a97c50cad1bdbfcdca62a3abb2158c5cd1cd3757c135115da824e85ed1e2368f6a5fe1c93984b783652f18bbe33cee1ac90eb1f2cd4457046f7cec50aacb4601e628a4aa1f46c705ae3af69f50473b5b4a84520ad87911d49e5f471f64d3bf4f99d054f481de015705254dd13962c7cdb58c617ffa2cf28d8efca90d24b3896400f2d0daabc80ac0464edeee4fc3d6d6ae7f7bcdd7922f077a2bc2bb7d84a2671c9fded756fe2fdb01531b31881a8b557d5d92aedc3ebd070e91573ff35e6d716feeaa91f8f95435b03ba3d5e2328f114cfd3e2beae4d17e620deecd45e8c24fd14bae8228dcbe8a9a5f01d93235d1961ceed03fc2ff804ac0c3454a669c757a70ccefc2f3b473c8105f50454352ed596baebe5cb59c0e4c3db253f22404ff1bd0e65b1e79a8a79111044aeb593ea3ec05f2a2a424e7dcfcb6a5998ec0767d46b2eeed145f4845a6da9b340f7dd79479b52afc06dcabede831627e1d0d3620acbde1afadf70beb1dc8b8ea969e4c33ba470523b38b1e53aa1ed3620204d475f0df023a67dd1c41de67f39f410930b659b0ddf86386863be3519fed9fbaf88590d7c58cc010c2ef6c7266ad9cf4999f85685910200fa82a835a9e285e4d7edb2f2246ad4ae9f63e09c5c8881c5690aafd5657122a85325cfacb35f73024dd3b155e100e9219b6662abcaee160b61c28b860f68139d2e0a75697bd4c42e973160db77d882841c9d6aeee053439a8b796a0671815765bd8349473a0cba43e050f4f0dde16fbe199f38c423e42d76886a398b25f5b81d7ef96d727f9fe29be59e5bbdf53e09a991cdb334fd6b752ce8ea5ccad92e4999a65aa1fa4763a421c2f1c3de605e5cdb48c69a84ae50e20228992f279f53960e318598332a107bc78d4cb9e0a38ce5d3842a1c8c9278f453ee2ef3eff80f507bc2410b14b44543a1c5f429c82658817ba5d8bda2e583f3dd6e653d02539c0653922977dbbc9860260a3e93955bd5d91fe010f2fa8a86f51b1154c80bb83b69767ec83bd067ed5bccfe004abe03731bde29002a3499a2436f40ba3e994d9ddd63438bde0567f5a6ef5688335583fcde827f2bba8b9b2fed46d64c8936b4a1c5466fed0e530354537981628f68f01ba1e6fb00de4c01786ade6bd264c3c4bf9f1d0c318558a20fb88b03ad684e450e1745e967a212629d3205f8fe0029abf83b39a19679bf685112def33f926999d55d84e0e2dba7ef4cb7d95098887dca4629b69b2d8a76aaed7323521a573d8d503a3198aa97a977d9c50fb1cb0c180acecf345053f687e62a64fbbac39922ddca5544001cafb4c8f53d211a0c8f7b77e6c54b39835cd3c9c654c74079301b1c4e7c771243050269650144ea45e203e8960d8b051ab1e030aaa643627062b92e5fb93a3b9caebb095cfeeed8649b589e89ab8341e8364332739df3f899c8baf1199fe9913a53046f40c4f0894edeb9e685fcd9052761636d2014c433893eada0895065a950896bdc841abc843138f4d913c4f50ccbad92ab747bb7b11d2846c4aee13b846fdc4f47b91a194d8f3377b659ab464f5ed01ee727cbc93759d977022e7c57d70c855a13acec9d575e4604ebf13b1b072a2916b3aa8f982a4488655e39054355d4f1ad5ad764fb8e8ca67d33456eb92a051c17485a74abad0c8902571477", {0x5, 0x0, 0x78717775, 0xf, 0x7388, 0x4dc3477f, 0x1, 0x1}}) ppoll(&(0x7f0000000080)=[{r2, 0x8006}], 0x1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000140)={0x0, 0x1000}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000001280)={r5, @in6={{0xa, 0x4e21, 0x80, @empty, 0x9}}, 0x5, 0x80000001, 0x3, 0x4, 0x4}, &(0x7f00000001c0)=0x98) 19:29:39 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r4, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'ipddp0\x00'}, 0x18) 19:29:40 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x7, 0x40) ioctl$VIDIOC_G_PRIORITY(r0, 0x80045643, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) open(&(0x7f0000000280)='./file0\x00', 0x101, 0x162) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r6 = fcntl$dupfd(r2, 0x0, r1) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x5c, r7, 0x334, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x38, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e23, @loopback}}}}]}, @TIPC_NLA_LINK={0x4}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008084) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ipddp0\x00', 0x10) 19:29:40 executing program 0: r0 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x11a94dc, 0x40000) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000040)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x2000, 0x0) symlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000140)={0x0, 0x33f}) listen(r0, 0x7) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000180)={0x100, 0x80000001, 0x3, {0xf, @vbi={0x0, 0x7, 0x101, 0x0, [0x4, 0x2], [0x800, 0xff], 0x3}}}) syz_genetlink_get_family_id$fou(&(0x7f0000000280)='fou\x00') getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000002c0)={0x0, 0xfffffffffffffffb}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000340)={r2, 0x1}, 0x8) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000380), &(0x7f00000003c0)=0x4) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000440)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$int_in(r0, 0x5473, &(0x7f0000000480)=0x8) write$FUSE_NOTIFY_STORE(r0, &(0x7f00000004c0)={0x2c, 0x4, 0x0, {0x4, 0x2, 0x4, 0x0, [0x0, 0x0, 0x0, 0x0]}}, 0x2c) mq_notify(r1, &(0x7f0000000640)={0x0, 0x1, 0x2, @thr={&(0x7f0000000500)="ef22850679798aa62b4c72bb7468d2606d9dfc92218397374fa56164c7f67c35bcda63997202ac47c0214ff5861e863cbc3d22c8e320ad8f6666d60c965f8deb4788e9a9bc9b96ebc5ebc6c8397d6045dcbebd51c9f81263f04fb12049654115f9c7f14e495bb460a0225bf2499fcdcda159b63bc3d87bd2", &(0x7f0000000580)="39688d45cbcf697811bb7812fbb2731b1e640a174679ad2ea85c36479a0beafdf89603b5e0b4a43bdd65e04661f9dac601a341b75f11e5255040ea86094103dd3351721a827bea3abbacdb26e81c6dfd99730126987be9b9ecfe0c6dd204d64dddf900e99338c035bd527057b25287f48ebf7947e0467ab3e925414146864a4cb3a5449722e73cfe93c585bf86b185e0170e5b4a0adb09509d828e6cb53a78ca6c2f3df8eeceafcc4b7b9915"}}) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f0000000680)={[0x6000, 0x10f001, 0xd000, 0xf000], 0x9, 0x19, 0x5a0ca98a}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000700)={r2, 0x5}, &(0x7f0000000740)=0x8) ioctl$VIDIOC_QUERYCAP(r0, 0x80685600, &(0x7f0000000780)) r4 = getpid() process_vm_readv(r4, &(0x7f0000000f00)=[{&(0x7f0000000800)=""/213, 0xd5}, {&(0x7f0000000900)=""/13, 0xd}, {&(0x7f0000000940)=""/137, 0x89}, {&(0x7f0000000a00)=""/83, 0x53}, {&(0x7f0000000a80)=""/248, 0xf8}, {&(0x7f0000000b80)=""/195, 0xc3}, {&(0x7f0000000c80)=""/169, 0xa9}, {&(0x7f0000000d40)=""/51, 0x33}, {&(0x7f0000000d80)=""/200, 0xc8}, {&(0x7f0000000e80)=""/93, 0x5d}], 0xa, &(0x7f0000002340)=[{&(0x7f0000000fc0)=""/108, 0x6c}, {&(0x7f0000001040)=""/238, 0xee}, {&(0x7f0000001140)=""/61, 0x3d}, {&(0x7f0000001180)=""/16, 0x10}, {&(0x7f00000011c0)=""/202, 0xca}, {&(0x7f00000012c0)=""/4096, 0x1000}, {&(0x7f00000022c0)=""/76, 0x4c}], 0x7, 0x0) ioctl$DRM_IOCTL_MAP_BUFS(r1, 0xc0186419, &(0x7f0000002600)={0x2, &(0x7f00000023c0)=""/27, &(0x7f00000025c0)=[{0xfffffffffffffff7, 0xe0, 0x80, &(0x7f0000002400)=""/224}, {0x28000000000000, 0xb7, 0x3ff, &(0x7f0000002500)=""/183}]}) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000002640)=0x200, 0x4) ptrace(0x18, r4) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000002680)) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000026c0)) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000002700)={r3, @in={{0x2, 0x4e22, @loopback}}, 0x1, 0x7, 0x3, 0x1, 0x41}, &(0x7f00000027c0)=0x98) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000002840)={&(0x7f0000002800)=[0x0, 0x0, 0x0], 0x3}) ioctl$PPPIOCGDEBUG(r0, 0x80047441, &(0x7f0000002880)) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f00000028c0)=""/171) 19:29:40 executing program 5: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x200000, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x1, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x8, 0x800) 19:29:40 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x4, 0x0, 0x6) close(0xffffffffffffffff) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x10000, 0x4400) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000040)=0x1, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000140)={0x0, 0x0, 0x3}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r2, 0xb4}, &(0x7f0000000240)=0x8) setxattr$security_smack_transmute(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000300)='TRUE', 0x4, 0x3) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f00000000c0)='TRUE', 0x4, 0x3) socketpair$unix(0x1, 0x248430af25bb2c17, 0x0, &(0x7f0000000100)) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:40 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x20000, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) tee(r0, r0, 0x6, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000040)=@sco={0x1f, {0x608}}, 0x3c8, 0x0, 0xfef6}, 0x0) r2 = socket$kcm(0x11, 0x0, 0x0) sync_file_range(r2, 0x1, 0x80000000, 0x0) sendmsg$kcm(r2, &(0x7f0000000100)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f00000001c0)="c14305000000400000000000ac14140deb10c144", 0x14}], 0x1}, 0x0) syz_open_dev$sndseq(&(0x7f0000000300)='/dev/snd/seq\x00', 0x0, 0x400) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00055336d717775c1814b60fed87ae6ba0c75bf48ae3ea3e72e3236e7cebc50f7291a0c4d3cc640496945dddbad6e073807f8dfa360398e15205b11d6429b01ac55a7a42fa08648d55d95f6a6662baf02e7cf274d011fdd8"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x420000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x6) ioctl$KVM_GET_FPU(r3, 0x81a0ae8c, &(0x7f00000005c0)) fcntl$setpipe(r0, 0x407, 0x3) ioctl$TIOCNXCL(r3, 0x540d) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x408400, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0x3) ioctl$DRM_IOCTL_GET_CAP(r4, 0xc010640c, &(0x7f00000000c0)={0x3f, 0x8}) close(r0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000280)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x6000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000003000/0x2000)=nil, &(0x7f0000000240)="7a08d86b60370dea3c80a54f0143cf243b", 0x11, r0}, 0x68) recvfrom$inet6(r3, &(0x7f00000004c0)=""/232, 0xe8, 0x1, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="654ffca7082356202af0fbea2e50827c000f9deba441fae8f82091f71088ae583ce9a760a12c7fd6fc2a373eaa80d3d925ffacbfa746c50ee0828cfe50cd"], 0x2ae, 0x0, 0x0}) 19:29:40 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x400000) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 704.704762] binder: 22263:22264 unknown command 911410432 [ 704.710600] binder: 22263:22264 ioctl c0306201 20012000 returned -22 [ 704.766760] binder: 22263:22268 unknown command -1476636827 [ 704.772821] binder: 22263:22268 ioctl c0306201 20008fd0 returned -22 [ 704.816077] binder: 22263:22268 unknown command 911410432 [ 704.821778] binder: 22263:22268 ioctl c0306201 20012000 returned -22 [ 704.872786] binder: 22263:22270 unknown command -1476636827 [ 704.878682] binder: 22263:22270 ioctl c0306201 20008fd0 returned -22 19:29:42 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x5, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@gettaction={0x14, 0x32, 0x0, 0x70bd29, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0x400c5) close(r1) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) mlockall(0x1) ioctl$sock_bt_cmtp_CMTPCONNADD(r3, 0x400443c8, &(0x7f0000000140)={r2, 0x1}) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:42 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000280)=0x6, 0x37a) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000240)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000180)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000000080)={0x200000000bf}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc0105303, &(0x7f0000000380)={0x5, 0x0, 0x0, 'queue0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03'}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000040)) r2 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{}, {0x0, 0x1c9c380}}, 0x0) tkill(r2, 0x1000000000013) r3 = semget$private(0x0, 0x3, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r1, &(0x7f0000000440)="5f1967e4850ade32c0813bcb3d716ee152d36d578c6299a02b556e30186a2d1e3ccf503c0dc823aa9f39dca04ae381e502c979229f09d53a1893d5ccfb0639db81502a734cd72cb1f6dc6d91453691dab6f2eb00a67f4598c68425396377ea24257cd5d69c32a392a8d37c6c1983c9b36e0790fcb1d26970ab2101b9f03d47e0312b48a48a5b935da83e35e1728e640efa75ab9d4a7e84a2ebe39f1344cbc103bf6da0", &(0x7f0000000500)="0a07d0e77ec964881a637db02214e56f3e81f5bc6257796a837c13dcc2f700ab994d012658c06ac7826c2aed491f65a22da4f53b98b19a3b2e02cb9edf3178932618f4f6d57e42321ec1821c3fa1774b1b082ba91ad9adca64d533604842570ae03a11ef5702a0fcb49ead752904b4ecd90d4ea4bbc98ce24e58d974be57bac888b29cbf4c583b183a5a035dc0aa735ee1e07a8f7544963cd1781b020fae1283c5482bcf08b96d0e2bff3ef6947061f549ce33db94e227216003e4a05e39d514215b5956133e", 0x1}, 0x20) semctl$SEM_STAT(r3, 0x3, 0x12, &(0x7f00000000c0)=""/107) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:42 executing program 4: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000080)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x80241, 0x0) r1 = socket$inet(0x2, 0x3, 0x4000008) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x2, 0x3a8, [0x20000800, 0x0, 0x0, 0x20000830, 0x20000a68], 0x0, &(0x7f0000000000), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000300a500000000000000007465616d5f736c6176655f3100000000766c616e30000000000000000000000076657468315f746f5f7465616d00000064756d6d793000000000000000000000aaaaaaaaaaaa0000000000000000000000000000000000000000d8010000d80100000802000073746174697374696300000000000000000000000000000000000000000000011800000000000000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041554449540000000000000002000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff00000000000000000000000000000000000000000000000080000000000012000000000001000000feffffff01000000110000000000000008060300736630000010000000000000000064756d6d793000000000000000000000696662300000000000000000000000006c6f0000000000000000000000000000ffffffffffff000000000000ffffffffffff000000000000000070000000a8000000e00000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000fcffffff00000000736e6174000000000000000000000000000000000000001000000000000000001000000000000000aaaaaaaaaa000000ffffffff00"/931]}, 0x41b) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001ff) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) ioctl$TIOCLINUX3(r0, 0x541c, &(0x7f0000000040)) 19:29:42 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)) creat(&(0x7f00000004c0)='.\x00', 0x18) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500)='/dev/cachefiles\x00', 0x400, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x800000100000007) close(r0) r3 = creat(&(0x7f0000000540)='./file0\x00', 0x40) ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) r4 = syz_open_dev$cec(&(0x7f0000000580)='/dev/cec#\x00', 0x3, 0x2) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r4, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="c8020000", @ANYRES16=r5, @ANYBLOB="01022bbd7000fddbdf25020000007c0004001400010062726f6164636173742d6c696e6b00004400070008000200070000000800020008000000080004000900000008000400ffffff7f08000100020000000800030000000100080003000500000008000200020000000c000700080001000d0000001400010062726f6164636173742d6c696e6b0000400004003c0007000800010003000000080002000200000008000200faffffff08000200040000000800020005000000080004000100008008000200020000000400050094000100180001006574683a76657468305f746f5f6873720000000008000300010000001c0002000800030009000000080002008100000008000100030000002c004e230000000000000000000000001400020002004e22ac1414100000000000000000100001007564703a73797a3200000000180001006574683a76657468315f746f5f68737200000000a0000100100001007564703a73797a32000000000800030021ac0000100001007564703a73797a310000000038000400200001000a004e2200000000fe80000000000000000000000000000b7f0000001400020002004e237f000001000000000000000008000300080000002c0004001400010006004e24ac1414bb00000000000000001400020002004e21ac1414aa000000000000000008000300d9000000c000050008000100696200004400020008000300ff0700000800030000000080080002000000000008000300010000000800030001000100080004000500000008000200030000000800010015000000540002000800040005000000080004000300000008000300000001000800040076a700ffffffff0000000000080002000200000008000400050000000800040002000000080001001e000000080002000100000008000100756470001400020008000400ffff00000800040001000000"], 0x2c8}}, 0x4048080) [ 706.847534] binder: BINDER_SET_CONTEXT_MGR already set [ 706.853176] binder: 22276:22284 ioctl 40046207 0 returned -16 [ 706.885953] binder: 22280:22285 ioctl c0306201 20008fd0 returned -14 [ 706.940834] binder: 22280:22285 tried to acquire reference to desc 0, got 1 instead 19:29:43 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = dup3(r1, r1, 0x80000) setsockopt$TIPC_SRC_DROPPABLE(r2, 0x10f, 0x80, &(0x7f0000000000)=0x2bb, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) readahead(r0, 0x3, 0x5) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000002}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="a8000000", @ANYRES16=r6, @ANYBLOB="000126bd6a00fbdbdf250a0000006c000300080007004e240000080007004e20000014000600fe80000000000000000000000000000f08000400010000000800030000000000080003000400000008000500ac1e0001080003000400000008000800000000001400060000000000000000000000000000000000280003001400020074756e6c30000000000000000000000008000100010000000800040005000000"], 0xa8}, 0x1, 0x0, 0x0, 0x40000}, 0x0) [ 706.985010] binder: 22276:22294 ioctl c0306201 20008fd0 returned -14 [ 706.990519] binder: 22280:22291 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 707.000814] binder: 22280:22291 ioctl c0306201 20008fd0 returned -14 19:29:43 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe2(&(0x7f0000000000), 0x4800) r3 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x8dc2, 0x103000) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400220) dup3(r2, r0, 0x0) 19:29:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r3, 0xae78, &(0x7f0000000000)=0x2) 19:29:43 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x9, 0x200) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f00000000c0)={r2, r1, 0x9}) close(r1) migrate_pages(r0, 0x80000000, &(0x7f0000000000)=0x865, &(0x7f0000000040)=0x8000) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 707.271872] binder: 22305:22311 ioctl c0306201 20008fd0 returned -14 19:29:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x200, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f00000000c0)={{0xa, 0x4e20, 0x2, @ipv4={[], [], @loopback}, 0x33d8}, {0xa, 0x4e24, 0x7, @mcast1, 0x1f}, 0x6, [0x1000, 0x6, 0xffffffffffffff2d, 0x6, 0x100000000, 0xb6f3, 0x3f, 0x5]}, 0x5c) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="eef6a4720ef97760"], 0x2ae, 0x0, 0x0}) 19:29:43 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x45848a603b00442c) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000040)={0xa18, 0x6, 0x3, 0x5, 0x10000}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0xfffffffffffffda3) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) [ 707.559470] binder: 22321:22322 unknown command 1923413742 [ 707.565588] binder: 22321:22322 ioctl c0306201 20008fd0 returned -22 19:29:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x11b, 0x0, &(0x7f0000000000)=ANY=[], 0x3c0, 0x0, 0x0}) 19:29:43 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x11) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x1ff) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:43 executing program 2: mmap(&(0x7f0000013000/0x4000)=nil, 0x4000, 0x1001, 0x11, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x2}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$rds(0x15, 0x5, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/rt_cache\x00') ioctl$TUNSETNOCSUM(r4, 0x400454c8, 0x0) r5 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x0, 0x20000) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r5, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x10c, r6, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10000}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfffffffffffffeff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xfff}]}, @TIPC_NLA_MEDIA={0xbc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x50000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1544}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x100000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9ecb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x200040d0}, 0x1) userfaultfd(0x80000) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="f0000000", @ANYRES16=r6, @ANYBLOB="000628bd7000fbdbdf25050000003c00010038000400200001000a004e24ffffff7ffe8000000000000000000000000000aa090000001400020002004e22ffffffff00000000000000001c0002000800020005000000080002002f000000080002000200000024000900080001000000000008000200ff7f000008000100fffbffff080002001f000000200002000800010031c75a7aab000400040004000800020006000000040004009c52e64767351cfeab1167738ea2a6e8702c6fe183c3889c69ce98d5c44ba52e074d06271efc5991b641510617fc07551b6a1feaa77718e4cd30e68db21a80faead142d6be1213642443bd75074044d94c7769ac72982c5e651bffba2d99d24566ba5b451389b1ae636800882b0bd026cc0b916573c3523c8e69ff4bd696572c76af57e40ebb6170af1f95d1179d8322fc83189db41490b4b08b7e965fe8d4c9ad307d2d6993a7376e341de68edcab30beca46324fa9c4b6233fa0c3d0b39b7a43698db07383bb0c1492a8d45e963e6c128dfff7420acb5d127ee6ee82cd133433a3a287dfb5881e9b8f710e592de7667d8cd0f1509658661f6c116cec732f0556dd7f9a911301d5a58075561b72ad40a7bba8aa55a2df4608bf0cf9f432e978d90ed8edb34b20384da247a53bdb1c9be0837893f6e3ca023379b4c217928fc047292fa5538441926432e1fc41de8c9c0191cee7d1"], 0xb0}, 0x1, 0x0, 0x0, 0x4}, 0x20040000) dup3(r2, r0, 0x0) 19:29:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) ioctl$DRM_IOCTL_GET_UNIQUE(r1, 0xc0106401, &(0x7f0000000040)={0x65, &(0x7f00000000c0)=""/101}) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6}}, &(0x7f0000000140)=0xe8) ioctl$TUNSETOWNER(r1, 0x400454cc, r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 707.867218] binder: 22331:22333 unknown command 0 [ 707.872394] binder: 22331:22333 ioctl c0306201 20008fd0 returned -22 [ 707.930991] Unknown ioctl 21539 [ 707.956832] binder: 22331:22333 tried to acquire reference to desc 0, got 1 instead [ 707.964085] Unknown ioctl 21539 [ 707.968868] binder: BINDER_SET_CONTEXT_MGR already set [ 707.974462] binder: 22332:22338 ioctl 40046207 0 returned -16 [ 707.996024] Unknown ioctl 21539 [ 708.025300] Unknown ioctl 21539 19:29:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f0000000000)={0xa3, 0x0, [0x70a000, 0x100000000000]}) r4 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_S_MODULATOR(r4, 0x40445637, &(0x7f0000000100)={0x3ff, "6e7f5015ebebcfcdf0daa8f95bcca5e986006df228b93e8b60525eb7db31bfce", 0x20, 0x7f, 0x7, 0x4, 0x7}) 19:29:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e20, 0x4f34af2b, @loopback, 0x101}}, 0x7ff, 0x4, 0x0, 0x6, 0x9}, &(0x7f0000000140)=0x98) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000200)={r4, @in6={{0xa, 0x4e24, 0x2, @loopback, 0x10}}, 0x1, 0x1}, 0x90) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 708.077847] binder: 22332:22347 ioctl c0306201 20008fd0 returned -14 19:29:44 executing program 2: r0 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x3, 0x800) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, r0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ff5000/0x9000)=nil, 0x9000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x4000, 0x0) ioctl$VIDIOC_ENUMAUDIO(r5, 0xc0345641, &(0x7f0000000040)={0x1, "fd9bfbeb2ea556a8444c1c075011636adceab77bc03f62f6c96d8549b8801904", 0x1, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r5, 0xc0945662, &(0x7f0000000140)={0x7, 0x0, [], {0x0, @bt={0x9, 0xffffffffffff0000, 0x1, 0x1, 0x3705, 0x57, 0x7ff, 0x6, 0x70000000, 0x4, 0x100, 0x100000001, 0x95c, 0x400, 0x1, 0x10}}}) dup3(r3, r1, 0x0) [ 708.293382] binder: 22350:22357 ioctl c0306201 20008fd0 returned -14 19:29:46 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r2, r2, 0x0, 0xabe) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000240)={r3, 0x1, 0x6, @remote}, 0x10) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f0000000300)) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f00000002c0)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x7}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00000001c0)={r4, 0x2}, 0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000000080)={r4, @in6={{0xa, 0x4e20, 0x0, @loopback, 0x8999}}, [0xfffffffffffffffe, 0x8000, 0x6, 0x0, 0xff, 0x5, 0x5, 0x1, 0x2f, 0x6, 0x400, 0x3f, 0x0, 0x7045, 0x7f]}, &(0x7f0000000180)=0x100) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000280)=0x3, 0x4) 19:29:46 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ioctl$int_in(r0, 0x5421, &(0x7f0000000000)=0x4) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x200000, 0x0) ioctl$KVM_S390_VCPU_FAULT(r1, 0x4008ae52, &(0x7f00000000c0)=0x6) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x200001, 0x0) setsockopt$netlink_NETLINK_RX_RING(r3, 0x10e, 0x6, &(0x7f0000000040)={0x100000001, 0x80000001, 0x9, 0xff}, 0x10) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000000c0)=0x100000000) 19:29:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) close(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:46 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 710.306710] binder: BINDER_SET_CONTEXT_MGR already set [ 710.312208] binder: 22368:22369 ioctl 40046207 0 returned -16 [ 710.361515] binder: 22367:22380 ioctl c0306201 20008fd0 returned -14 19:29:46 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x1000)=nil, 0x1000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) ioctl$VIDIOC_G_STD(r4, 0x80085617, &(0x7f0000000040)) 19:29:46 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x1, 0x402) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e63334000000000f768812a826aefc7048b"], 0x2ae, 0x0, 0x0}) 19:29:46 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) ioctl$KVM_GET_MSR_INDEX_LIST(r2, 0xc004ae02, &(0x7f0000000000)={0x2, [0x0, 0x0]}) 19:29:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$BLKBSZSET(r3, 0x40081271, &(0x7f0000000000)=0x3) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 710.696826] binder: 22390:22391 unknown command 1077109518 [ 710.702770] binder: 22390:22391 ioctl c0306201 20008fd0 returned -22 19:29:46 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) setsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f0000000000)="28c04dd2edb6124dad7c41aa292f3999f5d0a2cc0f11b4b62a1784dba0bc425ce956fd9dd1c9448d472b71f4f43f4b556d3e1e282f9b76a3aab26ccf0d11a1364dffa9e1ddd158ab9e7afdc4e4ba44facf0abfd006bb3a53741a344ea3800a0d846ae3689b04455bf4e5", 0x6a) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e630c4000000000da0f57fc58696794a4c7a453dbe176564b19e63040762e451c25a31827aafda5f9608570e1a1afd8eecd72110000000000000039f2d547764df0ab8285e860c543fa14f406580cf4678399f00807a56a8a5533c9918b742c07658e9cab046f6992f42efc352620567290b2321b9925fa1c3d26505b815a0d51c5072c7d439c12fb8aeba91e243a614e01c68b9556e26e1db4aa92ec7903e50960539882f9ab"], 0x2ae, 0x0, 0x0}) 19:29:47 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x100) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000000040)={0x0, 0x20, 0x9, [0x7f, 0x1, 0x3, 0x3e59, 0x7, 0x91e9, 0x5, 0x1000, 0x4]}, &(0x7f00000000c0)=0x1a) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={r2, 0x8, 0x10}, &(0x7f0000000140)=0xc) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:47 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYBLOB="950000e5ff4faa1f18056ff7d144d9ab4ace597ec5ae9d6520f579d8c179a2dd0e9c245656febd252c81554641beedf25e769be8ee8bbaba5f2ad7af015278a2522ebeb7865d2e11b6248c1fa2c29f2937e4844e52b79944acb0a0db46782ddafeca9fdcf5747959ca0a5c265a135819704a011b0f93181c4ebdf94389b57916c239718a3f1989384324921a3a295c08d19a00f054f3a0560fec7e7464726a0de6424c649a343c4fe9c0c01ad4be36a4ddc5f514100500d4b695fc2c145142b2073fa7015cfb15e0f042b6aef9c718da6fc9e645b18b49179e9aa389c8e30bd2c1658d0fa9246835e6113d8e98bd98278e31c768076787768a35e312fd063faf"], &(0x7f0000000140)=0x9d) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x4, 0x9}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x7, 0x9, 0x306fd04a, 0xca, 0x40, 0x0, 0x3, {0x0, @in6={{0xa, 0x4e23, 0x3ff, @empty, 0x5}}, 0x3, 0x200, 0x100, 0x2, 0x81}}, &(0x7f0000000280)=0xb0) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000300)=@assoc_value={0x0, 0xfe6e}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000002c0)=@assoc_value={r2, 0x6}, 0x8) close(r1) r3 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xfff, 0x8000) openat$cgroup_subtree(r3, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r1, r4, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 711.068996] binder: 22413:22414 ioctl c0306201 20008fd0 returned -14 19:29:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x2) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:47 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f00000000c0)="a0fe5ac1124d606e41dc551054807bd6bdae1308d129f074e667d57f6a2df023d10be6d20bdde39eb918c2146ff6bdd89c77c7139bdf5d42b1b2755b7b118fb60a355459fb1945b5ba6bfcbe284a41c23b006fc368384d9c81f71e0962d7a2e6fae961031915232d6f6f3b91c706ce5cb650ac1c26d17dfc6b6be1c5b1b8d3a0b5814f111515f9a01c66a2379883b86a8b670f937a071d6758a8dc01c82dd3951d1651feb5d5f7919e8c1b231189587ba51700d85a40cf6d332ab6200cc794db58e4d3e340e80e795b1403d0c5d61a41d6c17544fe591da1b408527ccb06bce5a208ecd88bd4622f7109dad81893f0975f0043aa8e") setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000200)=0x100, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) setsockopt$sock_int(r1, 0x1, 0x3f, &(0x7f0000000080)=0x9, 0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:47 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000240)={{{@in=@remote, @in6=@remote, 0x4e24, 0xffffffff, 0x4e22, 0x0, 0x2, 0x20, 0x80, 0x0, r3, r4}, {0xff, 0xdf14, 0x21, 0x1f5d, 0x3, 0x40, 0x9, 0x2a}, {0x3247, 0x81, 0x7df, 0x8}, 0x9, 0x6e6bc0, 0x1, 0x0, 0x2}, {{@in=@multicast1, 0x4d4, 0x3b}, 0xa, @in6=@mcast2, 0x3506, 0x6, 0x1, 0x0, 0x9, 0x3f, 0x1}}, 0xe8) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) r5 = dup(0xffffffffffffffff) read$alg(r5, 0x0, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r6, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, 0x0, 0x0) sendto$inet(r6, 0x0, 0x0, 0x200007fd, &(0x7f0000000680)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf32(r6, &(0x7f00000006c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{}]}, 0x58) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) r8 = fcntl$dupfd(r6, 0x0, r6) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000440)}}, 0xfef5) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) dup3(r9, r0, 0x0) 19:29:47 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000000)=0x10040, 0x4) [ 711.542514] binder: 22435:22438 ioctl c0306201 20008fd0 returned -14 19:29:47 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) symlinkat(&(0x7f0000000180)='./bus\x00', r2, &(0x7f00000001c0)='./bus\x00') getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f00000000c0)=""/57, &(0x7f0000000100)=0x39) r3 = getuid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000040)=0xc) memfd_create(&(0x7f0000000140)='!)\x00', 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-net\x00', 0x2, 0x0) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={r0, r3, r4}, 0xc) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x400000, 0x0) ioctl$VHOST_SET_VRING_NUM(r3, 0x4008af10, &(0x7f0000000040)={0x2, 0xf2d3}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 711.608801] binder: 22440:22442 ioctl c0306201 20008fd0 returned -14 19:29:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x4000, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0xb88, 0xffd}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000100)={r3, @in6={{0xa, 0x4e20, 0xa0, @remote, 0x2}}}, &(0x7f0000000200)=0x84) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:47 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x37b, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000007580)=[{{&(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/193, 0xc1}, {&(0x7f0000000280)=""/214, 0xd6}], 0x2, &(0x7f0000000200)=""/1, 0x1}, 0x39c}, {{&(0x7f0000000380)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000002800)=[{&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/42, 0x2a}, {&(0x7f0000001440)=""/183, 0xb7}, {&(0x7f0000001500)=""/39, 0x27}, {&(0x7f0000001540)=""/51, 0x33}, {&(0x7f0000001580)=""/162, 0xa2}, {&(0x7f0000001640)=""/156, 0x9c}, {&(0x7f0000001700)=""/69, 0x45}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f0000002780)=""/88, 0x58}], 0xa, &(0x7f00000028c0)=""/6, 0x6}, 0x2}, {{&(0x7f0000002900)=@ax25={{0x3, @default}, [@netrom, @remote, @remote, @remote, @rose, @netrom, @null, @bcast]}, 0x80, &(0x7f0000003d40)=[{&(0x7f0000002980)=""/123, 0x7b}, {&(0x7f0000002a00)=""/157, 0x9d}, {&(0x7f0000002ac0)=""/56, 0x38}, {&(0x7f0000002b00)=""/4096, 0x1000}, {&(0x7f0000003b00)=""/144, 0x90}, {&(0x7f0000003bc0)}, {&(0x7f0000003c00)=""/167, 0xa7}, {&(0x7f0000003cc0)=""/72, 0x48}], 0x8, &(0x7f0000003dc0)=""/119, 0x77}, 0x1000}, {{&(0x7f0000003e40)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000003ec0)=""/11, 0xb}, {&(0x7f0000003f00)=""/156, 0x9c}, {&(0x7f0000003fc0)=""/78, 0x4e}, {&(0x7f0000004040)=""/142, 0x8e}, {&(0x7f0000004100)}, {&(0x7f0000004140)=""/243, 0xf3}], 0x6, &(0x7f00000042c0)=""/193, 0xc1}, 0xffffffffffff8001}, {{&(0x7f00000043c0)=@isdn, 0x80, &(0x7f0000004700)=[{&(0x7f0000004440)=""/217, 0xd9}, {&(0x7f0000004540)=""/157, 0x9d}, {&(0x7f0000004600)=""/254, 0xfe}], 0x3, &(0x7f0000004740)=""/210, 0xd2}, 0x7}, {{&(0x7f0000004840)=@x25={0x9, @remote}, 0x80, &(0x7f0000004a40)=[{&(0x7f00000048c0)=""/228, 0xe4}, {&(0x7f00000049c0)=""/115, 0x73}], 0x2, &(0x7f0000004a80)=""/4096, 0x1000}, 0x6}, {{0x0, 0x0, &(0x7f0000005b80)=[{&(0x7f0000005a80)=""/15, 0xf}, {&(0x7f0000005ac0)=""/24, 0x18}, {&(0x7f0000005b00)=""/76, 0x4c}], 0x3}, 0x8}, {{&(0x7f0000005bc0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f0000005d00)=[{&(0x7f0000005c40)=""/25, 0x19}, {&(0x7f0000005c80)}, {&(0x7f0000005cc0)=""/28, 0x1c}], 0x3, &(0x7f0000005d40)=""/191, 0xbf}, 0x6}, {{&(0x7f0000005e00)=@generic, 0x80, &(0x7f0000007200)=[{&(0x7f0000005e80)=""/250, 0xfa}, {&(0x7f0000005f80)=""/243, 0xf3}, {&(0x7f0000006080)=""/15, 0xf}, {&(0x7f00000060c0)=""/187, 0xbb}, {&(0x7f0000006180)=""/4096, 0x1000}, {&(0x7f0000007180)=""/42, 0x2a}, {&(0x7f00000071c0)=""/8, 0x8}], 0x7, &(0x7f0000007280)=""/115, 0x73}, 0x8}, {{&(0x7f0000007300)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f00000074c0)=[{&(0x7f0000007380)=""/52, 0x34}, {&(0x7f00000073c0)=""/87, 0x57}, {&(0x7f0000007440)=""/105, 0x69}], 0x3, &(0x7f0000007500)=""/93, 0x5d}, 0xf86}], 0xa, 0x10000, 0x0) setsockopt$inet_buf(r1, 0x0, 0x20, &(0x7f0000007800)="c1d56f2a04b7cf17ed8972b4d073b2cdf86a882ab4449ea59277440608f37a9c88ccffdde0eb92136f5ec1e9ff8dfafaa7c27392da4ef8efe1fb1c2d9eb3f06a8cb1b71687adc5425feba3b37d4f00b3f07b0f7fbe20b1b30b97d2dfa89a5cbdfc8328401a244eb02dc290aa475b05497429d9de2638cb7a51f540ffe181253770393ee8d114414c15b2f85f1f439f7a2d0bc4a773eb2e5f0e550ef7c22507a3b4314ef04f221cc4776d23062c5f32e698cbb4722fd39f8e74585273557637846e4b35e083262470af94cc07b993ad9ba30384617e5ca63f2511964e469bbb7f89e44eb231c125c09fdd0c786f3198bf", 0xf0) shutdown(r1, 0x0) 19:29:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 712.025660] binder: 22461:22462 ioctl c0306201 20008fd0 returned -14 19:29:48 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) [ 712.130502] binder: 22470:22471 ioctl c0306201 20008fd0 returned -14 19:29:48 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0563044000000000fb1e2d4b04c68d7ff6b4b89a76b4e5883a512cd43a93fb726c6972c75ed2eb1917118c8bedcbb6448c9914a3b008fc036f14db44c0fa1432b25abd13540350ae468ce652537847369b179e908a67daf35d61d3b79f49b6004e5c0a5656fbee09"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c0000000078"], 0x2ae, 0x0, 0x0}) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f0000000000)) 19:29:48 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000040)) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = pkey_alloc(0x0, 0x3) pkey_free(r5) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) ioctl$KVM_ASSIGN_PCI_DEVICE(r3, 0x8040ae69, &(0x7f0000000000)={0xfffffffffffffff9, 0x2, 0xfb99, 0x3, 0x3}) 19:29:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 712.386992] binder: 22481:22482 unknown command 811790 [ 712.392747] binder: 22481:22482 ioctl c0306201 20008fd0 returned -22 19:29:48 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x10031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 712.517932] binder: 22489:22492 ioctl c0306201 20008fd0 returned -14 19:29:48 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'nr0\x00', &(0x7f0000000140)=@ethtool_channels={0x0, 0x0, 0x2, 0x4, 0x2, 0x1, 0x400, 0x100, 0x1}}) 19:29:48 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000000000)=0x1) r3 = syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r3, 0xc1105511, &(0x7f0000000180)={{0x6, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="056304421a5422fa60de40000100a29b9a976c5e"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:48 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/l2cap\x00') r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x22000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, r6, 0x324, 0x70bd29, 0x25dfdbfe, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x0, @link='syz1\x00'}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x0) 19:29:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 712.894074] binder: 22510:22511 unknown command 1107583749 [ 712.899888] binder: 22510:22511 ioctl c0306201 20012000 returned -22 19:29:49 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000080)={0x0, 0x8, 0xfffffffffffffffc, 0x3, 0x0}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000180)={r1, 0xaa, "d5cea1da2fff8805692c84fda3167b7280a0fe201a46fc8d05c85aea07a093cbcad3de98482754bae0b1a0baa40e975c65be6b741b75550eaec32dd100cc8974b1ae3862c5afd1df9b50b764a1df132c55d566fa639e1ef63ab4130616d3d09c1876d7874b7221c505a6a2453bcf18a87aed36d8e9fec442a1715249225b27f56ec8dd74d9bbd76b8c8779043ac217090e7df5a4a91f08ff5158bda446991085a053db3fe45d8a4f4058"}, &(0x7f0000000280)=0xb2) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x400, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r3, 0x80605414, &(0x7f0000000040)=""/53) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f00000000c0)=[{r2, 0x8006}], 0x1a1, 0x0, 0x0, 0x0) [ 712.951964] binder: BINDER_SET_CONTEXT_MGR already set [ 712.957740] binder: 22508:22514 ioctl 40046207 0 returned -16 [ 712.977470] binder: 22510:22511 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 712.985392] binder: 22510:22511 ioctl c0306201 20008fd0 returned -14 19:29:49 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x10000, 0x0) ioctl$VIDIOC_OVERLAY(r4, 0x4004560e, &(0x7f0000000080)=0x1) dup3(r2, r0, 0x0) 19:29:49 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x5c, 0x0, &(0x7f0000000200)=[@enter_looper, @clear_death={0x400c630f, 0x3, 0x3}, @enter_looper, @reply={0x40406301, {0x4, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x50, 0x48, &(0x7f0000000080)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x4}, @fda={0x66646185, 0x2, 0x2, 0x31}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f0000000100)=[0x38, 0x48, 0x40, 0x20, 0x38, 0x48, 0x30, 0x18, 0x0]}}], 0x1000, 0x0, &(0x7f0000001040)="ffb673da733150f664d420c589aeed216876864da1cdc9a5d720a84acc3be8ae214d516aeff462794175f1b40e0df908ab20d95a91d46fdb8672bd06164d9dcbb5b42a95e65ded0e94b003409d014dad8dcf23219276d57c07b1a48c1b8b122064f63234121a41f3fbe66d55feacfa885fe90b07f1256efda3aebeab5061a20be3e32b2a21947e447b13d24843b5f6fa913972a936c320f9aa060092f7359213d651e55b5bc92fdc684110e790b509ed63ca9eeac208ed3ed01ee3c5e497581cddb679f7aefd9d6df85cae4fd5fd5121fa89a3bbdd3759c62bf06cc284dd3abb8a16f4be7ebc564a921e01673fd65f12ffd738cacdfcaaef60d07ed58ab972b9e42d36448c230fc5bd7909202193820780829bfa5b6e507d42699bae457f63a6bbdf2a6cd5db1ef57a12b3a3bc38a55b757f203c830606ef052e40a7f99aa70eac5c29d55e00e84b1f476cd138c9a75bde0ab87a432de9d461e7284a773818eb3e1737fd15f0d8a834a7fb5a8d6ae71d77baf1203e7f6650611704734761ec900d87b14eea597fd9551c2861dfacade5414acd52f20fd2bcb70a7eb7fbcb47a9e18c7b8dfe58be80d72ff60e617b888dba1eb9e0781463c749f7b4058b36a6d545c029d6dfbbc7939c28d7c26e450007405552041c02160e24df56ba353728e9b0ec570f5d09b8bbacc7d68f5f9747e133b63df36959f5bcc01dd4ef999398bf3690b0a43f995b612d765e2edb1b8163f3b1e08699b8986752e4d8bc108588ee720260d348f46494773d90ffbdbc6d0ec7d68061bc4ddc74ad114ecae27441c0a84c34ef810685ad2157c05f4b1e9e976d6af36212d99d424389ab7f0c1679a71252e42bab93234da981adb2f965598061c464d9cbdf95afc9dcf1c7957619096ac825e115a0f8a7c652cc1281416997b0e6e242225a34064c12223fae7d78639a6ce0b3afdf1d666dbb4a1bb84979d47904ae0e03d4d5c6327bbb1199749cec83ed53cbfaba085fadb74db3b185be06be51c71bfc4db96b415bd427241151e4ea6b8074989b479222f6279a6f2c31b92222968ed37e0262c1ad59cdc5f1aa1d32181299bd98365efed10564a4a380fb89d57b72ac2dd72c80103c43c533385f1a6ca88e83372590c30134adb962a7827815bd3d0ba1ba8f85e30015dcf778f725bc94fe1d13986f93af788da142874197e11702eb2bf5e57ea02d4b19bed882c5a4ae8086229f5bbb4caacc128f1dfa2aae4c3f9afb1166b6442ff2325c0b145f8c3139b4ead50fc27d80ae003ad18e888b05a9e81b90fdd506fac5ad294f16f3d9bc40420ba5544db9e35b0956d9566d52e624e199b47e4e9606c253d135b8ecb102c4fedb7d096d2ed6487b819113a7750d914a600a6977b12a94149d15cc8d6f9fb2747b270e876abcb4d4d2f6922eb7be72836b58fe9ca0ae2365b7d612469eaf94e691ffda91b8bbbb484d7e653becf98bae215f7f55b2d6909b4b78c6bbb3ac5a2e73c0745557d3ab88c63b78b46d71c5919a454a701abc69e5e14b576fd0241b47c35c67575b735fac23d9abae63b0fe5813d0588d689e12203901bdd14885579b478d225cdcce08669a22cb34a62a47391f8af23f9309bb519a7e8ffc8b819534fe9088a34744edaf9f6bd2eadfedee87915e82201048622242fb7adbbd7b87af6dc9b155966646e44bc1bd80e73ccf1adf4de9def838f07183fdeca8527e92b805e75e00fb48ff27ac51977c508acda3948b46e65ef66cbf948afcdccc5622324308d0bc43c4acd67e35c5b36fb1c20ca8827320aaaa6a314c3591fe0f6b6e52a1d2c5bae7bb676ddf8b4f17f5acb368bb5832564dc9552fe43902528eb8f345b6810d36a26687155a51371783cea8a8e7df01d0297ff7bcd9aa26e334e10a60d82c674198b42b95179b6e7a055ef89a49251e14b128385157410bc4c0fc6d978e71ce2a93cd42b5a1348b924dbb328473740d33991f933c9efa3c38dd34ae7e5eb04ef47341c21df81df6a4bac88d36ef8e166ca35d20e42797918e7fde0a011f01f231999ee9a4a983935bf3bf67b2a553475182e27f05bdce87612e68c2f1b93b093588c44a7f8e7d279af591188ec96b9ea330ee7b5c32c0b123ae8a3eb779a44dc3660df6a790231287e2763f3ec241ded7b70971d52695289f6fb0f4cdb2fdcf2c0305b3c10ba2a2e3e5334d07061f205bc0a90e38a29778011abaab8fe5c5c5602c9645d6c1f8e177602003545020f8be61377a252b26dfa7b6354224cff5666c8cdd53c9b36cd8dea2a66475b9d7c807f0bb1ae26c2ae20c2a9a44899924b7d6cf6c7186cfbd7df8bd4baa8ef60dc7810023688e2e67f03f3ea7e9a644e7c9640744a7597717aeaaa9a2c648c4a92068b0dd27a469508cc6c9d610519356e672df030944bed245f43e7e361dd1788f5acfacbf22a66754dbe14a5bae3fc8b0231f8b491a2788032d8c76a1e17bab7a9d3e4416e5fd1e7ab21c8ac6171e510ee5e71d9e1bc805ab91119c12d016fbc55e0bc83038a20affd0026926ad077396753efdeebd96e31510db3fcad41b9cdbc764f37637bef74bf46177eb52ee64201ca4c0d0bb8a3914c88be85e3f1a2cab24579855da61bdd5aece8252465d21dd3b820d0ef95af1d94f597942eba642161116f70f9fff446be74910f805477f91afc35728fa6ebc42d8b9dd0300e2cc7a04a0259c56c0d2100cb0b091610f03436ae78839c2df667e730de650d18546b7f3e3fe0181039efbe38bb4039e742beab81ddc733e40d7ca9125c1705a77b26a979b18546185ca9606f0ac15c48f9fa222271261605732faa29613cecf234dfb4942b3c8e71464c1e0623af50091c99feedf01610f02f3c3347ba9c1b5a635beb2430702c5b259942b6f1b9d31d1092c5efdf46ddabc3566f290691ccb014ec51957bd02ab8b1d4544789e30830f24d1638cae7305b4e69141867a05b5bd8d07500b1f1c037b3b5dc353caa0d7e368ef11324d3fe5fe7445b7240ec114873bf99445f4e3348e839049ff4d47f5e8756e1916cab81a42a228501b9717ff2568db5158d190cb91e7bd5c92646ce9c5a72ca69ae6fc5e4ea14a702cb304e18108c2a5a162ae64e8bf0e35a9500b1fc7ecb244d037c8b5eddc7c9d8af029bd753d33db7437bfdf6822e4f42c6a4b0a7e2e883a040c9e241e02c254519b3b0cd15621a34590a090c84871384980ba13b6ecb1028eea0d3fffc30e6b832882b9a9b23250cc06a6ca5f8eba8d0a8cfa550c8da79db54c4cc098f84ed3a9a5396fa96163fc0abc1713421111483deb185b93b172e5a4a0d72a348e4ad1ba1980ac2f89c110a7a29470242f99aecc4d922406cb72ee6da93ae50827cc6e5f659bb7d2a8c7fbd96286e2f0fe4447214bbbc8881db0379133b17a18a4936b88ca216291c33dd30d8d0177128e978ac706e9066445857f11298d1a04a6af4844f0a4871571cb843ff0c05d1b244f19f27ef961035e4445b3b05b0955c20e67afeb3bb161ddfdc93cdfd7c8fa58c4c6ad83f6713c07ecf6339d312e9baafa9dd22f6a2dd6f8332960a1625ef62e0e7204e2fc4b1015c0082b7e5280f647bc7e1f99523f596ee09501906c11defaa79a1f87c7f7e4946b4f2c3f44e6a22a20df4e7be67107762442b609add18a2ffe3e7fbf6ac90f4c838b0e6c1d6f453cb3a75c0cbb3ba88ffbb4986c88ec8ff56fad0caf191275ce78a01209b29664e76315578d023959c57eb5f66f6fed3f9d533c8afd976cc0fe07c4f0463d421857f1d4b13d16bc174d3708f494de3d975ee80b0ab94e31866327c9828092b65ea4d01e05cdbba6936c95909f2e2d085661690313e5c788f00582fdd17fd6bfd161db7427b393819dfcf2893996e4ea8ce50b0eb5f6e02426d0f71393f5fa196a22a9df5dc5821bda175845c8c368c31558078d023f1830d5039fcd0f5cffb1ff409e3a2609c47e53d2ba626adae33b40047d65cf2ab9192c0cb2b0ccca4559ee5a98318a49443c34186fdf87eb1ead09861f4c499a8564a090b1294f542dccd44d834fdabacb3b1f30efc91baffde5b7b675fd28161f71285a92899fa5ac87af9e61f2d58e68c3c4a81f44a6b8d411251f746ea152e20ec601623302423008e58d70fde1c46d41ce24fb1281075a7f53299f2ec0c999a96e8933dba8ccbe12cbe230a3258a657dba4774cf6c16f1b6e5f8529c6b97f1c272065b033ad913363023d0c969ae9c9931b7005b605862c7bd16a8fdbfe37c1c9f4e3384bceb10fc8f205194d9d75872e763a305a0946d0da801ad71e646cbe6615f97696f55de6c6ac5a14c7da6c72ea1a087dfbed0ba1bd64f5a91b9206bc7dd97176e12c6e338fd4f6c2c510bdb1bf729d5ef90a3923fb2b22046b481bb8043210ea27cb819ba580423f27cb4c85c5cd3b911cbb2b324fae2bf8832d706db51e0381b486e30f32d733595977a5579e008ef93190bb78a82573881799c854d572ff74b83eb9f763c45ffc3e987c3ea85eb44183db014bb38e3cbefbc4c8d7c8d51af0a7f9e77a0bb06d0fb3b7b054239693dcb4830b94e083b8f3c533e9cdb4c33e886d81eac559e490eaa2a6dd04b87f0bc5173aac752d3835f5ac6011b5c98387cf0a29d9b7a1eaeeb593ad6a0936ad65628189b28a85b772b5b4d2708ded50f2d2585334bcbb1781fb23ea2ed5f53f7f036989c5e35ced3c8b431452fb733239e595f948f8b7cb2c481454da109c4d0205104f6b16f1e095d2222312f02ebee3d69e48bbdfd625b927d0b379c95989c67d766e57c2f125f91263195e59d60fca1c86eca64b365981de691f75559ae0c42a3f52ba970f8aad905c05093828693b9bc5e5f65a5e41a88c3cabdd9ba65c70f7e36a299a8fd5b92495d6fec637a3714936d6b7ce808bc33a6aa8888adac7d1bcbba7c842e573103f9115aed2d9ccbf3dd71f5b868ec692d65cabc0161836b778e3fad30d17512b7affc0d7c974cea24bf94a3b3ace04380411f3342e980944bfdf8fd1defa3beddab23d37f0e1c9db2fef5d7aef48a8b1b50e5b2a5c32649de9a3c77ea30c404158a4a2f655f65aefa2a10acd38e589f9c3262cddf606f347ffeb2c15b4ca225af8365c1694157f754dd3c15f3408f6f9d36f97ba417668ff4defe519866ff10cd78c3d71efdf42f06d62d4452e7f4b4ab0fcdf8c3863de7db5f9928e63a03bf2ad706fdbe32f0c57a546ad864a7c064d72a109b6b8aac5c824960f19f185705603d44853e1ddb74698c37505df1ac214e0efd26cb48373349df45208f77cbc844657db063d98de598633aea70b1a28dc69b7367d4cd368c5f0ce9287f3bc025eaa602500959907ab7fb7ade236c1774d6a137c0f702829003616fa95eeb90ac333c8dacb0d03b309eca9c6f9ed9f674b918272815b8775a68fa2fae25b62f1ac76e8f828df1f60ed0b6b8e8cc887ad2ae3ff81b7aed5022006dd5d7ffa612b7fa63337e2a7799ec24229c4e3b79fb8d7fe9590555d318ae206d7964bd4eb8bbcbeb5e025a792693b57a12491d4ade1fc20b1bb13671f5e4669e738b7a20babd69dd54fcb0f7aadc413af328b463ecc7416f24a806830211167f4b1b4782b11d87fa5c409e5779eac567d51dee0174ea826c75e11ad6b9434cd071b47f70513e477fa4e3c32b44d8fcb7aaaad4f410e8aed65dd30a12e6cf888d8fe45b685c7b9286eb07e95b60ef48bd6c4ece645548e8b564db0b6f20a0f8ee9e138721c8aabd341023247239962371ccec9266a8c352dec515595c4d56fc5847209ef50afa6d"}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/dlm-monitor\x00', 0x402, 0x0) ioctl$PPPIOCGFLAGS(r3, 0x8004745a, &(0x7f0000000400)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e630c4000000000dfea92f819977667aa0be4e91d20b93ddf38d939a2bdd9137170caad1544275848d9d30cb1a003c680"], 0x2ae, 0x0, 0x0}) 19:29:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x200480, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40082404, &(0x7f0000000040)=0x5) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r4, 0xc0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=0x3, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x8, 0x200000000000}, 0x0, 0x0, &(0x7f0000000240)={0x6, 0xffff, 0x1000, 0x2d}, &(0x7f0000000280)=0xfffffffffffffff9, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0x10001}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r5, r4, 0x0, 0x3, &(0x7f0000000140)='-[\x00', r6}, 0x30) [ 713.322706] binder: 22528:22529 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 713.329808] binder: 22528:22529 got reply transaction with no transaction stack [ 713.337625] binder: 22528:22529 transaction failed 29201/-71, size 80-72 line 2899 19:29:49 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x0, 0x2) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f630c400300008201000000000000000f630c6303000000020000000000000008631040", @ANYRES64=r2, @ANYBLOB="000000000000000006630440040000000f630c40030000000400000000000000"], 0x69, 0x0, &(0x7f00000001c0)="757da87438bb32ff6942ccf3781b9534bf5a7b179c8808fd96fcea9387d5927e795d30d4d378d39c87051ce2d76097ad951b97574a14e4df2cf2f80c0bc759dad1bdc026973a3f8afb81671e43a4ccf9446a53eb6b28ca252ed3bcd28f2727e2b4ab6146d30d5362d4"}) 19:29:49 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r4, 0x541b, &(0x7f0000000000)) 19:29:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x20000, 0x0) r4 = gettid() ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000080)={[], 0x100000001, 0xd418, 0x7fffffff, 0xe46, 0x100000000, r4}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000100)='[$ppp0ppp0(\x00') 19:29:49 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)=0x0) clock_gettime(0x0, &(0x7f0000000000)) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) timer_settime(r3, 0x8000000, &(0x7f0000000080)={{r4, r5+30000000}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x15) 19:29:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = syz_open_dev$radio(&(0x7f0000000580)='/dev/radio#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e22, 0x2, @remote, 0x4}}, [0x5, 0x4, 0x5, 0x1, 0x321c, 0x3f, 0x4, 0x2, 0x1b982281, 0x8, 0x1, 0x0, 0x9, 0x2, 0x200]}, &(0x7f0000000380)=0x100) setsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f00000003c0)=@assoc_value={r3, 0x1000}, 0x8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r6, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={r1}) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x3, 0x80}, &(0x7f00000000c0)=0x10) ioctl$sock_inet_SIOCGARP(r7, 0x8954, &(0x7f0000000180)={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}, {0x9, @local}, 0x40, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x28}}, 'team_slave_1\x00'}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000100)={0xd2a, 0x8, 0x8200, 0x1, 0x1, 0xfff, 0x536, 0x7, r8}, &(0x7f0000000140)=0x20) inotify_init1(0x80000) 19:29:49 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) read$eventfd(r1, &(0x7f0000000040), 0x8) [ 713.782460] binder: 22550:22551 ioctl c0306201 20008fd0 returned -14 19:29:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:49 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000000)=0x1, 0x4) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0100000000000000"], 0x0, 0x0, 0x0}) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(r3, 0x8922, &(0x7f0000000100)={'nlmon0\x00', 0x6}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 714.097011] binder: BINDER_SET_CONTEXT_MGR already set [ 714.102643] binder: 22572:22573 ioctl 40046207 0 returned -16 19:29:50 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f0000000100)={0x7b, 0x0, [0xbf, 0x4, 0xf26, 0x5]}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, &(0x7f0000000000)="da01f3c812490e51786640dd05b3106297008c03377f4a47cbd8c91ecded88bfc97228baa28e0125b236e6040d54b3275bf66c20", 0x34, 0x20000005, &(0x7f0000000040)={0x2, 0x4e24, @remote}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:50 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x80, 0x10000) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x281, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f00000000c0)=[@in={0x2, 0x4e20, @broadcast}, @in6={0xa, 0x4e20, 0xfd, @mcast2, 0x7}, @in6={0xa, 0x4e23, 0x3, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x8000}, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e20, 0x8, @mcast2, 0x9}, @in6={0xa, 0x4e22, 0x40, @loopback, 0x800}], 0x90) ppoll(&(0x7f0000000080)=[{r1, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 714.162706] binder: 22563:22575 ioctl c0306201 20008fd0 returned -14 [ 714.178771] binder: 22572:22573 unknown command 1 [ 714.183954] binder: 22572:22573 ioctl c0306201 20012000 returned -22 [ 714.255732] binder: 22572:22581 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 714.264319] binder: 22572:22581 ioctl c0306201 20008fd0 returned -14 19:29:50 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1000000, 0x10, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000003c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bind(r2, &(0x7f0000000040)=@nl=@unspec, 0x80) r3 = dup(r2) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r3, 0x28, 0x0, &(0x7f0000000340)=0x9b, 0x8) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000000)={0x3c, @loopback, 0x4e23, 0x2, 'ovf\x00', 0x8, 0x0, 0x67}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000300)=0x3, 0x4) r4 = dup(r2) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, &(0x7f0000000200)="82c27b928366e9fec4baabf3ea78cdfe70c09e1db73a7bd04e598adefce320a5e0d8dc4d07f8dba2b14a67f0ec78b741f856bd9272aa8d776c2c0d3a7e8a1832857f81661007e6a791a9e385b1afead7b7f30c614a504d9ac37b8d6b1379726c3ac4dc38d99f7331565a2fbcb5ba898a4b068ab9159b73ccd8e2a73608dd4fc0b7a6df675348fe7d7a4eadfc3b8dbac96d9b7b3b5fe0e9f7f6288f4d9bf854ac3fcad84f61c0f60248aa6678bb2ce71b3a02737b1081e7d0b808a58aba94bc6d95ed73d77afe955236c34a71808287fba264b467de429d6d14e26360593519f47e1815782be2b33b0a733af6") r5 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x0, 0x2) ioctl$VIDIOC_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000140)={0x0, @bt={0x1, 0x5, 0x1, 0x1, 0x100000001, 0x1, 0x9229, 0x4, 0x12, 0x151, 0x0, 0xffff, 0x8, 0xff, 0x2, 0x20}}) dup3(r2, r1, 0x80000) 19:29:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$VIDIOC_S_MODULATOR(0xffffffffffffffff, 0x40445637, &(0x7f0000000080)={0x1f, "56d2b671d3b96a45763458dbd6513e7074138b1dcf85c54746a2daaaaf868cbe", 0x4ac706f195c2305d, 0x5, 0x3, 0x2, 0x7}) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563640a00000000"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x101000, 0x0) read$alg(r3, &(0x7f0000000100)=""/191, 0xbf) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x40030, r0, 0x13) r4 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000000, 0x20010, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x8, 0x0, &(0x7f0000000300)=[@free_buffer={0x40086303, r4}], 0xfffffffffffffd6e, 0x0, 0x0}) [ 714.439401] binder: BINDER_SET_CONTEXT_MGR already set [ 714.445094] binder: 22586:22590 ioctl 40046207 0 returned -16 19:29:50 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000000)=[{r0, 0x6000}], 0x1, 0x0, 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) ioctl$VIDIOC_S_SELECTION(r1, 0xc040565f, &(0x7f0000000080)={0x0, 0x2, 0x5, {0x2, 0xeea, 0x2}}) [ 714.499635] binder: 22586:22590 unknown command 174351109 [ 714.505526] binder: 22586:22590 ioctl c0306201 20012000 returned -22 19:29:50 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x500f, 0x40000) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x11000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xb0, r5, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfbd}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x10001}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}]}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xfffffffffffffffd}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x11}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x97}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 714.569226] binder: 22586:22590 BC_FREE_BUFFER u0000000000000000 no match [ 714.576654] binder: 22586:22590 ioctl c0306201 20000380 returned -14 19:29:52 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) getsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x2}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x100000001, 0x3) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f00000000c0)=0x3, 0x4) r3 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x100, 0x101000) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000100)={r2, 0x0, 0xbe, "437ebef8d2ccb8b00991109a68e89e6fd8b64a503c82c68dd9d788b80657b6e287ff081724c403e2a9d42061a4ad205985d56d4a8c3fb849567a33eb7d6de99bdc7346381960fb4175af6b84688c8ed5a3013ac595794941037c4a8b1f1c7333668eee657f7344aa70607f329053bf9e0fc5081f1bd06a381ab2f83d05ae069198a2a9931236dbbed93ca6baed6161b879d77ab35a26b5314fefd7f73e30a64dfc0a58d5899640b44104"}) futex(&(0x7f0000000200), 0x0, 0x2, &(0x7f0000000240)={0x0, 0x1c9c380}, &(0x7f0000000280), 0x1) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/mixer\x00', 0x2001, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x882, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001ff) splice(r1, &(0x7f0000000140), r1, &(0x7f00000001c0)=0x60, 0x1, 0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cachefiles\x00', 0x400c00, 0x0) unlinkat(r5, &(0x7f0000000300)='./file0\x00', 0x200) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000340)={0x0, 0x1000, "0cca901de055ee96027e1c9cb0e301e7c0f7f104331ad99563c54f3435d62f31965666844f2a8a6ed3c6a3315c044e952e2611ce5f1bfd4d726fd19652c982bf27c902828676bd0c2afd9ad98f0ddc2c76c67be7f5998de141ebf63e8c5ae3d8fd6420ba470a0aab24ecc60b33e2f8b2da161d4aa47adb6542604320baa1487e8ed29da0c3562e0dd97dcc0cfc3524901237ca5dc01ddec59c113e139958fa9c8ea5acae2fcaeef20ed1eeb2231755cb70fec381033a364e1de6957ed4d06babb343bff0744562c99bd36342902f8f0bec94cd724fef3b132cd33749328f01905ae1cc5eb6b44706726dd57be13a7b9a53638c48edd39522f389f396916373c52be8dafef9fbdf51926be42960ca95971fd9781531dc53cec1584b85f85923a3c147b5b3e277684e018024f748d9b9ce9d6396e7d46c46930a45afe5c3b4fb89df8ef0484f04dda4222dcc43a55ba1724e51e145270e27c3c386d07827666b3b1deff65e403fb48758ac02ff8135316fcb5af8a8b6b3b91e186f43bc0515e9c2cd3c560e143680f146c93f7f4ad7d5351f29d81a9085814c30c440a572fecbfe3f0a65507cfecb3159da03deb6f9af624c5b80787b0db547a35ffb0e0a3c58360a03c94389c6d686717e331d47d5d83a0e6b15b6a6ae4c3f1a2fea2966e69c8146ed5652df1587c2c5384e331d831989190aed4d6462d9133b90ee50be06cb22c5d281fe4b6de75d23d884ef41fef4b470a7bf97cdb3628ff4abe68c1365b271ed015695e9053ac79cb413ee00c5ceed204e64a8199842b38cff8ed1ea6b95310dd26868c50b807d78cebcd87df1174dd27cfe669af656df896fc92cda91e1ad3cdf6ec19a15a52942df22815b284e2c330ef32a7919d4174da8e037d6b067c7c532df48d240218de4bca1a0c154aa17e8de0ab5291284f261175f9148cd97fdff21ab5f904d91ac49cb9dd0b24e2a42c5baf15ae909e00c1c4f19903999d1adc66d15c88385b8d933696b2ef003ef324d284e6ebe642b18e6b59feebf8f53660dac0bd80dd4bb26bde73be65f8a77afb8104b176fbeda24d4034be88b1820a72ec5b81d175255e7e42943126813d23c218853853881bc0544b95759c0adaaa8f8309733dd307cfe6258ee76bca3709f06bb74a6852419669ad4fd457d025628ceedac1b5d609fb520627b700b6506e895991a563c5b2e73066b644d3cf0b74236ad7bf7627a48e84a6d9929f670290086b5f4a09eeee466828d641bda7ecc1074e8c1d6a2e168d69771a029118f7f042b5c1ab4b419d32cd294a16454bddd89a6d92759ba06b7a61f2d5b04ede93fe64ee066d26eb71154321a43c5371e894831bb19319a9e9138b81e4f9ac66b099d07bf16cc7c3ca3d04977267043d9c5bc6ea33663a43e5571e12534eac694c5728fe5c69b5d8f20eceafe8cade42a89b6b91e61c7153bef33fed8e201e13b7a6c02af3e342acd9af847df384d4ec04add3feaccdd4b0e072d8378d69e2e98e7b9130de63de1296f972d4c82545d5924b78d5d0d54bb0ce7de9fe9071ac9978b6f33bc3a117d3673da450fb23976d788cbba169765c324b8524c8b5ba64c30a528eaf54448abc4093d9430faac8ea9e21602dd4bdda6d8b5811a957c65e1a96ced5ed890db6fe595f5d525428a94a6c18cd693c4dfbf34964cfb8e6c1e566b0ab006a43fc15010e54016e95a3596ce967cc5bca201e813e15334559b9eee864abd5625e6934b6eb5dfe19855264b2d32cecfe707e90d9ec9878cea17e7c4edf1ae9b79595f752830b68841b77db75d91c4943b4556e9ef3b6ab788ce3ffb0f6c4e71aa794bd1f6470c8317681c9bb2e840da1877c1b9e3a7cd62b20d28503df397058d588a427627eee22366962e82fff4651fe6f4129d4f2d7e6933e1dfd408ddc8d9747d129631bce2ead19332e93eba35ecd95264d31e580488211a4c4913a9540e9bd0e78029fd0ca3e41c54f6d99d588128217927c36c9582a7b64fff49e8d27683d002bf3f505518dbf96737d23bdb0bf3ed3c0e9ab55750954eef9b8e5625f1e9013beea89db75fdca80f0eae405d819ca13b98f930aeaf1250a6bfcf1d31b95d40efcc7963e19970761dba96bea517fb8875b3454d5081c166b6ca325d2be99bbb02e1ca9b1c2e4f6ca4a2779887c2d313652dcf50e4e345a467f743dfa5fb0db30efb436e84fa4d065d85579e0a8bdc13e9622eff2ad3b22e87a550f000f0e5f4fd5db3f0458823510216fa623b3bf0fdc898e70913170d2d2af3f58fda2bbb448333893a2b0b17180b688ac1fc29a08ab802ca2f94c5ecb2cead56416973200420fecc66373cd670db9726539320ece6dfeeadad75e34213b53bb0edab3fbf0a4be9bff1b817d6041074b6d645e0cb3fdde99ede3a5d33a490f3a705f7151c7124b0e8dfc50a8a0c257866496cbd56ad26f440f529130629d9b4369836a2ca476645d58d61a85ba1fa88d6d2fa7c970319a54e94f95dfe511f89a8f59635f36a6e0aa91a73930b560d775608f1efc95bf0992dc52a884da5d7af527d3cc78424244b6ee5393e19dc73fe73099c47fcf5c7ef4e77c31f993b8ca742aec3f01e27829f41109880f9fd5cb9741fd807d9f292c7e540da5c70e83ef4c495dc949a6626f84f704acb95c58bbcb889ca1f82a533be9d41c2fa4a132778b6fc6c75757180000e4d47fce18865b7ee305ae134dae7c7cc2e19456427aece2e2be1ecaa2e5c06dc90d0dc797095b430150d9133d2a79b163d5aecf9b5d818527eb0ba5eddd50ea580c90bf0668dcfadddf2d16880454208ec67e725d7553821bb58088d3e2d4ff14d980e2f5a20b3528e1a5ec4436f29b16b0f085faba14370a8497e4d99c358f6a3acd4566689f1c583008a232f7908c0016b09e1fbf19bcd7bfadbf105499937e42506315db386f0affed969bfbd1d7c1c944c8fbf9b431ca4c3f988ecc241532f103495b7f62266e8c6be7993dbc7ed929159e6afc78e179f0973c3dcd45c63016f2ac9158bb58c4c58afa80094f64933549070fcbccf9c5d84d8d391a0762c213c1000a8987f16c08748895fd4afff3820fa2b682db5a8ee203fd532379bb711b73c96673da8316a67d2ea73c64410f0a7de09a3648a440a41c8d5b60531d641497104041e63da4fa8504517df9f3e3a45b5bebf13e311175012d5887f11a83f283e57016e7c8cb5dc44ee6c2cdbfd6630db21e496d0a0fdceda690f2c2e1b6a83e50d6f20581ab68814bd2a8361373000e078e75931f7bc981dfc47df61e8850cf515067358e53a38518817f98a8e60f72c2f0a12ea1f2651c820cf0593aaddc5f0ee8a47711517215afda19210d54c8d0f85b5419e17fd1db929e79e85e260269cb0f3271d97088fd3cfb47501228d8abdcfa0c4dd33c913dcd4cc4c02db83726d6ce3fb2fd838a581cd9b81efeef041d64c8c50db2edab1a5700cff16bf97b819f78721a1d580f5fa3267f91ddc926e2825d45b023e0dfe0238116b15b55bbb3da394601d130e2ac36e0875a273983b94842c7dd45f47c41ec2c517eeec8636263d247701146bf985edbc4f4b40c2848d6506d09ca86da286724b73096cce42a94cb698c6e5ae8e01ac10ab436c75567c9be58873d7ca70e6f1923929e2003cf14606b7060ee98d019e418ae74e506d31cc6b3f95143d42c68fb667ebd7276e27864fbe64793985160c90f9b6feb9e6249b8fcdb81a5e956ef4c0fa88b48220e4750fa60622188741e8a2f05f864d690798a28ff59991e480d9184dade64894bb1a8327b48d32a27c9c91e9c81f70cf022d082617d39b322e6d90dcd41fff24d78e43afb6c3f4992a394cd3eca851f19fc9be153940dff4b9d606c45c1f4bbd373db08ae74e96bda703cd07b54909ec2c395f63fc7a98e6fe550f7fa2c4afa93b3c1dab9495e78f4e7d967517260d80618e6bda1fef35abceb72557075cf8fe1bf4a2af01070f3f8cf9399083fa13ac4c4db041ddd1267764b7b1428184b5e75a81ba4963c27f1bb5fdd131776327b6fbb159eac81e5ffb62891d533327778ec5323ae7cc4af0813133bc9264510702900b1c205f624714ee2638bf1420819ff393bce8e86ea2725298782132b9b56298cbce409dc3bb368489c704d8e492437f0e0cfa742fd2e26d97d2a3dc0dde74c4c62d6e46dbdefac34ca12494a6e460bd8c757a3b2ef5f630d000a0b120ac0eaa8ccfe1c7b3e1adc212d8d1b54dcfeea293f0dcac41cfb3c36d4c08e7eaa9098cd8028ebeb0627291734fd0e338bb77590f358e3c352019b499d6fe6e920686f5c88df8d96e468c005a7cad35afdf2777e9b00db0a0e52fde36b142339aca2024f050a4ed0e0611789d654e46deb6504fe0adcd55ebfbeae56d2d54b51ac0496c87fe8ea9aa879dde7b15bf1efe9a4ef420285bfe3317e4e91fd96893f5ac05f3cb03d78f39ed77f47da6c5fe3294b14e47a4e2050df148c0ffd17b2b8a77fe3bd91c2fbfb3df8964e5d1a20432f6a6a89f83d54f8750bcd5c513af532852c410ea4ea10fb272987123ffbd7a037c05fb148492e78060f506534558234e8c09fc4d592d949ac463ebf0ca885433409084b933d504e03b22966502375703b7d6864423e6753e25508cdbbbf9ee307e652410ffb71bf053df0e225d17ef5307bda561364c62d8684e874475aa1e6db7de14397743bcce0771c64c2e695686a07ff036ffe94d8f949f06e4fb0d617f57025ed57a38f383cbad1445a51b9850cae28aaf44aa48edd2f93ff4eccf1965c4fc8689329324903ad51b75f12ce62b7efcdd5ffa484b34dfe69c0e76e0c58bf4c7fa957a04de9e797a712d0d2abf12dfe0feff8881b32c84550072415300e171d27ff5227ff23ecf9487361749052be8f25802894bf4ae83b345f21847d6cbb617f74ad21aecff34a4cb2eb6630f82050c101834e3f42f944f1b3f125a78a4ed7f9cb935429b370d17fc6412fc420996d95c53fad199bf16bfac5e6ada1ce94736e5923f9815482192e85f7f9707cca5422b517e4592faea162bb046f2bdd4b4c54a1adb727b57cf981f87e427cacb7c616ae31b3ef79d7cca849e1de4b725744213e113ac2b1d42570c53ece3f80b88e4da606339e955f65c216316885354c824f1bf3e81e06907879315f35b621febbac513820c016a1d3a30972227dbc652f6e58e6caae83164bd1c4d50aa7b90ac19b74b3a6712e5b0f217d67c540975632fc1accddd6daf166ac22dc6f76dc12bdd597e84cc2979dcad109cf63547a07adc12805e887f0b936cd31f5bac3d82d0a9e2fa226154d976282172f3b496a4335454b4fb39f1e577554eecbb3ee4f0a32959b8e8f4f67bc072fccd06162f39b03f79df294958e97beb85c00dbe036ead572134334e4a88e193b6e71df99a83d2a057b0e366c5f3eff16a71086a404addb013a4476f0c40baba89e910395b0b5c011b9eb91f1e32c0123086d675e76efcfb8736c789ea516dcf33c84cdb137770adf5d9187e293c34057f7e7b05db5b126d85280ca05948b88ecb09bf11c919fdfff33c573edb09dce4865e0178ad7c46432de477ba3a7cd06aa2185bb22ad2920bee32832eebde92c538bdf115a4d458edde065615cb40a9565eaffde05c31beb1678c11a85c634ff72202c9dd60c69c573c0cc9a9bc5ef12f7a49ff2138314acb3f5cfe0100cd53e7562f9cb3c775843253dd35af66753a78c7903fbb1f56c2221e7c38da33c51048a813170c42172b0841022a1df8db9dc1de9d07e489b985a4a2f34e204d7e2c"}, &(0x7f0000001380)=0x1008) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f00000013c0)={r6, 0x6}, &(0x7f0000001400)=0x8) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f0000000240)={0x200000a7, 0x0, [0x70a000, 0x0, 0x4000000]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) fsetxattr$trusted_overlay_nlink(r7, &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'U+', 0x8001}, 0x28, 0x2) 19:29:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:52 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x88000, 0x0) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f00000000c0)="ff036412687b0734a49a9bf827f8b4e698874f7aa4ce950fd8a20c6e74d91d5b892cfe7b536b8562df45c6c5e12838031eb3281db62a3cc6db4e35237b803db5bba424beaa2aa308384959d7e46b84ee2cad0c15405f642aed204d062007e57d97a664f431997e05680a150e8ea10490b25044c90cf80e486966c379d6bfa0100450f4c17de1aa6c272f1d89") setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0xfffffffffffffe41) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040), &(0x7f0000000280)=0xb) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r1, 0xc0bc5310, &(0x7f0000000180)) [ 716.911277] binder: 22607:22610 ioctl c0306201 20008fd0 returned -14 19:29:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:53 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x80000001, 0x40000) ioctl$KVM_KVMCLOCK_CTRL(r1, 0xaead) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 716.983476] binder: 22611:22620 ioctl c0306201 20008fd0 returned -14 19:29:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x280, 0x0) ioctl$RTC_VL_CLR(r4, 0x7014) [ 717.154987] binder: BINDER_SET_CONTEXT_MGR already set [ 717.160384] binder: 22624:22626 ioctl 40046207 0 returned -16 19:29:53 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1eb5d210ae"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="ee22000000001611"], 0x0, 0x0, 0x0}) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000080)="6944a35a816456dd8c2f8b8d44a4d085f38e4663d54744b42465f8c73e7f1726c74159727bb85e3261244eda34ad98f469f22be194c359ecd2d2b0ff45d5641d2d61b039251dfc712b96f7afa7c9dcfb59ecee7341b2a001174bcc87b2e3f4418e639c39868633d771c3f7edfdb2072a53a15c52840bffbaf1de980070871d75cd92cc1ec9fa1d006d63f946511574e2cd875023f95fbcb1eefb27e4cea5264bc4438a0c4f9c2a4d9a529588f961d2d3cc50c50347239f4c699e71095046e32936e0cca07e3edb516f4f2fc3b6fdbd92f124a3b83e744d3164822325df60e02cafa0f4979c2840c95f465a4ef06f7de23c9866b941fe320d735d7efd977ba4a1") 19:29:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x101000, 0x0) write$UHID_CREATE(r3, &(0x7f00000001c0)={0x0, 'syz1\x00', 'syz0\x00', 'syz1\x00', &(0x7f00000000c0)=""/221, 0xdd, 0x9, 0x8000, 0x4, 0x3f, 0x401}, 0x120) 19:29:53 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) getuid() setpriority(0x1, r0, 0x955) tkill(r0, 0x15) 19:29:53 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x5, 0x0, 0x0, 0xfffffffffffffff7) [ 717.559704] binder: BINDER_SET_CONTEXT_MGR already set [ 717.565267] binder: 22644:22645 ioctl 40046207 0 returned -16 [ 717.593037] binder: 22644:22645 unknown command 282244382 [ 717.598901] binder: 22644:22645 ioctl c0306201 20012000 returned -22 19:29:53 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000040), &(0x7f00000000c0)=0x40) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x0, 0x2) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='rose0\x00', 0x10) [ 717.672354] binder: 22644:22645 unknown command 8942 [ 717.677627] binder: 22644:22645 ioctl c0306201 20008fd0 returned -22 19:29:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:53 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) accept$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000080)=0xfffffffffffffd49) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) ptrace$peek(0x2, r0, &(0x7f0000000040)) 19:29:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)=0x0) setpgid(r4, r5) 19:29:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x14000, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f00000003c0)={0xff}, 0x4) ioctl$VIDIOC_S_MODULATOR(r1, 0x40445637, &(0x7f0000000080)={0x40, "a0f7a3c3b73b24c03bfcd7923b044fd7f0f133f8b8875ccf7ca6d061e9838577", 0x1a2, 0x68, 0x0, 0x8, 0x4}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000180)=0x0) fstat(r3, &(0x7f0000000340)) fcntl$lock(r4, 0x6, &(0x7f0000000140)={0x0, 0x0, 0x100000001, 0x100000001, r5}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0300000000000000043d1b05c0aac3e07eea426d7f37917821c85b1dd9d0b9df00aba3a2b43c7d195836a1158adc711d374f4fff28aa309b9015cda3ce9f4c4d466222aeef166c4300a47a6648513a7e440a65c8530605a5644d0ca090bdd3fef790d7ec68ec7136e8d08e9c75cc55bda9349acaca462623be0f382a6ca54d1f4f2154a5b5d9a266a161af93f038a4a3aaa387fda944ff70681d4c48ecc91b0cb882da8fe9e4460e55cf6ba92954dd99357cf01037013b5439b8234237c370a4e08f5d4e62a1674f74ef1211376c899bc40e11f05216156283ed971f073ec4167ef23956f51e3037bebb60521d6762d86bab580dade23c4ee9b293fd95eba077a12db94543a376d83f1f8662"], 0x2ae, 0x0, 0x0}) setsockopt$RXRPC_SECURITY_KEY(r1, 0x110, 0x1, &(0x7f0000000400)='\x00', 0x1) 19:29:54 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000000)) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:54 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0xff, 0x2000) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000100)={@rand_addr, 0x0}, &(0x7f0000000140)=0x14) bind$xdp(r0, &(0x7f0000000180)={0x2c, 0x4, r2, 0x14, r0}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x26, &(0x7f0000000000)='*userem1@keyringusercpusettrustedeth0\x00', 0xffffffffffffffff}, 0x30) syz_open_procfs(r3, &(0x7f00000000c0)='net/ptype\x00') ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 718.081821] binder: 22660:22673 ioctl c0306201 20008fd0 returned -14 19:29:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x80, 0x0) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000080)="6280c018849432f665fe4ced6b05839e3be8ca603dea478febb4ecee2793d51e43eb2b57f2e6a2ddb1fbd751256ad4f9a0ea9c19cae915dd45f63b98028c0129ba7ba7a770e6f0c127dae44451b39bbe59d96062e2f5dd90ee7565f744b7e020dad8d7bb146798cb820e9d9e3ee2aff361e9285ebc937d956dbfcebce5c36d701c96ba76e299304fef11772f5bd2e2f226e853c79784c6bef44f3add745a05221515c74f77") r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:54 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0xfffffffffffffffe) ptrace$poke(0x5, r0, &(0x7f0000000000), 0x7ff) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) ioctl$KVM_CHECK_EXTENSION_VM(r2, 0xae03, 0x20) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x4000015) 19:29:54 executing program 2: mmap(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x3) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) ioctl$VIDIOC_S_FBUF(r4, 0x4030560b, &(0x7f0000000080)={0x2, 0x3d, &(0x7f0000000000)="39f5e4ee3c2b816a7a09255fab8509a4136180eb81705726e210d9e48ae399fa5b5599ef273bad9db3485cd6b2d9e5e0c6261896b204d7b22b03c049434e9ebd456754495af9b726151ae10e699bf57fc1524602483555810f566e470f383ebed8fe92efe9b6153e33c8fdb4ed55eec73931ffd51a6bbac2f41b574f7c", {0xea, 0x9, 0x35793d5b, 0xd, 0xd3d5838, 0xfffffffffffff3f1, 0xb, 0x4}}) sendmsg$key(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="020c040e2000000029bd7000fcdbdf251e001800fa02e3006572a31edeea2cbe7c442fb71c3a29d509237d31a9699002ae66a380386a7e4d874e6ecd380ea10f5ae102acb27de546c4ace8dc6ee80e67da679777fc8d2772c781a729a5c6c5cf38c7dd3dc3e0cb8857d0fc1b64b4c289e2f7cdab8e9fec5709e2e2b56e722a9350debd46423a68b017ac76befeefdf0c5b5cf90024d3b18bb1e03a25f19365feeb6edd1c419ded44b37facd255f8748c61b6d28adb1823a2dbab044732b727babc8073c9c1b32c854b49e64ceea14336556d87ae0894dae54bb5a191e2c6bb8958c58c69de68c79ac93001facc269009a4f29badde9052e05739c60000000000b71c1840c99594f7c50b64bbf146799b4f5fb420b0cc304ffb0df99ea54f243eda23fd1735edf16d80f9a2fbc95a24acaf858fb76c2f069c7237ccbe17eb381ec3232434c3ecadeeaa4b2277bf47845d61b17d9a253559958fedde68f2688f4577fdae0bd8e13bf71e0d36d8ec33b8b0894250e64eca31032ee61524d1f0e63fe6dc9a1f2f0625a00775d38f46ad5bc220b6022264145d4a31b1aa0723784caafa2129995d8bf62506fdff59cd419bcae90ebe41747ecc4d921ba270b199"], 0x100}}, 0x20000000) [ 718.389000] binder: 22687:22688 ioctl c0306201 20008fd0 returned -14 19:29:54 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x101, 0x405) ioctl$RTC_WIE_ON(r1, 0x700f) exit(0x2) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:54 executing program 4: link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) 19:29:54 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000005, 0x20000) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:54 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@empty, @rand_addr, @loopback}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) clock_gettime(0x7, &(0x7f0000000000)) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000140)={0x70000, 0x83e8, 0x401, 0x3, 0x7, 0x5}) r4 = perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0x6, 0x1, 0x4, 0x1, 0x0, 0x7, 0x2000, 0x2, 0x100000000, 0x7, 0x5, 0x7, 0x401, 0x4ef, 0x3f, 0x0, 0x3, 0x6, 0x8, 0x2, 0x80, 0x6, 0x4, 0x2, 0xffff, 0x2, 0x7, 0x7f, 0x2000000000000, 0x2, 0xc6f, 0xffffffff, 0x2, 0x49, 0x80, 0x38, 0x0, 0xe9, 0x0, @perf_bp={&(0x7f0000000040), 0x2}, 0x440, 0x9, 0x5, 0x3, 0x4, 0x80, 0x9}, 0xffffffffffffffff, 0xa, 0xffffffffffffff9c, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:54 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$VIDIOC_QUERYSTD(r2, 0x8008563f, &(0x7f0000000000)=0x0) ioctl$VIDIOC_S_STD(r2, 0x40085618, &(0x7f0000000040)=r3) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 718.907502] binder: 22712:22713 ioctl c0306201 20008fd0 returned -14 19:29:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r2) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0, 0x81}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000000c0)={r5, 0xda44, 0xd74}, &(0x7f0000000100)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x400, 0x0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000240)={0xe, 0x4, 0x10000, 0x7, 0xe5, "97b4c485bd0daf91f6ecbbb071b1562333523edc5f678c548425b3168bf3305e987d5fc83c5a21772d7e5865600c86c616c1141a66b39e9b3d4bacfad77a59114ce2dae49e6805bdd1bd30b184b7403400cfd1a7c8b3e36bc025ea8b96394796069d2d9a809d6903e759192a279a1d4691ecca7bf4464c07a50a6a0eca2e60ac4684d094a9b8e7ba32a45321a07bd97d72babde17f376093462b63d479fc48dec01c28741cef5e24de90bcd720ebf6ea675d63f22eab8bbe26d77e1e4d43f0393499a9b0ef7976f728b0e827798118834c353786e308d33eada36ee4df3bfc9ba8b14ba5c4"}, 0xf1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0x8}, @mss={0x2, 0xfffffffffffffffa}, @sack_perm, @timestamp, @timestamp, @window={0x3, 0xdc25, 0x2}, @window={0x3, 0x1, 0x8}, @sack_perm, @mss={0x2, 0x4a}, @timestamp], 0xa) [ 719.145846] binder: 22717:22724 ioctl c0306201 20008fd0 returned -14 19:29:55 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x9, 0x3, 0x298, 0x100, 0x0, 0x0, 0x100, 0x0, 0x200, 0x200, 0x200, 0x200, 0x200, 0x3, &(0x7f0000000000), {[{{@uncond, 0x0, 0x98, 0x100}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x6b2, 0x96b, 0x133, 'snmp_trap\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0xe0, 0x100, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xd}}, @common=@socket0={0x20, 'socket\x00'}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f8) [ 719.225453] binder: 22726:22727 ioctl c0306201 20008fd0 returned -14 19:29:55 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000000)={{0x7fff, 0x3}, 'port1\x00', 0x40, 0x40411, 0x2, 0x5, 0x8, 0x1, 0x3, 0x0, 0x5, 0x8}) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:29:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) r4 = fcntl$dupfd(r0, 0x406, r2) ioctl$UI_SET_ABSBIT(r4, 0x40045567, 0x4) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f0000000000)=0x9, 0x4) 19:29:55 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x8200, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1d) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) getgid() r2 = getgid() r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, &(0x7f00000002c0)=ANY=[@ANYBLOB="72617700000000000000000000000000000000ffff00000000000000000000000200000000000000000000000000000000000000000000000000000000007284370c4b45033f55cb8603ee6749dce27b1c04d7c59594e91aa4bf0cc0844e4422d82f6e3faf8020568a500b8b9442fba86675070735cb2a2b2a197c4044faf767bff6fed6e6434eac2ccfc07167347682bac57fa743d59c791785aef00727f77042f2ff080e8b5d775bde5f3421e612e9adbb919c1ac544d24845d5e43e1be42bb20e9679d5a710eb366901625f469290169c21e0ec9a1c95034034483e506ab81ee12cdb21dd7917d32406ee3906c469b42300ba0e888e4acbff5751da44f7fcad5bd109a45787823cdd4f95e417ca0c56ccb61023d657890421f53491d0650cb241918bca7291936faf8fa88883db1a00622e524bd5ac04e605bc49118e78b4351d6cec8400"/336], 0x48) setregid(r2, r2) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x80100, 0x0) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x4000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r5, 0x402c5342, &(0x7f0000000240)={0x9d2, 0x1, 0x6, {}, 0x101, 0xfffffffffffffffd}) ioctl$UDMABUF_CREATE_LIST(r4, 0x40087543, &(0x7f0000000140)=ANY=[@ANYBLOB="0100000001000000", @ANYRES32=r5, @ANYBLOB="00000000000000f0ffffffff0020000000200000"]) syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x200) ioctl$RNDGETENTCNT(r4, 0x80045200, &(0x7f00000001c0)) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) sendto$inet(r4, &(0x7f0000000540)="3e3fde4e31aa7ee6b378c1206a0208a7782d7c7cf19cac77f00cd0730adb9e494b7859cc7cab0c60c99c87d99c7bba055e12c884ca5f20652f49a9fc199c80a3de2db0c1d761de0c43b509610e764376b6411af4652ced3b6a05cbef4fe1c920495af9df451b2bf8003b6f0289484d212a3cd204b05c8ba0062d922b2c9f456ef5529471cbc6a0d36cb658aa453f90b8036e2dcabec18541c45e1f622397d84c52205de2cafad9020425672527378daf5b0c67c0b33c1e89aead0630b86ad101619113fc9cc06a7d70c1a8dbf52b06a9e425253b507418e7cc8182149095d3b1fbdeb322f58612ec6dc3e3ec4afd3a5f78ca3c824e50ed0f07db2740e17f142a6b49d8904df3c76166787cee726923f64daff1357165fcbcc313e04d74ee28bcbd0421acdb891a0c3f2d67f1ea3859f6aeab85df93926c217a2f4f2574d9c666ff368d22951742fa4acdb2aeb9ea59b05463e5f1f6d831afb40c69edcccf9c2e014c7a628b6cc91ad6eba235f3363ae34b71f41726d607f573f581bc092f53b830f56a32b0f7e15c35afe679e55f44998f96cd6def3d815db5ebedb93d8b6bf48c7c6b75a97eddadb5e04d7d8701289524730c54cc32583cf432d1f2e34d0e0bcea85057f9e7d6c7399e267c28e11bba29da132c80e8f5a10353ca7b19a2ce748ec36021d7f826638c912589a8b343505b2127c8523fd85c3376dd9eae05de95e1ee7b622612eeb3647828d33f5f3b7c13c39fbada0fc12a8c61700165949fcbd154e4c5ab10d02a2e65829082dc8b5bb2ebbc1e1e3c4cb564e40783f1ff6cbcd9cd9137074df74e8413c2af857d633f8f9a9ee93531f8fd6989ae24e5f48798f033b1169b74bee527762cd3f0d577155b7ec96bfe38e3ba26a65ead10917f855ba43e70c23337d191face1e37c434b1cbf8793592d05d10a6deabff15660223c74057a5cfcd4ac413be4dfb3081012235a671d0a196ba47b380d09d5f502271f01d53516ff72a587864345b3b316f3947a0ad01b48588dcf4cbca521c6e4f100cbd4cdef220bc61575cfe0fbbaa5ad1e3bb8d1fe25c39ebc2acf3482081009571b904f2c32c42dc829b9b04d53cb439a248af2e9f449c9c606ba8e13e10619c0e27c03b7b448c31ec343c662d6b3e83f0f68f343ac4f89cacb0791225568e873a660eb1a43129ba7848d052812c5ee587154fdf88f45dff29ab54a42e99a7ce89672becddfc925e75e677208d08ead448e169227b983082f807c4a1c21991341a7d2ba4f5184423e78d9849e56a882e31e183d1032f54b100e02043f8fe2a33e8581a0e4dd4caa7de588d65e96f175786ac314d7d007dffd07cac1acbccaf036faf08fd3c6bb1913356b6c3d499336de2e535792777ed9d4efa203e8a8ee99f2eb2d25ef895e1bd8cda45b0b26007dea7da2b3b1c737d714d45163c9a279fe74e4e31379ebf0aeecc0f2a7a4a491624087d0dd1241b69360f538d7e52e44882e2f39fa916760cd63b86e8d1c359cb8a772153402470e69085b6b05609fbe0cc475118662c6027852ed13a22c568a6e9a9622e61f17d8d5c3056e67f575fc23fd4027876f276a8c177527e93036a16bb91292205fb9e261ebfe6e8ddb42dd4bb282ca614334cc25ee87a98467e4d744420d69c4ae042cea907ee118a48522761fbc3198b1ffa7dd8c5c390a5c05b3ebace86424f4045d134318c7c72597007078b37c3cdc13ce6a575fd4f9cef42e10b82381b07351f25d8389203c655541e8f112055f7ac5f487e981d185702be40b597a8e8642f56a6889b38da5a16b583cf1efe7ffa09673791309a4146bd9c49d58dbf1ed3ce5907bd6f9dad89cb6cba06425bce7dc94f74e19a43aec9b0c11d8f2290f5542e9e5300a105d9043f126ad847c4004560e1d23eed83c56b0164cdc388d471fac3654cea31211a5ba3c6fd18a3ad54f18d335a0ff8cb5bbcbc0b996488833118bb8f13082d2033bda4640725e251659d4a88d01253fc4c1549f2b1c4b2b760e0d82be96f0e618dbd9d0cd5aeaa2f87407b0afc47f1d84093b6a738ae764ba3a2807cf9a6841a67be3f6829c721fa731f4bd2a4461ba9ad0a7b44454fe9f4593f66f1bfdead399e11b58177fc89addc112079420c66d0dbe930dd82507195f259260110485fb96010552df2280db2b63539fafd85e0289dc3ca2e0c097b504bfdfb8666080ddcb40c136ca0b88596bc5b3e7fea3a1325618122fed99deb77d5f6f4b6ecc2dcbb81385799614c42f5eeeee9105bdfdbe7b58b6446f111b273ff1cb8de52208303bf6092a04b1b12ba0c0fbacd5318fa5c9c64a4b9ea0695b07f790df66a6963854aada0048d7b58272d488ec7654f8f15f1f61670ef7e463591890e301955c80352561129bff816ca1e8c4100b017404884532544f67e10d99078be09672d9dd75797f278e70cb0efc19619283e71f803ad6a285623bbf044006ebe72f1642d0386613850006d7b8f098d8b2950a75945801c5f29c597d225f7bd53ee234afb775a243c573e7d138b201253a4dad60bef5f206b93e7c1af4f01f67b0a2e2f115d9bf734d13697403e1d0d39e12bdb055d79a44ef57822f0a19ef27b645722cd17ebb6d5418eebbe416f81553c3585dff51284f7984ef9f42a591d449098f717b542cc41e716100f326d0883f07083bbc44a7dfddb76d9da318ddb68c28ac2b5a7e568d15ec02c62642e48c881d805ac114ffa6fbe93b00b4d7b5ce7e1c707556919300980483742477bf26ae16e07d98e6e54badeed47cd87c5e1f18eebe2395ba32719235c992c65cb1dac18195ff8f89413a38bdd6f90e2087c252d316c912cc052cf2f7b050c55e14bf78e8444607919d054ea15b225db70e2b874985f09e6021e2934d870c75a6673c74f3514223c0b11cb7406b5c8b62da18f4d4a5ef073ae9f88955b09bb226f4dc91f514ad8be68173c7a211f8c9a7e83fff9bfd815a36f2e25c5f101d0ccb2be6cbe70bdf2a8011c935892ff80b09a96836685953e400568b2e9c15cabab5f92174215791fb5790cfb4df191605b2f688fe9f87d606fd05dea9e94fb6f978ccb5a53fd9ee816280867abfbaca3375b22feb543b5c02e4aa794d10bd6a5fa3b656c43c1a3ee0bf57e77fb92faaa426334d1bd01f20a99ef01f505f90001da977faf45a7e53ed6c047e0032af24aabdfd81416817ce543a6351731073697bd2a96438a7cc0828323d7c2beaec23b9edff07b11e44d47b3cf2af913e22b7c4468b2e2698cd8a78d39286220b3e94a57d2247c2e7cd2ec7ad3fd8ab380b7a58a4d46c9cebe43629eddd7f5ac504c4ebc912dbfbb837e4e5f20a0673ce79daf952709ac4fa0191e96c0cf58ea5dc326c78a05ac8f086c354dcc3d74d2d5a58aa1c2ee3a5d3c91849e6171fc99aa70acada2db9d467127d6bbacadde31e531d07e696949bac5fedbd9141e5262c0849c0e89082fb275cab5d3cdfe4af596baee13b9b15e343b23aad3b3413fe3caff00ff187ff6053ad85830d736668d0ca22c174be7254141bcb65416ecdd6bded4318fb500423a085d8c243e91a6a1308c5678f3a859ed1b2d8e343e15f3abe11383131911780b92d2299cb42d580bf6f109b7914ad1ea18bddcb6088908e75bb0b341255a40ce4cc5334bb4524cbfbadf4e15757f3c958d75ca808e778967221199ad077273fa3a4f7022f0ad0771b25da12f0789bc44ffe4f8672f748b7cee0d791f77e07e45aea9ff20b4ea03305b241d8d3b5155e2a32aa8405f98b17a879e5cb842523b85bc2d04333dea0758a366931bfa6cfaee9149e63ed2e928ff5172cc4e0268620993dba14b0739e4436390514eccf5c6a0706872b6f06156dcf5176a89a93c17e3c97a63b03b652b003f75ab609230c10b7e5a8dd13cd384571f6dfe5c80dad11dbfa12c87b2008b71674e6bbe5a0f533fd8f074b52da53da24dd4c4b29bf25e9da2dc5cd8dbd2e6ff81860dbf78865439ae80dd1e1a2c28ea05a0336deb6208d3dc2356ccb7fd8f01e75d8a4ac1d4a0e8b38b9cf493955676b1048a2eee8996bd1173b970b5a6a8909db9cfc4444afdf0bbbcd393fab36cb633edfb8120839aa0924798c89129876da86b51e1d25a4a0a1d56363949170ab61aa57bf0b1b780d2b48fa57c3ee94b32312d29a9ff0b20fac91ecbe10a329658a4f1232449ba277e6cdfa906df39250f9c0008f457afb80322b171621a602441078a58db547985ce0ca5b53ff464332c8280b82d77e39a54744e18c42238ffd671ec224d3b2f77333354153a7f1b046a89efeb67c5ca94961c9a7a41a604624bf5035cf5c68ac2c8098ec441b4789bd35c3ce77d63f92799c04caf0f1a1bb6b1ff8285253f6e8b8f1207b1b55580ba348d32b87e5410a3499093786cb895686dd519ec404a030ea9453fafda853a368702087d7dd64877b1eba0a7f786a95189a421cce9d5bd568fc2e55887c052be62a73da48ccbf16db35d6ffea0529a11e31e5bac763b132896d051a2eb8c95d6c49668bbf170ed4d0e487f1033f3c8506d44cbda301c72065a4a3941bc8f11a448b546212aad05fe27636546d97b6ab6131c15207fd4d6f467ac22d2264c1e917f652517932da95b28f9b5e615d7a6debbcbdf38fa7fb3685681798155ae2990a23d04071dba361e087d1993e723a71a56dc553eeed028d42772bde6827a8a48c6dc475229eb8c2a32307c45b4a20a5590ebc7c590ba7bddf01324fcea74461cf626aae31856017a0ae9a0d8ee88d9d8d9a18b8e3858252e62ebbd1a2a6d4406cfbb41d747509d43e79ab9f5dd80c3dd845bc7ba187034e6198e487883ca6da8d30fb1e1456f2af60410a00473b3e93cc402dbaa90efd3c54ad6b43bb69de19bf940a9a56e4bdcfbdc216c453680e20b87c92097aa7b06ab5f8101f0c6d99b58ee27138f1f7b1963c1171dcc3b6ffbc7d836b1c741ae48a5916efb2dd80303d85e7e6ef7f2da1ee112bde35b1b3d56d5ab24e116c94bae7c0fb89e3125fe22d810e8f48837069fad31744d5b8c8844813493602950d7e1b48ae72620732149b7b756e449959d882bf6d9e32000e39ecb50513523a7a2705b37d8e6bb3919d637d710a3f43d7354cf523f2be81f23731c8de249f81e47cd34ad5ffeda58098d4361c98df35402edbc4afd66fec02fd08ffcd318379ed112664c755efaa9551b9739c042451d1297cea7663d58939e811ea75695d721b4fbb9080bc15559f46d1ec9f6ba5affa1921d55dd4f21f44b064f71122de9f0715a85401cd147cb70b76a0e8f479e6ef2f2b897ff29f9766f2b25fd10f4fc65dcd1a926a770a48d8d2e5d6f15da3d93331bfc02006c9b7f7214e6f7b92be5330603b5b16460cfe7b0131b6b14dfd286b798bcc48fc8d125ed4f901cdbc324a4aa0dfaf76ab609ea9e2c8d367ab58bd755d60817f02eff9bded85cd4cc77641e6c92f0d819ab0a6c1e741d317568c95150fd9955edbffb92dff79202b6499e74f0dcab51cbc0819748b3165a92ea67b25565d5b1c7f2e6feff23e31fb6077cc37cd6152e08e3e8784b78966c432641222afc4597c9ba139db4aaac820086d3ff99f088e1cb6328ccdaba77455239ad2d222e05a3a8e4afde32cc47c05585f3b325cff50812f8798e3851d60bb3e974398eb4421ffa11afc78e4e3cc5d5495f0ea2d90b46df78acc4e418fe35aef23a6b8fd3d6b9c6abe35877caf2604ac06b2d66f866d3b73b2239600e0d27a05f99300f01dfd71eaa964fcabc9be48bab894d8c62f83ec67f8eabc1463db7306a", 0x1000, 0x1, 0x0, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r7, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='trusted.overlay.nlink\x00') getpeername$inet(r3, &(0x7f0000000440)={0x2, 0x0, @initdev}, &(0x7f0000000480)=0x10) ioctl$KDSIGACCEPT(r5, 0x4b4e, 0x18) [ 719.535323] binder: 22743:22745 ioctl c0306201 20008fd0 returned -14 19:29:55 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f00000000c0)=0x9, 0x4) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x48000000002, 0x0, &(0x7f00000000c0)={0x0, 0x0}) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='attr\x00') fchdir(r4) sendmmsg(r3, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) setsockopt$inet_buf(r2, 0x0, 0x11, &(0x7f0000000000)="d5214ce618049399f62d5d8ce6114c5c5ea5ceaa9c611397f2238f582821b5db72624cdc7a37c1c3a577bfc028341f30b97aa8121a2c17e45a47a0aaf71ca888a068275c55a7e4489523758658995c0910c08321c8b4c9", 0x57) dup3(r5, r1, 0x0) 19:29:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:55 executing program 3: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x10000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000180)={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000240)={r1, 0xff}, &(0x7f0000000280)=0x8) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$RTC_RD_TIME(r5, 0x80247009, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_GET_DEVICE_ATTR(r6, 0x4018aee2, &(0x7f0000000100)={0x0, 0xed3, 0x5, &(0x7f00000000c0)=0x8000}) close(r2) ioctl$sock_inet_SIOCDELRT(r6, 0x890c, &(0x7f0000000300)={0x0, {0x2, 0x4e20, @remote}, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e22, @broadcast}, 0x8, 0x0, 0x0, 0x0, 0xffffffffffff4b0a, &(0x7f00000002c0)='veth0\x00', 0x7, 0x2, 0xcd2}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c4000844c6a"], 0x2ae, 0x0, 0x0}) 19:29:55 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) syz_extract_tcp_res(&(0x7f0000000040), 0x7, 0x60000) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, 0x0) tkill(r0, 0x15) 19:29:55 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x2) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f00000000c0), 0x1, 0x0, 0x0, 0xfffffe4e) signalfd(r0, &(0x7f0000000040)={0x3}, 0x8) 19:29:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x101040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 720.015775] binder: 22762:22765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1783399424 [ 720.023953] binder: 22762:22765 ioctl c0306201 20008fd0 returned -14 19:29:56 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80000800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 720.189851] binder: 22770:22780 ioctl c0306201 20008fd0 returned -14 19:29:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getpeername$unix(r2, &(0x7f0000000080), &(0x7f0000000100)=0x6e) munlockall() close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:56 executing program 1: r0 = gettid() gettid() r1 = socket$inet6(0xa, 0x400000000005, 0x40000) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r2, 0x40086432, &(0x7f0000000000)=0x3) tkill(r0, 0x15) 19:29:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x10000000000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 720.470388] binder: 22789:22792 ioctl c0306201 20008fd0 returned -14 19:29:56 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x807fd) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = dup2(r0, r0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000040)={r2, 0x3}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000140)={'filter\x00', 0x7, 0x4, 0x470, 0x118, 0x0, 0x0, 0x388, 0x388, 0x388, 0x4, &(0x7f0000000080), {[{{@arp={@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr, 0xff000000, 0x0, @mac, {[0xff, 0x0, 0x0, 0xff, 0xff, 0xff]}, @empty, {[0x0, 0xff, 0x0, 0xff, 0x0, 0xff]}, 0x6, 0x8, 0x2, 0x80000000, 0x81, 0x9, 'nlmon0\x00', 'rose0\x00', {0xff}, {0xff}, 0x0, 0x4}, 0xf0, 0x118}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0xffffffff, 0x4, 0x2}}}, {{@arp={@remote, @broadcast, 0xffffffff, 0x0, @empty, {[0xff, 0xff, 0xff, 0xff, 0xff]}, @empty, {[0xff, 0xff, 0x0, 0x0, 0xff]}, 0x8, 0x0, 0x19, 0x2, 0x2, 0x40, 'ifb0\x00', 'nlmon0\x00', {0xff}, {}, 0x0, 0x22}, 0xf0, 0x130}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "554f38644c0acc998e4295ba10832e09cc6bc1e88c57bfe8dc6863dc762f"}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x1e}, @multicast1, 0xffffff00, 0xff000000, @mac, {[0xff, 0x0, 0x0, 0xff, 0xff, 0xff]}, @empty, {[0xff, 0xff, 0x0, 0x0, 0xff, 0xff]}, 0x800, 0xd43, 0xcd6, 0x3ff, 0x2, 0x1ff, 'batadv0\x00', 'ip6gre0\x00', {0xff}, {0xff}, 0x0, 0x22}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @empty, @local, @rand_addr=0x2, 0xf, 0xffffffff}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4c0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f00000000c0)) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r1, 0x4020565b, &(0x7f0000000600)={0x1, 0x6, 0x1}) dup3(r4, r0, 0x0) 19:29:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x373, 0x0, &(0x7f0000000180)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x3ad2, 0x2000) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:56 executing program 1: r0 = gettid() r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x8400) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0xc0305302, &(0x7f0000000040)={0xe2ff, 0xe387, 0xaea7, 0xffffffff, 0x9, 0x7}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r2, r2, 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 720.738078] binder: 22799:22801 unknown command 0 [ 720.743197] binder: 22799:22801 ioctl c0306201 20012000 returned -22 [ 720.803237] binder: 22799:22801 ioctl c0306201 20008fd0 returned -14 19:29:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dsp\x00', 0x8000, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f00000002c0)={0x0, 0x800}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000340)={r4, 0x6}, &(0x7f0000000380)=0x8) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x81, 0x0, [0x7, 0x5, 0x5, 0x3]}) r5 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x210000, 0x90) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) futimesat(r5, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={{r6, r7/1000+10000}}) getsockopt$sock_buf(r0, 0x1, 0x3f, &(0x7f00000001c0)=""/53, &(0x7f0000000240)=0x35) r8 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r8, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:57 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) signalfd4(r0, &(0x7f0000000000)={0x9}, 0x8, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:29:57 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) io_setup(0x0, &(0x7f0000000000)=0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x40000, 0x0) syz_open_dev$amidi(&(0x7f0000000180)='/dev/amidi#\x00', 0xe4d, 0x0) r3 = dup2(r0, r0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000001c0)=0x6004) io_cancel(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xa, 0x7f, r0, &(0x7f0000000040)="a8b796037e55dba2efb6f76b438b5d91f9251ff9bd1ce7a41644ef1a50891a9df49d2778bbcccb2c65832168ac5fd92c817386da113d5d09", 0x38, 0x749a, 0x0, 0x1, r3}, &(0x7f0000000100)) 19:29:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:57 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000240)=0xc) getgroups(0x3, &(0x7f0000000280)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff]) r5 = getuid() r6 = getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@empty, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f00000003c0)=0xe8) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000400)={0x0, 0x0, 0x0}, &(0x7f0000000440)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000580)=0xe8) getgroups(0x3, &(0x7f00000005c0)=[0xffffffffffffffff, 0xee00, 0xee00]) sendmsg$unix(r2, &(0x7f00000006c0)={&(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f00000001c0)=[{&(0x7f0000000080)="01d2cf9a22d93571423b922d67879bee116d96162da035d7b2fcbe8c31e32e374bb350f10f", 0x25}, {&(0x7f00000000c0)="e768338e7ce08cf640f3c54d639467f41c15135e47b0e4a1d8b5111f5474fbe176684e85f6405f7250313d77c4c92b7096adbaed58fafaa77e9e7a486d6607cdc26d2e18cd9b5416f1d0b701668319770ad77c429b2eb89d5f8c10ea0ec74b5c8a9db5791bbba8f5f8d77276ad54e11055cb1d8c633564edbbd5f99a1e1e35751d4fe24519dad51d01466e0b4af06a456ea5cc5ffde57cfa83eafd8c9fe9597df15002bc7a195cf6a747059a2b46bcd60beb8d27bbf59ae1ca5e2c05edaf604d5efc31742305cc9830dd957985c4692e6686eec2f12f2f4585f89fea8f20a94a403268b95a1793391212a1b96dde9f51833c93e11b8277fd7fd3cd8b9628d6", 0xff}], 0x2, &(0x7f0000000700)=ANY=[@ANYBLOB="20000000000000000100000002000000", @ANYRES32=r0, @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r2, @ANYRES32=r1, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r2, @ANYRES32=r2, @ANYBLOB="20000000000000000100800002000000eec39ab7cd2d709ca71f1985190ed0", @ANYRES32=r0, @ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r0, @ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r0, @ANYRES32=r9, @ANYRES32=r10, @ANYBLOB='\x00\x00\x00\x00'], 0xc0, 0x40040}, 0x800) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 721.227953] binder: 22816:22823 ioctl c0306201 20008fd0 returned -14 [ 721.267093] binder: 22826:22827 ioctl c0306201 20008fd0 returned -14 19:29:57 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x301000, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r1, 0xc0305602, &(0x7f00000000c0)={0x0, 0x400, 0x302f}) ioctl$VIDIOC_SUBDEV_S_SELECTION(r1, 0xc040563e, &(0x7f0000000040)={0x1, 0x0, 0x2, 0x1, {0x6, 0x3e49, 0x0, 0x400}}) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000140)=""/128) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ioctl$VIDIOC_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f0000000280)={0x0, @reserved}) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:57 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x8000) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r4, 0x800443d2, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {}]}) dup3(r2, r0, 0x0) 19:29:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000080)={0x1, [0x8]}, 0x6) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VIDIOC_DBG_S_REGISTER(r1, 0x4038564f, &(0x7f00000000c0)={{0x3, @addr=0xf00}, 0x8, 0x200, 0x6}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f0000000000)={0xa3, 0x0, [0x70a000]}) [ 721.613685] binder: 22841:22842 ioctl c0306201 20008fd0 returned -14 19:29:57 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) r3 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x5eb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ftruncate(r3, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f0000000000)='cpu&3\n\x00\n\xc0\xf9\x02\x00\x00\x00\x00\x00\x00\x00\xc8 \xf4\xb3\xca\f\x90|\x1ff\xf0\xd2\x9ba\xdd\xba\x93\xf3\xa2\x97e\xd7\xa37\xc0\xae$\xef\x12\x1feq*\xeb\x00\xb5x\x7fV-W\xeb\x9c\xf5\xe5 d\x99]O\x13\x99uJ\xbd\xefe\x83\xc2\x17~\x9e\\\xac\x1f\x93\x00\x00\x00\x80\x00') getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f0000000280)={'ipvs\x00'}, &(0x7f00000002c0)=0x1e) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f0000000300)={'NETMAP\x00'}, &(0x7f0000000040)=0xffffffffffffff84) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) sendmsg$can_bcm(r2, &(0x7f0000000480)={&(0x7f0000000340), 0x10, &(0x7f0000000440)={&(0x7f00000003c0)={0x7, 0x200, 0x2, {}, {r5, r6/1000+10000}, {0x4, 0x3, 0x7, 0x8}, 0x1, @can={{0x2, 0xb43, 0x2f0, 0x9}, 0x5, 0x1, 0x0, 0x0, "635e697189b7a9a9"}}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x880) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000000100)={{0x2, 0x3, 0x2a8, 0x9, 'syz0\x00', 0x3ff}, 0x2, 0x0, 0x800, r0, 0x5, 0x23b, 'syz1\x00', &(0x7f0000000080)=['}/#eth1\\-vmnet0em1vboxnet1\x00', '^eth0self/{ppp0#eth1selinux:!\x00', 'nodev)\x00', '\x00', '-,:keyringmd5sum-em08selinux{,loGPL\x00'], 0x65, [], [0x8, 0x800, 0x5]}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000240)={0x0, 0x0}) tkill(r7, 0x15) 19:29:57 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000000)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:57 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x34d) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 721.823198] binder: 22847:22853 ioctl c0306201 20008fd0 returned -14 19:29:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r2, 0xc0505405, &(0x7f0000000080)={{0x1, 0x2, 0x5, 0x3, 0x3f}, 0x2, 0x1f, 0x400}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = accept(r0, 0x0, &(0x7f0000000000)) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000040)=0x2, 0x4) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000000c0)={0x80a6, 0x0, [0x55ffca08, 0x3f]}) r5 = accept4(r0, &(0x7f0000000280)=@nl=@unspec, &(0x7f0000000240)=0xffffffffffffffa3, 0x80800) r6 = syz_open_dev$vbi(&(0x7f0000000340)='/dev/vbi#\x00', 0x3, 0x2) ioctl$EVIOCSCLOCKID(r6, 0x400445a0, &(0x7f0000000380)=0x7) getsockopt$inet_tcp_int(r5, 0x6, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000140), &(0x7f0000000300)=0x4) 19:29:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:58 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000380)={'rose0\x00', 0x8000}) ftruncate(r2, 0x2007fff) r3 = request_key(&(0x7f0000000480)='id_resolver\x00', &(0x7f00000004c0)={'syz', 0x2}, &(0x7f0000000500)='selinuxwlan0/+&\x00', 0x0) add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={'syz', 0x2}, 0x0, 0x0, r3) renameat(r2, &(0x7f0000000140)='./bus\x00', r2, &(0x7f0000000180)='./bus\x00') getsockname$unix(r2, &(0x7f00000002c0), &(0x7f0000000340)=0x6e) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)=0x0) timer_settime(r4, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) setsockopt$inet_buf(r2, 0x0, 0x0, &(0x7f00000001c0)="11173f8eee739a6870f8a38cfd9435da5ab5229dfab6c345ad115bd63628372fc57a80463b9faab420f5920da9a9274d71ecd5e7293a663703198daa56bc67454a9169fc735cf237647a2f4f52309c4c891839f9f8e241f4f3aa33b40435070cca8e8b83efbe03adbf5c0673445040938cdc811a29d46c32aa2ab650feb35f584bdee9d373ca8798896b97bb2c362db63d40ab54b0d0f9467cfb9e3ade16d8f098024cdfdb1961435e90c5a311b225a8124350ce0fed5ef1647e96a7cd36ecfdfdb9285ea23f0263c207e0bd480a767d14092e2034c170e3772a0dd30e666e36", 0xe0) ioctl$BLKPG(r2, 0x1269, &(0x7f0000000100)={0x3, 0x7, 0x51, &(0x7f0000000080)="2d06db38b227eff86191a3831f17fd1f0406cc851ef2843de4f8e996e01fe36a9b2a67f4d6652e971c80b1518ecbf582f94347d54b6faa1bf82f70ff24ad69ad4ca7c4a41457d76815605e6f1353adcda1"}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@timestamp, @sack_perm, @window={0x3, 0x40000000000000}, @timestamp, @mss={0x2, 0x4}, @mss={0x2, 0x5}, @mss={0x2, 0x200}, @timestamp, @window={0x3, 0xff, 0x3ff}], 0x9) ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f00000003c0)={'ip6gre0\x00', {0x2, 0x4e20, @multicast1}}) tkill(r0, 0x15) [ 722.123256] binder: 22869:22870 ioctl c0306201 20008fd0 returned -14 19:29:58 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x1ff, 0x44900) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000040)=@md5={0x1, "28d0f500577478646205dc62ee19cae1"}, 0x11, 0x2) ppoll(&(0x7f00000000c0)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:58 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x200000400201, 0x0) write$UHID_DESTROY(r1, &(0x7f0000000040), 0x4) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f00000000c0)=0xc) write$P9_RGETLOCK(r1, &(0x7f0000000140)={0x21, 0x37, 0x2, {0x2, 0x40, 0x4, r5, 0x3, ']:.'}}, 0x21) dup3(r3, r0, 0x0) [ 722.330220] binder: 22877:22880 ioctl c0306201 20008fd0 returned -14 19:29:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) 19:29:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x2c4400) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r0, 0x4008ae73, &(0x7f0000000040)={0xffffffffffff0001, 0x6}) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f00000000c0)) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:29:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:58 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) wait4(r0, &(0x7f00000002c0), 0x0, &(0x7f0000000300)) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000040)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast1}}, &(0x7f0000000140)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) write$FUSE_ATTR(r2, &(0x7f0000000200)={0x78, 0xffffffffffffffda, 0x5, {0xa738, 0x1, 0x0, {0x4, 0x2, 0xfffffffffffffffd, 0x1, 0x86, 0xffffffffffffffc1, 0x3, 0x4d5, 0x4, 0x8, 0xf8a1, r3, r4, 0x1, 0x7}}}, 0x78) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000280)={0x4, 0x34343459, 0x3, @stepwise={0x53973d89, 0x8d7b, 0x8000, 0x9, 0xf89c, 0x7ff}}) ftruncate(r5, 0x2007fff) sendfile(r1, r5, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 722.637137] binder: 22895:22897 ioctl c0306201 20008fd0 returned -14 19:29:58 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:29:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x191000, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000080)='cgroup.controllers\x00', 0x0, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffe73, 0x0, &(0x7f000000dff8)=[@enter_looper], 0x0, 0x0, 0x0}) [ 722.749472] binder: 22900:22903 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 722.757322] binder: 22900:22903 ioctl c0306201 20008fd0 returned -14 19:29:58 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1000006, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r2, 0x89f5, &(0x7f00000000c0)={'sit0\x00', @ifru_data=&(0x7f0000000180)="3b5ebbb901391860c2a6aeebdbf6afb10abb4a8112653b32394bb6eb5c81bbf2"}) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:29:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x80, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffffc, 0x24000) getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000100)=0xb) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x1, 0x2100) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f00000001c0)='/dev/hwrng\x00', 0xb) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000000)=0xc19) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f0000000240)={0xa3, 0x0, [0x70a000]}) 19:29:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x9, 0x400000) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000100)=@assoc_value={0x0, 0x800}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000200)=ANY=[@ANYRES32=r3, @ANYBLOB="870000002b3cf00844cbd441e33400deb27aa09fd28289e7b846f739530942c21df79de592ab26b4808f3c58bac10155542819ad29b7f3f97902f13bc6aab28ebb287fb8fcf3d25ce6295fdafa0ddae49a624ab55f87002330aff359dfe817ab51fca68c31597fcf23a58b602f09ad02550815ee45a36a777c8c91d34b71768e0fcd02ccaec5ec1bf9070f"], &(0x7f0000000180)=0x8f) ioctl$PIO_UNISCRNMAP(r2, 0x4b6a, &(0x7f00000000c0)="484aa54ec4c13bd2dc9e52") ioctl$KVM_ARM_SET_DEVICE_ADDR(r2, 0x4010aeab, &(0x7f0000000080)={0x7ff, 0x2000}) ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0546044000000000"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:59 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x80f, 0x40000000000004) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x100) ioctl$TIOCNOTTY(r2, 0x5422) close(r1) setsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f00000001c0)=@int=0x6, 0x4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000180)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000140)={0x1, 0x10, 0xfa00, {&(0x7f0000000080), r4}}, 0x18) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000200)='ifb0\x00') 19:29:59 executing program 5: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x10000, 0x20000) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000040)={0x1, 0xb62, 0x0, 0x2, 0x10000, 0x1, 0x4, 0xffff, 0x0}, &(0x7f00000000c0)=0x20) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000100)={r1, 0x100000001}, &(0x7f0000000140)=0x8) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000180)=ANY=[@ANYBLOB="bb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000785800"/191]) r2 = syz_open_dev$vbi(&(0x7f0000000280)='/dev/vbi#\x00', 0x3, 0x2) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000002c0)={r1, @in={{0x2, 0x4e21, @loopback}}}, 0x84) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000400)=0x20002, 0xffffffffffffffd5) ppoll(&(0x7f0000000080)=[{r3, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 723.226030] binder: 22921:22925 unknown command 1074021893 [ 723.232036] binder: 22921:22925 ioctl c0306201 20012000 returned -22 [ 723.310098] binder: 22921:22925 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 723.318683] binder: 22921:22925 ioctl c0306201 20008fd0 returned -14 19:29:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c0600000002842d0d67905f4bbf70c2360c5df3f3a45bc8c156963e2625ef1aebf9ce2e69d1333aa81fad02c5263bcd5206652d5b27ae63cf414c46348b6e18c919174d8f1339c56a070142f56bc8847efc90f7c8004b2f6e539be1508d2e2981b7c2cf4043865291ed16f6079ce7fd"], 0x2ae, 0x0, 0x0}) 19:29:59 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendmsg$nl_route(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@ipv4_getnetconf={0x2c, 0x52, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NETCONFA_PROXY_NEIGH={0x8, 0x5, 0x2}, @NETCONFA_RP_FILTER={0x8, 0x3, 0x1}, @NETCONFA_RP_FILTER={0x8, 0x3, 0x8b6b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0xc000) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000001280)='fou\x00') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0xc20e018}, 0xc, &(0x7f0000001300)={&(0x7f00000012c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="20072cbd7000ffdfdf2501000000080002000a000000042605000800020f09000000080001004e240000ebb6040003000000"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x800) sendfile(r1, r2, 0x0, 0x8000fffffffe) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) bind$inet6(r2, &(0x7f0000001380)={0xa, 0x4e23, 0x100000000, @mcast1, 0x4}, 0x1c) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) timer_create(0x5, &(0x7f00000011c0)={0x0, 0x37, 0x7, @thr={&(0x7f0000000100)="3efbcb54b320589a9ad4479a1b6fe4835954a8c9d0e8ed74a2f9059bc23e5199b80d3bca177fc591b83121d8cfe144c2ceeb0f348c021c70cdec47010bcec222ed90f4a85e05924284cab6bc35f47e59a3127a821a861aff3583c11f8f1fbeb403a77523751516b98d55231549765bb3a50778b9f14635f6743abbe69ca2e70eb4546a492ed62acdaaf5777ef631474164f8533d77f6b6", &(0x7f00000001c0)="a85b7daa7026dcd114a29ed68f773601f31f0d62b613bf94de624cca14de90661e80a4498b5b32483ba41cd4c5ba91220eb18bb79b8126a6c20242afe941052ca7b90b5acdf4034a6a03186a822994385a88168d2bb6bd993acd111a410e8bd67d9c69704389bc7364d76706a25b1107f3e9ee4f89f4ffdea1f331330871f2e69516fba1adbca955cff9f7f90b88249949b176f06b39f04c78ad40321b77276facad784bc02f06b1d1b0cb4c2ffb420431d83e63ad24503cf5bc9e8bcc4e970d5e09d7ddf65b62179c2181d9d2e68a329c4c8d9373ab17fc4efd7f7f5c4e2886b1d79509b8a177feb45f0fcf6bcc20d3561c3e32ce10cf9c6003d53e6e5ce60ec91732a439073e1f8553056e755ca570e6952261c21abecc8a556ebf53b32131c32b4f8a5b67628aec4a9283dca69511a3fab92164265d8db303b60a15de749e602de302150b0aa33404a0c5ec3fbc9c74f8dba0ba2a181a5c504b66c0ecb8f1fb6fb892d166dd4f083e2d22fdde1a5a9635f95a044c327c5835c413df381b8a61c90f8432808b3b8cad8a4380c7e0eca0ed179132f8f28bc9f655e3ff90bcdb25f61f9cc263a54a4aac0b6b4dd57c6a4b4cf03a0597cc67eb13c8940512da75401595a9fbec1f1c91a9dcf7256722dea77a78bc6050af0ae16c096e4d74e090cd5e8ade2d2bb852c7667c44101480495e80b8dacc868c873241612b3f38b967d561ea0055bca0c345be096881f2269ccbff0bb1fedc1ab8a2a0d91f6daae0679076b4e015c6c234efff6a8478e10944460da2aa3d016fda44dd91c77950e151f83f9da12f187bc7d6e2dae1d8c0d4eb1d575f2b4479045ee1acfa569401e664f8f2a24bc697fb2dbcfb27dadef7edab1109d26ea691fbbbb2550942008d4439db3a7e84b637946d20740a89cd715b2a3cec80aa0558274d3dcf5c748486f387a5ac48e48536425c8ee161d70c94c816633c844a537ffddf185bc74d79d8acf907b4bc33c4c10b303e521a6aef1619cd5e2f641e9efbcac10fc3dce468184db7f5a31b26780aa67f04d96615f7720e2941434ff5181d7730ff089898bb38842cf7d7cc7809d2385e38fe8d9027813dea4014c59824a6f9967fe44ad6b619ff85a6a3dd010c60f4b7d92479ac06f8dd7cb41d0a278b2cc311316f7ec7d2a168ba1cdc165b4cb5ff243953adfc939923386d36726cb1ffb5dbcbac21483dbfcf9d024ffb983382998ab1e71a6fb33a72ccf91b536566856385822bba7b8dff29b1d760932dd6081ce80644d8e5e8969fe834955be3ab13c44871d77f1f674110bc571fef95b610fc5c52de9449b34022677f814c030e9e509facd94821c4c586c3861ccf56b031cf061e467dc42b9333432f000ec180f63d63650365faa30ba17b966db4979f2936576e9a065dab4904eea50c344d1e6a956f765abc66a5b34e342060e01259bd68c1dd0b73e56e38a3cf79e711d110d53a2472009293a201f77e00d5bdc08444c28b405bdb6f3dd9f8a7ff1f5f3e51bc6bd524e392c721e688abdb3efc3752447e8a77adb48fdb53eac73ad4b6e3e2d93c31659a7fed344c01f9995837c72852c2fa9ad414a33a645b9a9d0d00f9754e3b3c2a8b07881a93a20242aefc682b29b95385edaf335d974470be790bd02e45e260c6970c5236cae89727d1368bfb27db9b2b4cb957e03c2d2d13b64b330fbb6ede084d35294b99a51b5a22cd139a0acc0d9bd4b42619b17097cd588b75e7acec825b27887e5270cd0f7dae85c4f815645ed8708c336cfe35dd671718b9efc6777426cb0e8be39fd0aa9aedf0b98361c62450d732c9fa6dcab270a4aa3491579d801da458ecbe1a31aa84351bd5931c0579778d6b81a9bccf56ad64f45cbc4f05d14e1d3f44878b90ed4b1a46d748f73b6faf8af9893a2f0fc9ee2b341454ca747e920f4570c86080e29e074dbfb61a37752ff32ba66e7137410d5ff15c6d21e841dfe4abcbbc3ae9023d7a0f0d5969051460a4370d80f81056204cd68895ee3aeac204b482d4c551614cd5d558862d691cb473939feb590255ce993ee88bb002a7474c94f616afda2f7c0e4f7fb5a8451fc623bde863be669f36ad873498fd904e38554f4126426348f86086617d0394f3c7330d7015f15801a4d99131d8bc5dd5365790f4747cba8dfd57accecaec23ca52bb14c2cc0607502be6f0ff58d40173fd99f9f68e803150ce3ffa5b65615dbcc69b698380f15e60ab92f79cccd17f6b7cdd870e8c4b3765c361fb9385f2a6746c547aeb8d8c7936fa7f676442dd67b2ca6bf09e3d88633029cf3d8dd2bd8c518906f5b3a86b2ff9c9b0d95e95f03eaa75c286cea866ef3716cb1f75a12fac299dbb53e9a4b4e2e8219db961c9c43f29f8f36b58f409a3eb951d8429cc1479b197769490d5bf8c8c3602b9b731c35fcfb73460c8ecec529cae0561663a4dab9c7b5befcf5a724a773d7d07c4cdf1e470abcdacd87b06c1a94e3216b25d5151153ce888acd96bb222c20431b4a760645a8ad385433bfd8880d3db658c58b3578821efaf7030a2a9ce44498abb8938cb2b1788e4605c71216173f9fa8b0a24e29c47b2c012a8ff18fea959b5e20752e4b8e44e1abbf44d01db0f3057efb1303058db0810f40dc2299f7ddc1beb5afd67cc3f7adf5e8a5e371423ea39ebc60801b789fc35eb0c073ad3d4d404cfe5703daaf6e2f3b3ceda16b32ee5866c7a9a69b537e143308a77bc9d9c0b27dbc5a701fa46dcffdb7435a12d03677501590534eeb4f17da58704d29217c931d9f340920cc1dde75cf055a12b9384c16fd269388fc3e2dacf39242d60fb9f62cf88228f8a802726ab0a447588f24d8a612dd2054514e2db2dd08b5ce1f624bbaca1973c131af16b5d722accfef8975cb7e2117d18cd1e73719d3d53571911c3f03c5a5a9fd5b6e5c5200ad126dc93c84064cf58914fd470481ec210580efa2d92889a731af196f3e7550b47115f2fbb33e59b45abecf1bf2fac4c4ea5b5a0612fac0e0666af6cfc8570c85026f629aae5d87dc7ba87543cab6491af63fb14ea92bfc77cff5182f2c46c3e570913cf2f6931422c04455f6673a52c3bc1462581523efa06e693bfefd07cc2dd80fe989eacce6b1b6d4fc0c88d68ee6b9bad6accb7dec0b7ff5aa590ba2eeb34fc615457049680921c12b7918fc7204e6bdc6ce256601013ae5149b08335295b442b1a1504fe354b2c45d410ca5fec2c9625abae54266cfbfe387f3bd0367377f2fe7a4d87c01a49d38aae82411dffb70300b14e8d7a41e1344d2ee65f5ef0d9015c7b77fd3de8f7d6fbc48640386a820fa3e4589531493f035ffbacec4edf6c5e8b25ad8ae4dab0af037a43cd53072e091590e363934af6d07f7235fb2c35cc21811a2cbae3049728555edc2d271a96956f81e5341da3a9de426cb4981d86f3225cf59ff4b6a163c3b112959bc3843d0163c9b136bc15fb1053601a5ac1a6084af19d1532836e52e2eea3b3fd93a5625a5c1983f9aa36385be82f1f53ec9f038f86e65693c0e07841fb8f909dc169be09d065233d74d32a89fe056a5f69ddd47d5062d95df1cac64b8f957a3bfaf2c6f84f52f6daab002f920945af85ff011a2ffe9aad075a5b5bb0f0b625c2d408058ebc305341c853260bb1710a7397bf2a4a87c22120f7b3d1a41728fd20848c50d4a1bf4a0020cc7278fd21709084adf2755c2e468567378e53e63b287c78abc1628346d14e2220edcaa16ed8b5f7200626a07148c5741163c4eff2e3d2387f8ce633440b69153da36cde3b24fd37f940732938c149037634f9b3b3b4d25b2edf021c8988288f2abc555aa5f9eaa70b959c301efc97d202c0e701138fc7a70f4cbdea53cdc14189d4024eeb2824c5e3cb598407ff5b7771f0bfaf25db83e59b02fea37178155a3ce0c9c3ee53fddb1972d2d9ffcf547fa0d870e86579108ca49f1aa3d2b51858f8b0590a7e65f6fed772c490eeffc546c76e7f52d1d218736b9dc79acb518cc8115ab555817053ad090467e31434e9c15b6f39c24201d293e62a07b76a1981310b6122edc8ab3349dfd07befb7c349356cf9b74c0eecd07db14418210b836cf26336c7d3210b5ef0ef9ebfdcd0ce92696cf4787923b0f5b4ae2307d7efffc3075545b0f2d65241c21281e962ab4248510c149e31647b5c67b908e45781cdf392427a93f55f9f03b1c78d6b27ca136d023fd9bfd09e724cf1d515ab2d148190e2c8d24059360ebcfd7431cdd8170db0c6d8b12a612b184f3e5c793bda6a3b1dff2050332c63bef80ad8be5ef343662fb7beff91db598a1782181ad59b8a368c6a7ab02bd003bf3ab795ee90b8b8043986abda9efdbe7cf89b6032cfde14e8a9fb7e2256ae7124beb776fa24aef05e126c40525644e61e32bc6c12d4cc0651a8bdece46e3e2da16ab068637b6a91c70b4bf856f0b86803a52510d820cde6926f4965fe02fcfc93ecd297e142b2ce12ddc84d14267df8e4df67f57e5af02f1296e59077a5ea839647b4dff9aac9f80ff676d8f95cd8eff6d6ce12e723a8acab6215c48412c0a1f4000a5a2f65139d06352a219660ce1ddc17af722910b1f918368df0097b2ea8536a6cf8fbb61c75d9f6a1458dc2323d09473b895b6512e38122ee6a459065852850497fcfa2739cb33e93331a03e6e0351927eadadbe87c6cf55974145a37d543312318b54af49722098e2b62b23e60cb674a0352d9e4867a46c25bae298a26e242dc67b9b6d6dd6f5f1bec3ed17c89f5095aba759e952706b84e4d09164598e3fa4b2f3febd49c5bd048955dccd3b83d2e0f4f83074e1fa92003fb52616f1d5e017d98d4680fccacd936b8e451d3cf1407586f5f7c0d045adbef230269a7ed4c92e86b5c616e2419d4f155c93ae7eb562a2ddfe6b114e37a4002d7fbe725832340b69e8ed6db6cf5e0ce0e7cd020ad7272b24e725070970af99960e86981da7ccc074d3206e1808b82a28269839ede9e08198fffd2a51c38e14be6f67f98847ecb59bd73bd10542cd32f030876f4e1e2900951642723418f46810dc70f6386e4e6e1b45502a5fbe96f343333e4f8a921350639c3e25e762704d2606bbbe84c1cc8db7bd12bf0f237411e74850f54a275219e55a3932012fa6f806b1f6a343a8200e2181868e1fb57be774ddee56fcfb065136605da760a28c54bf9c02ed093f2f4c3fde03bc0525830cbde9a4f20eb16fa62b068b37cf776a757580f92c3f88dcb7e52930e6d6c16c71b4279474fc61f09fefb402968bfcdd6c0d5c4086889560692915b5043dceec53959c7b34f282949508ebf5cbd6edb3f46cd1179ccb49a44099391251e8375d247ad87656266b9e3c285a72236f31671121a275406352553e7133ac8cbb513aeba4543ce6f8e5b4cde40e11c6abbb64197b415c918e9e1edea39b677c52a77ba68186e962d3f9d93590bc407fbbe32775f3eae628d4b148e2d01efdf57386dc94a5f229df8f294585137e1e40e721526ab6305eb957cf2bfa16ef71630d4508ea29a6f054b6953a9eabcf300e54ef1b0328ba716bab200d47ec8b0fa729813b6f1adabff8e9bfa3cf816d7c4c23b981b8b79072575022ef3611b663e90ec57919496298b1cb802e785f3f02936732464142559bfe033c06b383ee614c6c48f166c1ea298c0a5b866551598a970ecfcf2c18bba36d1ae2aa7e125f7cf28694711f72a1ee448e1bbf2b4690f9f29785e64f54a172e53aff8a24f1ee716474fc708c6db550f405d5f5233cec44fac45f61585b52c685292cf11eb6d17bd"}}, &(0x7f0000001200)) ioctl$KDENABIO(r2, 0x4b36) tkill(r0, 0x15) write$FUSE_NOTIFY_POLL(r2, &(0x7f00000013c0)={0x18, 0x1, 0x0, {0x1f}}, 0x18) 19:29:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sendfile(r1, r0, &(0x7f00000000c0), 0x7fffffff) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7, 0x101002) ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000040)={0x5, 0x8, 0x81}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r6 = getpgid(0xffffffffffffffff) waitid(0x0, r6, 0x0, 0x8, &(0x7f0000000100)) 19:29:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:29:59 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x2, 0x4000) ioctl$VIDIOC_DBG_G_REGISTER(r0, 0xc0385650, &(0x7f0000000040)={{0x4, @name="94af7d28fcb7aec6389f7babeb8c83a06dd5558d029c639c5db3607044d34a43"}, 0x8}) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000280)={0xfffffff, 0x1, 0x10000, [], &(0x7f0000000200)={0x990b7b, 0xffffffffffffffff, [], @value=0x7ff}}) socket$alg(0x26, 0x5, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000180), 0x4) ioctl$VIDIOC_ENUMOUTPUT(r0, 0xc0485630, &(0x7f00000002c0)={0x0, "d36343d80586465d2d8b4111332e98b9813bac4b8c1ef1fa941a35fa73363172", 0x3, 0x8, 0xfffffffffffffffe, 0xc00000, 0x2}) syz_emit_ethernet(0x12, &(0x7f00000001c0)={@remote, @local, [{}]}, 0x0) ppoll(&(0x7f0000000080)=[{r1, 0x8004}], 0x2000000000000031, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) [ 723.604672] binder: 22936:22939 unknown command 101475086 [ 723.610705] binder: 22936:22939 ioctl c0306201 20008fd0 returned -22 19:29:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563eb3f00000000fc5410fd7dbabb02df453312"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_REG_LIST(r2, 0xc008aeb0, &(0x7f0000000080)={0x2, [0xff, 0x0]}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) r3 = syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0x744, 0x400) getsockname$tipc(r3, &(0x7f0000000200)=@id, &(0x7f0000000240)=0x10) creat(&(0x7f00000000c0)='./file0\x00', 0x8) ioctl$PIO_SCRNMAP(r3, 0x4b41, &(0x7f0000001040)="ea4c0a34699305f04719e63c758b0900981b5fa3dd481af594e7489fd4934ce45f30fcbe94946ab83025d32bb1142a24e565d31be16045cd1813eee7efd9307c6d5cae12dd55e4cba6e13e1d83002d3de4fb29d397b5539d10579aaf591b6ece08452b8cd2432e1b7cb07d082ec493a49382e3cdbe14450c6a412f393369c004eccfecc26d7c45744395728cc2984c1cb659324cd4a5d056df41536a66e0d7cf63a75602f55256e5a55d9ddca576f4afd00044a2ba253d6d66ff375f202af093691d88f44fce3012a021992cd05066c5fcf30e094f71f5da005bad75c6bc2670031588a21292587ce3f7a0555ea7d15542676f48b8453748c3597194dbee3a7f1e2fbfcbc61b6b72f15bd43697c65dad008eb782b0f624d93cb990754b438dd5ae5d077b9de4583c020dd1e26f707c6eb1c794ab12a53ef24a9f8bb69336452f5b318ce626d623ffafc50947bb76d66ff5d7ffdea9f6eac1f72a0f4c84135f78fd54bd5fe0f4a946426b205c05ef5995f4f8354577cc11dc1d42d6b9d680caf8d1eea991318e555dd6841b8cc9aca2866ff4d02eb7d944c9f23f26694cba574c59f3a6cfe27e4e3122baf74b99d0b20b090bc66f6e6fd2c21c84bade1cc2ae6b4b53190a240555acc001e087ed4f54724a2bedc937d520c2ffb717a1c8b74e8202e6ba884b95057e26468f38e30ef491d7fdc60e25b6548219e1ea9ca96fa54e10fe6a4e8eeb582c3d605da4e689c4ace15efefebf8001cb0ac8d6fd83ae9a99c80f6325864e2fd4d423c5251b034aaf8bf48a6f743fce420373d116690f535ddcd64e2aef0289b04c33297d4a3d977ed056d501c737987527e207c88f7b31c1bc000b6871afe731dbde6684d78e13f7935cf89aa8faea3e2e8b0bf4f051d4b9c5f1b6cadae2844101f16d88cd01a5b05da40a8af2765b6d71c56c0a66fa2810e21d06ad839ca5eaaa315ca96a7af83c4782c63d85351c5f89bd695166089fbb51349798b29c8b4e73998de9a2af6641ed2e21d71e6912bfedf03a14f1ae54404137ed5b457c4963587243da3a14d304db35328f2d1bebe5bf7ab1f619bbdd57382d00bb607c9bf9dfb6be90129e1f754e55a12574cb59be2c75c07eced71c2dca6a534dccf092a2eca4f4a74ee973978cd719b3967c29303081988ce141744dc513979c02cdbbb239a4c830bd3a6496c54c1f0770264a4c0abdc7046b84bdb6ad90229b1c32a98ad0fb189e8fed29324f7382bb5f958923eb6b53b2c76563c2559bd8957f0037ec4bff6d7a656cbf8580599cc96f19d4cee18ca700bf133100e2ea8b306116760a337a0c28813d691ee7e2fbb0a46d5d9d15ba7ee1bdc9f2f59105e2a6322e7c5ecaa91a6f41c09d94b3867a0e64c378a9904952646a6da7382f96c0526574c7e944087c04c09334c3351165a5358a463ca27edb909491602df78204140e7c4d0e9fb7c54ac6cbc6e663ff9c6e2a333fb77e9a95db52c1096ac96860c52ac97719bf0cfdadcd22496759b8348a22ecb292590445bc5e9c6b767d475f64489cfa4f77bfb97b9ad6d34b4b8b22bc53564fd593244171a0628975942f9badf2c85388ad6761ae8e2f319f15ab8ee11c1efdb453a7f99b4d2a87f142b398080a8e6a5d46b1906eb51214efb7df0a4cd44d423b601d15d789b9c99c5bcf848bcbf8c920010a09f13d57910157b7eb5268fa8b9dec3a439ca3b3fe251ef24a6c608b9f397b7b3e556fd1c18652899f8ba11c6caae9d59e0ac0157a62856a5154f1e8057a9afed220650f1e05dd3921b3c9c1e138aeb013e3fee9a417e03cbfe941da75f16eff28450a8dcea8b0bdc089492adbd6cc09082c526586171afa984f0bb582b2500b84388ab902f799ea3f7e2f3d896409fa21ee5b21638a9e461379076c4f0a049dde7fd132a147acafd78d803481baca28b5d236782e0b784b468339ee4f2f8c52b45410bfd8d8ca355410794c877ffd6de53086aa5dfc0968f85ad1aec0ea58484e4784c1c113c95b662f8433bf9adfde3d72b02a60d9024e7c0c1a90ff7bdf284ed311ee4f8fe87bd6f5b21645d3ddc90f7476fb0d3e927953088511845c9905d9d289cce54e98a0aeaa02e9af8ba5ce2e06bad39317212a1f1f8cd809b8a957500477809afbbc2134c06dc5b7e60641fe9133961000ef686a83ca3fcc15b3bad9942067078bf9dcec63579f778aabece0e50ffd825fad9364f2b8c588a680e67849edf0fa3a9e9509fc12845e13fca36feea632f1318e593da5f3f627ce6d86fee2818fe5999c04ec49044ea9f288e02d7311326098cab0c4e50acd42217290737c9efc5e920b15b971b678a5cdca212d0715192aa1402bfb7fd9f065468cfa1bb353cf11b6b43ef31b4684411aee9d04ace3ef383f5b28c0afcc7f83365a985ad8498375ab64250acf636a6593a0209aee369b64e4be8428c9bd059ef33a3f789da4a89a22ea205b6f2682c5d80392a027fc10be270231a9b9386d47f53c363de419cfc24bf72c77f46dcf1469d5bf2edabd411df6ca40adffb937e6b9f00f333ce8c49867b8dbbbd27d56dcb94ff6577d471f8d257e44484deff6d9f206ea4250b6d183d5e84d1e050f2470727b1ff1385f67527fa5efe9fae518fef811cec3d5fdc438ce6bb00d0667d42fd57f8169fccb26a6c5d55bed2e23793f18f2b0253800dfda10568a3a0d0fe6a40e2a7bbdc6e22514798ca364c426382af6d94f59b8c11711c48b80aa2abd63556f40ade876d5b75ab0fdc8b7fb88968e45b7cd1dd5df8437e4ee32b640e34d3a4e5e106b9050788feef6aba843beb29af1e65474aaae0e742f1a1394a11545859c611f6fff4801a4a48be37b2c1ee76c1e2051d925e9be24878269612eedf80826d479a9ee0e79a8c599733992856d4bf392249240c90dd00671a1355f16ff0ac383ff84aa37f6032be00be440e402b275be29c9e0492d6e26c62dee4b369e827ec135f0fd234ae8a500086daade18dd19c9cb2368b9f9620ea1d9b057bf9dfe043a0f60f76c0ec42837d633d74633e9e29058168a64d2b2a0a1c2bf44ce9a04ea04d3963535833e88a3bb7df2d3988c24f5a2c5aab6dc5fb20e959f7748854c269a493dffeab2499f1dc9259d20e431c3f63e8f6a06ba50f6b4e911bc4932891725e5402e073f1d0195b318c10e266eacded28c098daf0a9a03b01c5fbc63806413135c89c4d9afb45a15926d927b8b11967cd3c2ce5ab758e27effc2b060015bbc25febd1522fd7fb043182dae702e62bf2f51f27283240deaa4439cfcea01eb142c12c8db2df28e8a9a6bf364b4f24403fb9d2852d119ed4c3c7b0bc3a9dab5085f51c5f10854705870e627b87e94beb4ff1909cce695dfd178fcda79f281b2d9f8a5e1a9d6f02d4f4ed9698ea556ef146e4c49bc04757d03f3a8b02d23ec39d9e7d55eaaf2f830e4ea0faf3ba78d0bd447234c06b85927d5c1c08c17430b0744e6db2412085c05a1f88f858f477e5df55e1e3bc42281b44f2ad08c7150b9b044603b5b91ad802552a1183436884a7bc74b1d410ee250748ccfc128a7b33498289b986e2ea128973d68754298e65a59b46ccc1da1d59d3b3404404fd1e7ebcbbf7ff2a879280ab4219a7987593fa5b928d9fadd424c07ecb26784fc7be8bf8d722abfa26b02711ab893e8014e96dce73f88d7c1d74f5c0ca11e3c8138ea50536472fae52af675a4d1c7689af230c8fa06e1843a841690d7daba9ed31fc0a569385dee278275ab2f530a0a8147c4e614d66c386eee7adc62cf84aeef699969d9ef99198440bf2f5688e7338db2df99aa63a3c81f8b1818be5ed236464ebd264f40c5444797ef5e5930436c9ea5f45dd5d3674e941e7417fdde51504f238e4bb96d55558a49894ab98b820116c05b334a095aeaa02d434d21e712e6e6cf3a734f4e5e8153c54d6af32f09c294c033d82a3bed464e4b8e53372ddddfbec8e40df5a2f16cb6d0ea75bb055aa1603303abe20a4feaf962c91fbe9e3256c3bae256cb9f6808021d604d9c9fca289222ea959d5fff334d51769c75cbd5f3a465cffbeffb9c129c9a8704b722348ccefdc3fce7d03735c93fe14f5823d08a19faf48b841f059f995d8195411af3e74c444d2364988a5061aba68396d396a6076c48affa40e935149ce10967fc3a7813a45cde6cd58dc16b5659ad7b9204f2f7378c94a109b469ba28df89712e44f9eec4e37bda4f59cf112d2dcf2fd22c1de69127a737cd7948f86b0ea1664cb8bbdff5797e6027b99f118fbe064eac34332e39ac950c31deb895922674320cf6c1218d5d46489672ab880c1e7540b5f096dad8cc3b1c1016115857a793f530bc636f0546420253c02c31d9519fc4e6d5e713b1edb4ef4245aa7ca7e2ef7160b6678c4c045e1e16bca916e56dd4da6c60f2cf465783bd39f76d62ef7a0ddade40188c8bbf28af5cc7b9b37238c239bb63835db6e88fbb67c2e0aef2499670f29d58e359a0aeb35d1ae2e1e5646d48a89eef633504da968e582cbc631dc13c2abb98f59e4930ef8318ab0c64f9eeab8539bbb0fdf5b042dfd072ec62ccfe7e43fb9ee527ff879b828defedd0b8b7632bcd1819af694cb4383e815187d95c2239dcae65aa783b7ea305e83773487171ebfaa824785f536df9413edfd1be158f36e0c1e60ed257f8b0fafe44adabe5d204423c0fdeb4ad860edab942776a78a583228e3bce36a10f835fab2fcc6fa57246800c86fe51ffaf58a84b76ba240b2a47e7eba76fe437bd4a2de6d8bff404d683469c37c7c053ac7c970f6e64506104e32ff5b3031e81beaa7f46b8f042b23ab8bdfee07198b5cba1c97e8a9ee7f3c7945dc4b76161ca990b52bc4378110834a2486012c6af6b4d1c661d004133010c13d131124dcba13a95c2a57e3200928c111d5ffdc49a392c8b96b5469368b010df1107b974f9dd807a149ab2cdb224224fcd1598dab383a6a021274c6e66fad157131a5d66d3cee53e899f2cf80b6f2fb9e0e31bae5a727c68d81a84187caf6dab630d4c8056cc29fabbac94387f3aa79329d7f873a37360ad19b42623361d1417fe3101f25a8ffde0ddece76f46994ad2a1082063766d6e88cc58163e6ed5f12a016002007cb12769f7bada35c072b75e7b16245404f1699c02c278fe332611cd45672a940d08e91e271f1c8dd99016f47a09cd7f3e3a92d5bbd79e608337e2f71b2d0326b39b088ccefa57db3dacd99c7b7175a515500ddfb6ce6325688369eb0ad5ac1624ce820ac67c026d160d6e6c05a1776ad188db31032495f840da70cd29aaebbded4a96f3454a277e56a26c74636fbda104b545435ac38cfc642216bfa7b16e388866e0c083030db1dbaea26f46764f6141695c3d6a460249ba4799eb51d68264de4af69413e57e7e062735a667140b423099acf96da80f6037fe7ea2320ffff7fa3ef6ee9d0684dfda9a48e13017e16b3f0ec73b622f73c0cc69d3268106b3989ef410747103cb5eafdfc1ecd325d86154eaab68a7d68c994a50a9971f6125f7abfda1639a466f24e4052b530a5446de429416c4d86a9786057f143883b6d803214ebef180eba40d05f57e6304a22b542662f4b1d744b57be667f4c18823e059dcd39b3ac58e8d582a3f06af88419c6c6ad14a1a1a35e152ce1af19e61b9a495ec8f335a78bc15d7aa7b922ecb091b8372b8eb5f71cfe80f721e36c9381ad11f6c9dc097ff9d3c9e0498c55e20b9771ea4d68346de834540b3e8c174a059c41a037cff1fe3e87902dc4759b74a4f9b1c9d0bd68d4a5979e72e1706") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 723.778009] binder: 22943:22954 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 723.785418] binder: 22943:22954 ioctl c0306201 20008fd0 returned -14 19:29:59 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000740)) connect(r0, &(0x7f0000000780)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x3, 0x4, 0x4, 0x4, {0xa, 0x4e20, 0x6, @mcast1, 0x1000}}}, 0x80) r2 = gettid() r3 = socket$inet6(0xa, 0x3, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x80, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r3, r4, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) [ 723.900636] binder: 22956:22957 unknown command 1072390917 [ 723.906657] binder: 22956:22957 ioctl c0306201 20012000 returned -22 19:30:02 executing program 4: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm_plock\x00', 0x20000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer2\x00', 0x101000, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000300)='/dev/snapshot\x00', 0x0, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000340)='/dev/adsp#\x00', 0x0, 0x220000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x0, 0x2) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x10}, 0xc) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000140)='trusted.overlay.upper\x00', &(0x7f0000000580)=ANY=[@ANYBLOB="00fb8102800facf86edaf7cf9d36985ead8a673b88304e6a373b39d89ec51d03f19a412c5b74cee08e8a8527284fb2bc2e46e92c33662b462d3a3450d93a6274133947bed98e8e979e2b36ad36da662b49dd3ec3eacf7ec199a932ad39ad21727642e252a45855ae634dad96af6e65a625e7adcb1d7e58336df8c86cea9bb6ffa4d28affbdc7aed7c833df83ae9ebd386b743ab293cfe078332be2756076690c8c1c313256c246eaa3d551dcc78b97a997d0d58782c76e26b44ee0de68e5702b06218fd175081918692b0fde41ac0b0877bd1750a5efa01c988dc9b6bf7154cc2a3a3d7c97df3e4195ffeda32ced86f2bfa11dd1094375e4d6833911a9df387a3115354290c6b00b3002727a04eb30f4938ff920c97119d4c84d7c73bc2d15f20ce1ded4093a2c484f081b0236ed9157486794f6ce39319bacb2a2cbfe887bda75c19b93d053dc7f61aeb795f35ba73e9067a6d12f1be2000bca5b950c082b00f6d64ada4ff3c954478de163b9465e7cf20b69a9d0912532d2504896282e41d2b521ae2904275b5fad43f7baf8a03c39902790b771c2f18e0c94b88998b83dccaa4b248ee7cc6ad2eaa5dd16b297377cb9289ea7f1f858ee39f6a41bbeeb0ba5c874ad52b224e950b926cf83c0a9cde7394c7e08db262f909c1a9502f74286330499bf0d000f9a9c9ac77dc15dd7b62fb7cddc1f5fb7"], 0x81, 0x2) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f0000000000)={0xa3, 0x0, [0x70a003, 0x1, 0x7, 0x2]}) 19:30:02 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x10) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000040)) 19:30:02 executing program 2: mmap(&(0x7f0000011000/0x1000)=nil, 0x1000, 0x1001, 0x110, 0xffffffffffffffff, 0x0) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) sched_setscheduler(r0, 0x2, &(0x7f0000000140)) r1 = userfaultfd(0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f00000001c0)={{0x2, 0x3, 0x80000000, 0x2, 0x100000000}, 0x4, 0x4, 'id1\x00', 'timer1\x00', 0x0, 0x1000, 0xfffffffffffffff7, 0x3, 0x1f}) close(r2) keyctl$join(0x1, &(0x7f00000000c0)={'syz', 0x1}) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x2) ioctl$FIBMAP(r3, 0x1, &(0x7f00000002c0)=0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setattr(r0, &(0x7f0000000300)={0x30, 0x2, 0x1, 0xc30a, 0x67b, 0x2, 0x0, 0x8}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r1, 0x0) 19:30:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="f6ff000000000000"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:02 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)=0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x11) timer_gettime(r3, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x4058534c, &(0x7f0000000040)={0x8001, 0x4000000000000000, 0x8001, 0x9, 0x7f0000000, 0x740}) 19:30:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 726.135710] binder: 22975:22976 unknown command 65526 [ 726.141146] binder: 22975:22976 ioctl c0306201 20012000 returned -22 19:30:02 executing program 5: r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x24000, 0x0) ioctl$KVM_SMI(r0, 0xaeb7) r1 = socket$xdp(0x2c, 0x3, 0x0) write$P9_RLERROR(r1, &(0x7f0000000040)={0x11, 0x7, 0x1, {0x8, '&!vmnet1'}}, 0x11) ppoll(&(0x7f0000000080)=[{r1, 0x8006}], 0x1, 0x0, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x10000, 0x0) [ 726.211399] binder: BINDER_SET_CONTEXT_MGR already set [ 726.216995] binder: 22971:22983 ioctl 40046207 0 returned -16 [ 726.221524] binder: 22975:22976 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 726.230479] binder: 22975:22976 ioctl c0306201 20008fd0 returned -14 [ 726.323348] binder: 22971:22990 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 726.332005] binder: 22971:22990 ioctl c0306201 20008fd0 returned -14 19:30:02 executing program 2: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x101000, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000000)) close(r2) socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x0, 0x0) ioctl$TUNGETFILTER(r5, 0x801054db, &(0x7f0000000080)=""/60) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r1, 0x0) 19:30:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0d9d8294f920a62f6f17d4c86b0cabba17c06aa641f81c29850c47a16d3f75f4b0bfd9de1f4f52b540a3194e7190d68b49962912e2f6207fc304a276ee9ec66fd8ad77e54a466f9dfd3e8dc17e3c0c4c17b3d6aa7553f0713936c2bbe3e50f6ba72f39e3d07e64ef31161c990f8c72ae5cce30ce1f7a44b95ac9ab25bc4cbbb23aadbfe770797d776663c3a4216d84cf33cdd09bec26e00000000000000000"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) restart_syscall() fcntl$getown(r2, 0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0e630c95a3dead024478e140000000008261350c886633fe1bd771d8cf899b8b69b66cc28dba64f36e84201bd9e39a19f4fd260472195b62631b239b51987b1b38d24befc01e9661b798ddd8e3c6c9e6748a8c00935801af70cf0c74236e"], 0x2ae, 0x0, 0x0}) 19:30:02 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x48) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f00000000c0)={0x5, 0x0, 0xdda, 0xf4, 0x2}) [ 726.743471] binder: 23006:23008 unknown command -1803379443 [ 726.749508] binder: 23006:23008 ioctl c0306201 20012000 returned -22 [ 726.779181] binder: 23006:23008 unknown command -1794350322 [ 726.785607] binder: 23006:23008 ioctl c0306201 20008fd0 returned -22 19:30:02 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x1, 0x4000) ioctl$NBD_SET_TIMEOUT(r1, 0xab09, 0x9) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:30:02 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) clock_nanosleep(0x7, 0x1, &(0x7f00000000c0), &(0x7f0000000100)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ptrace$poke(0x5, r1, &(0x7f0000000040), 0x3) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = accept(r1, &(0x7f0000000000)=@x25={0x9, @remote}, &(0x7f00000000c0)=0x80) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') r6 = syz_open_dev$usb(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0x4, 0x2000) r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/btrfs-control\x00', 0x480100, 0x0) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r5, 0x8, 0x70bd26, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_SOCKETS={0x14, 0x7, [{0x8, 0x1, r6}, {0x8, 0x1, r7}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x8000) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x20000) ioctl$KVM_ENABLE_CAP_CPU(r8, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x4000) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000080)=[@in={0x2, 0x4e22, @local}, @in6={0xa, 0x4e20, 0x8, @mcast2, 0x400}], 0x2c) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(r0) recvfrom$unix(r1, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:03 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3, 0x80000) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) getsockopt$packet_buf(r2, 0x107, 0x2, &(0x7f0000000100)=""/115, &(0x7f0000000180)=0x73) close(r1) r3 = open(&(0x7f0000002000)='./bus\x00', 0x400000141042, 0x80) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) fsetxattr$trusted_overlay_opaque(r3, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x2) ioctl$TCGETA(r3, 0x5405, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:03 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000000)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) [ 727.184990] binder: 23024:23029 ioctl c0306201 20008fd0 returned -14 19:30:03 executing program 3: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x420000, 0x0) connect$vsock_stream(r0, &(0x7f00000000c0)={0x28, 0x0, 0x2711, @my=0x1}, 0x10) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCINQ(r3, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x400000000000040, 0x0) syz_open_dev$adsp(&(0x7f0000000180)='/dev/adsp#\x00', 0x405, 0x200002) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f00000000c0), &(0x7f0000000040)=0x68) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1000000000000001) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3ff, 0x800) 19:30:03 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$security_ima(r3, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000040)=@ng={0x4, 0x12, "3665a0d7"}, 0x6, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:03 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000200)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000280)) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x1, 0x42) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r2, 0x8008ae9d, &(0x7f0000000040)=""/50) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) ioctl$TUNGETFILTER(r2, 0x801054db, &(0x7f0000000180)=""/107) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f00000002c0)={'NETMAP\x00'}, &(0x7f0000000300)=0x1e) ioctl$VIDIOC_S_JPEGCOMP(r2, 0x408c563e, &(0x7f00000000c0)={0x80000001, 0x7, 0x27, "e0e23aebecff64bd5fcd500ab5e0e1d762739113414229e46d4767aee32c8c4b5b6ed11a2ff57384e3827be985a8031e998304f24af00fadbf93c4dd", 0x28, "67ce052c8d8f08aad723cdacca8a912da27a70dc39b61f9600d57c3afa463d29ea1cbf68d9b762b126acce3fe19d267239aaba28389069df4fdcf2f1", 0x38}) [ 727.563410] binder: BINDER_SET_CONTEXT_MGR already set [ 727.568900] binder: 23043:23046 ioctl 40046207 0 returned -16 19:30:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$sock_ifreq(r1, 0x8957, &(0x7f0000000040)={'nlmon0\x00', @ifru_settings={0x10000, 0x6, @te1=&(0x7f0000000000)={0x727, 0xc2c, 0x5, 0xfffffffffffffffb}}}) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000500)='/proc/self/net/pfkey\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000000540), 0x1000) ioctl$KVM_GET_FPU(r0, 0x81a0ae8c, &(0x7f0000000340)) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000000c0)={0xa3, 0x0, [0x70a002, 0x40000, 0x0, 0x100000001]}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x40, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000001c0)='fou\x00') sendmsg$FOU_CMD_ADD(r6, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x5c, r7, 0x801, 0x70bd27, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e23}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x5c}}, 0x4095) [ 727.662573] binder: 23043:23046 ioctl c0306201 20008fd0 returned -14 19:30:03 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x4) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r3, 0x400, 0x70bd2d, 0x25dfdbfb, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x1ff, 0x9a, 0x9, 0x4}}}, ["", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r4 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x4, 0x2000) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r4, 0xc040564a, &(0x7f0000000180)={0x0, 0x0, 0x301b, 0x9, 0x15f, 0x401, 0x7, 0x1}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r5, 0xe00, 0x70bd26, 0x25dfdbfb, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0xf7}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0xc0) tkill(r0, 0x15) 19:30:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x2, 0x80000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.net/syz1\x00', 0x1ff) ioctl$VIDIOC_ENUMINPUT(r1, 0xc050561a, &(0x7f0000000180)={0x10001, "d0ae0fd29d4a666ba2177d3ec6df40dfd54fc4e67b4c202c8d5fcabbb94b9b72", 0x0, 0x7fffffff, 0x6, 0xff, 0x2}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000000100)=ANY=[@ANYBLOB="050000000000030006000800000018af0eb37df42f29a5fdff98cd77853431531fe6f04d0050e22aa9b18192b53a2af07434bfe77aaf8e5da87a314107000000ac68e6ba9e7e2e8ac56a3cdbf26018a71ed8afbd4bd8fa860bed3a97e53d97a972a070446ffca8a7f262"], &(0x7f00000000c0)=0xe) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="707ce08c7c519370ebbf814beec065c384878c2e2a7bfcf30cc1be2072a9f939ae7444a8499ca240e661644f395af0bc929765f33c1db645a011e0b52a1f8031c325a89e9e2e8ef9ca48f3a33a758a7213c2098187dd9b0b7285e620a0569e4ce1cb218970e77a1132378679f132e6d5dabf1bb1aafd8756664ca3afa16ba78170700147d2a06c933eab5c03f67dc8dd134ccc97747619ccafd2031eb5aa6aa6fda6c6102e8ea6c1cb4f13a569e3d31523e7feff59b381c988b5b0dc178cac5e363bcea4ea"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:03 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) userfaultfd(0x800) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:04 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000), 0x10) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x2, 0x80000) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f00000000c0)=0x80, 0x4) 19:30:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(r0) recvfrom$unix(r1, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x8, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e630c4000000000f04b190c7149c04c150c75cd7129d6685d6b94542f4330157c9b6daff3020000ed075cf8cf8e60685273f31127ef50a9ce71dddaaafca3b34fe6ebc1db5b70c290183a4ccc675d4f000000000000358e1fe4037ce4ba0814915100b93ca625844bee099b0dc318cee71915d00d9d6fa0405ffd81ee081e6f5fd2147cec26a209fd7f2a72eda5ec48bb77e029085deaf75712bf4a08ab038afd40b97d670f25640b539833f33246a3c0810652de0a10df540e0eff2e7e202e5e21650e3525eced053da36f58e1eaaed273b5f3fa0fb78d87d7871231f7981ec27ae5c9fd4f86bdbb58fe51553114f45a89f9baa357b60fa3880000000000000000"], 0x2ae, 0x0, 0x0}) 19:30:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = socket$inet_sctp(0x2, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f00000001c0)=ANY=[@ANYBLOB="19cf60d5171135d7a5530863973276545e008694de15ed79f62452e42064621df8c5582ea00a7ccaba8e1546", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f00000000c0)=0xc) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000100)={r3, @in={{0x2, 0x4e24, @empty}}, 0x3, 0x2}, 0x90) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:04 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r2, 0xc1205531, &(0x7f0000000000)={0x7, 0xfffffffffffffffc, 0x5, 0xd68, [], [], [], 0x3, 0x9, 0x7, 0x100000001, "61750abde8844a1203c9f589d29d412a"}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:04 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) r1 = dup3(r0, r0, 0x80000) setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000080), 0x4) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r2 = fcntl$getown(r0, 0x9) sched_getscheduler(r2) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x62, @local, 0x4e23, 0x0, 'fo\x00', 0xa, 0x400080, 0x45}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x2000, 0x22188ecb, 0x100000000, 0x80000001}}, 0x44) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r5, r4, 0x0) rt_sigreturn() 19:30:04 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000140)='/dev/cec#\x00', 0x1, 0x2) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000180)={0x7, 0x1, 0x100000000, 0x1, 0x40, 0x1}) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000100), 0xfcc3) ppoll(&(0x7f0000000080)=[{r1, 0x8006}], 0x1, 0x0, 0x0, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x4af0d16a, 0x10040) getsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f00000002c0)=0x3, &(0x7f0000000280)=0xf7) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000000c0)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x8) [ 728.439494] binder: 23085:23087 ioctl c0306201 20008fd0 returned -14 [ 728.514568] binder: 23085:23087 tried to acquire reference to desc 0, got 1 instead 19:30:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) write$binfmt_misc(r1, &(0x7f0000000080)={'syz1', "54b10e6c8a0c4cea3b7cdfc27278f047da108956a56c693eb99f9a2c5d5f0034dca4754cba476e26a74d56cfecaaf94a776c5348cd0b2a84afb043faa83767ad213245c52948ca3cc9ece2f9791fe75cb1bdee3309b44b90519ceb9e537d8e8ea678f80fd7fcd2f6992bdb217406c6e240d23ee77d9a1195cf20120d5a12b0de26be2d23c90ea12873afab088755727cb8ff8270d82703d993f2ce39d453d2952460dd5f2f20fb2f8643a81e41ddae0448c2ce234224f6bb8fc974bb2d23b1ef4b011f"}, 0xc7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 728.688776] IPVS: set_ctl: invalid protocol: 98 172.20.20.170:20003 19:30:04 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) listen(r0, 0x1000) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) setsockopt$packet_buf(r1, 0x107, 0x7, &(0x7f00000000c0)="a4ee413806f7a9cf9c54c6cc9a9f5b9b2c1e19e1a6ccb4dc200facd8feae3ebc2b5ec29d95bf2c0ea2f3923d08467103", 0x30) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:04 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x80003, 0x80000002) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x1000000002007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000000)=0x1) 19:30:05 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000000040)={@local, @dev={0xac, 0x14, 0x14, 0x17}}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) creat(&(0x7f0000000000)='./file0\x00', 0x1eb) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 728.888649] binder: 23116:23118 ioctl c0306201 20008fd0 returned -14 19:30:05 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x800, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f0000000040)={0x2, 0x1da0000000, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(r0) recvfrom$unix(r1, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:05 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000000)={0x94, 0xc, 0x2}) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) rt_sigprocmask(0x3, &(0x7f0000000040)={0x2}, &(0x7f0000000080), 0x8) 19:30:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x400, 0x8000) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x500, 0x7f}, &(0x7f00000000c0)=0x18) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={r2, 0x3}, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SCSI_IOCTL_DOORUNLOCK(r4, 0x5381) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 729.355605] binder: 23137:23139 ioctl c0306201 20008fd0 returned -14 19:30:05 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1f, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000040)=0x10400, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:05 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x10001, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="18a3194a862020f45ac1a017c471bdbd150a77e0f5906a37c6948ddb68f7f9ed54b8f66f3b7b808e22a13c7a44fb68cf19d5e2dc7784a23e2223eb8fdd092c1746a5454c02000000000000000302f6ed88d18d77d1c1e1e19a9d9642544b6b4d939ffb0debf6160a9dc4159a016d", @ANYRES16=r2, @ANYBLOB="00082abd7000fcdbdf2508000000"], 0x14}}, 0x810) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup3(r4, r0, 0x0) 19:30:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x800, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r3, 0x4018aee1, &(0x7f00000000c0)={0x0, 0x7ff, 0x2, &(0x7f0000000080)=0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:05 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x801, 0xffffffffffd) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100), &(0x7f00000000c0)=0x14) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r0, 0x968a, &(0x7f0000000000)=""/4) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x10000, 0x0) ioctl$int_in(r1, 0x5473, &(0x7f0000000040)=0x9f) tkill(r0, 0x15) 19:30:05 executing program 4: socketpair$unix(0x1, 0x9, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x8000, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000080)={0x2, 0x0, 0x6, 0x200, 0x81, 0x0, 0x5, 0x7, 0x4, 0x9, 0x101}, 0xb) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:05 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000000)=[{r0, 0x40}, {r0, 0x2000}], 0x2362, 0x0, 0x0, 0x31a) [ 729.818742] binder: 23163:23165 ioctl c0306201 20008fd0 returned -14 19:30:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x5, 0x0) write$FUSE_OPEN(r2, &(0x7f0000000200)={0x20, 0x0, 0x5, {0x0, 0x2}}, 0x20) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) write$P9_RWSTAT(r3, &(0x7f0000000240)={0x7, 0x7f, 0x2}, 0x7) getsockopt$inet_sctp_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000010004, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) close(r0) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000100)={{0x63, @rand_addr=0x4, 0x4e24, 0x1, 'none\x00', 0x13, 0xf5a, 0x77}, {@broadcast, 0x4e21, 0x3, 0x3, 0x6, 0x80000000}}, 0x44) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:06 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x8, 0x40a00) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f0000000040)=0xc0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) [ 730.213047] binder: 23184:23185 ioctl c0306201 20008fd0 returned -14 19:30:06 executing program 5: r0 = open(&(0x7f0000000000)='./file0\x00', 0x800, 0x4) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000000100)={0x1, 0x1, 0xffff, 0x5, 0x5e7}) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r0, 0x110, 0x4, &(0x7f0000000040), 0x4) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000000c0)=0x1, 0x4) 19:30:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:06 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2107fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) arch_prctl$ARCH_SET_GS(0x1001, 0x1) 19:30:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x5, 0x80) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-monitor\x00', 0x200, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP_CPU(0xffffffffffffffff, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x10000, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000240)=""/92) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x10001, 0x5}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000100)={0xf786, 0xa0b, 0x10001, 0x9b8, r3}, 0x285) [ 730.268273] binder: 23184:23190 tried to acquire reference to desc 0, got 1 instead 19:30:06 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000012000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r1, 0x0) 19:30:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x10000001) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000000011, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) ioctl$NBD_CLEAR_QUE(r3, 0xab05) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 730.509681] binder: 23201:23206 Acquire 1 refcount change on invalid ref 0 ret -22 19:30:06 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f00000000c0)=""/193, &(0x7f0000000000)=0xc1) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vsock\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f00000002c0)={0x0, 0x5}, &(0x7f0000000300)=0x8) get_mempolicy(&(0x7f0000000380), &(0x7f00000003c0), 0x8, &(0x7f0000ffc000/0x4000)=nil, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000340)={r2, 0x9}, 0x8) r3 = dup2(r0, r0) write$cgroup_int(r3, &(0x7f0000000040)=0x2, 0x12) getsockopt$inet_int(r3, 0x0, 0x5, &(0x7f00000001c0), &(0x7f0000000200)=0x4) ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000400)=""/221) 19:30:06 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x9) [ 730.637513] binder: 23211:23214 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 730.641328] binder: 23201:23212 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 730.644922] binder: 23211:23214 ioctl c0306201 20008fd0 returned -14 [ 730.659817] binder: 23201:23212 ioctl c0306201 20008fd0 returned -14 [ 730.717646] binder: 23211:23218 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 730.725157] binder: 23211:23218 ioctl c0306201 20008fd0 returned -14 19:30:06 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x3) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMSTD(r4, 0xc0485619, &(0x7f0000000040)={0x5, 0xf900, "0705639bd9dc47ba9b371194a52f32e303bafa986e86468a", {0xd2, 0x1}, 0x7f}) 19:30:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x100000002) close(r0) socket$nl_crypto(0x10, 0x3, 0x15) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="feffff53b31bc402"], 0x2ae, 0x0, 0x0}) 19:30:07 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x100, 0x10) ioctl$KIOCSOUND(r1, 0x4b2f, 0x2) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) getsockname(r1, &(0x7f00000001c0)=@l2, &(0x7f0000000280)=0x80) fdatasync(r1) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) fsetxattr$security_ima(r1, &(0x7f0000000040)='security.ima\x00', &(0x7f00000000c0)=@v2={0x5, 0x2, 0x3, 0x8, 0xc2, "24153c538a37db56682f456e69ca57f14197d201e32ea4553fc5aec73db1a47d474f45a628b3de2277f593f0644f1af54b57b755ea6c1a48b02c24c7787c384938c896bbc6ffd34586ad2c23f69b504a70e936d4258a42913b272602f4c80a8d9c6ca871dc94c01ba809351e601e0865816da9512efe829bd5065556c3afeb1dfca1c10fd96239f91d6530494ae55984b02bed2c2b6c0950dd4cef06e9ebd84e62a2dcc022acf7fbb592530a19714ac434be7d12579c6ed3989331d6010b26c5d645"}, 0xcc, 0x1) [ 731.095898] binder: 23233:23235 unknown command 1409286142 [ 731.102902] binder: 23233:23235 ioctl c0306201 20008fd0 returned -22 19:30:07 executing program 1: r0 = gettid() getpriority(0x3, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r1 = socket$inet6(0xa, 0x1, 0x2) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000180)={0x39e0, 0x20, 0x10001, 0x1000, 0xa, 0x1f, 0x9, 0x7, 0x1000, 0x3, 0x20, 0x401}) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f}}, 0x20) fcntl$setown(r1, 0x8, r0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f00000000c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000000), 0x4, {0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, [], 0xf}, 0x200}, r3}}, 0x38) openat$vfio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vfio/vfio\x00', 0x200, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) io_setup(0x9, &(0x7f00000001c0)=0x0) io_cancel(r4, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x2, 0xffffffff00000000, r1, &(0x7f0000000200)="5a1f0b77845b3813d779f3699865c5f4e5b7f60c66a4e379f2f4e0c4a874b3a6d9f22d88c9fb25b4ff7104c7b61898006b4410fa7acfaa24db5564e5f01651828d7c28c83f914b3407e023d730028c4fe62194b71e21814b1fb1a09a8be56b58c30d1abfdd9c8031f857dc18a7b07ebf2de776f80bad6d8c1d8021e789e4c18a61011ef8e1372fd95361b383aa4f689d4d399d4026572740d6a3aac9e32ce466fd4ffb3357f647f01c9e587751ce20608eaba3325287e3b41225407819a0ae96c6a8789d67f6f4d7d9b3f8f7059d4218a48788466f715fc56852e21d183e389eb3e3a6", 0xe3, 0x8, 0x0, 0x3, r2}, &(0x7f0000000340)) tkill(r0, 0x15) [ 731.188370] binder: 23233:23235 tried to acquire reference to desc 0, got 1 instead [ 731.238170] binder: 23233:23244 unknown command 1409286142 [ 731.244100] binder: 23233:23244 ioctl c0306201 20008fd0 returned -22 19:30:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:07 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80200, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x552020}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x1ec, r3, 0x600, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x40, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2ed}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x100000001}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA={0x98, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x428d6aa4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd16}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x44, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xa304}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x7c, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x0, @mcast2, 0x100000001}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x8, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xba92}}}}]}, @TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x20000000000}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x43}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9c30}]}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r0, 0x0) 19:30:07 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = accept4(r0, &(0x7f0000000000)=@ethernet={0x0, @local}, &(0x7f00000000c0)=0x80, 0x80000) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x3c, &(0x7f0000000100)=[@in6={0xa, 0x4e20, 0x3, @remote, 0x80000001}, @in={0x2, 0x4e20, @multicast1}, @in={0x2, 0x4e23, @remote}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f00000001c0)={r2, 0x8000}, 0x8) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0500044000000020"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = accept(r2, &(0x7f0000000080)=@ax25={{0x3, @rose}, [@null, @bcast, @null, @netrom, @netrom, @null, @bcast, @netrom]}, &(0x7f0000000000)=0x80) setsockopt$inet_mreqsrc(r4, 0x0, 0x0, &(0x7f0000000100)={@broadcast, @rand_addr=0x4, @rand_addr=0x4}, 0xc) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) close(r0) recvfrom$unix(r3, &(0x7f0000000200)=""/102, 0x66, 0x40000020, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0e630c40000000002c12e00cae22065b4057d9b3a901c06022daa7718d08f1fe392d54863b19aafb439a4e20b6a38c858e0a471a14af04625c079b33c1091cab19ec"], 0x2ae, 0x0, 0x0}) 19:30:07 executing program 4: socketpair$unix(0x1, 0x80000000000001, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) [ 731.686014] binder: 23260:23269 unknown command 1074003973 [ 731.691799] binder: 23260:23269 ioctl c0306201 20012000 returned -22 19:30:07 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_mr_cache\x00') setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000040)=[@in6={0xa, 0x4e22, 0x8000, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1}, @in={0x2, 0x4e23, @multicast1}, @in6={0xa, 0x4e24, 0x9, @rand_addr="e61e3c68f2970725862bc7033d9ea8c5", 0x5}, @in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e21}, @in={0x2, 0x4e23, @broadcast}], 0x88) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000140)={0x0, 0x3, 0x200, 0xffffffff, 0xd, 0x101, 0xdf, 0x5, 0xd8b, 0x80000001, 0x1000, 0x6}) r1 = gettid() r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) sendfile(r4, r3, 0x0, 0xffffffffffff8001) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x15) fcntl$getown(r2, 0x9) 19:30:07 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x42440, 0x4a) epoll_pwait(r1, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x0, &(0x7f0000000180)={0x400}, 0x8) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x20042, 0x0) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x4, 0x0, 0xffffffff, 0x4, 0x100, 0x8, 0xfffffffffffffffd}, 0x1c) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) ioctl$NBD_CLEAR_SOCK(r2, 0xab04) 19:30:07 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x408000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x40, 0x0) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x80082, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x400a00, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000180)) [ 731.782927] binder: 23264:23273 ioctl c0306201 20008fd0 returned -14 [ 731.790601] binder: 23260:23269 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 731.798100] binder: 23260:23269 ioctl c0306201 20008fd0 returned -14 [ 731.921109] binder: 23260:23272 unknown command 1074003973 [ 731.927381] binder: 23260:23272 ioctl c0306201 20012000 returned -22 19:30:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6, 0x400000) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000040)=@fragment={0xff, 0x0, 0x9, 0x800, 0x0, 0x1, 0x68}, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:08 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) lsetxattr$security_smack_transmute(&(0x7f0000000200)='./bus\x00', &(0x7f0000000240)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000280)='TRUE', 0x4, 0x2) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000080)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000180)=0xe8) lsetxattr$security_capability(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f00000001c0)=@v3={0x3000000, [{0x158, 0x100000001}, {0x1, 0x100}], r3}, 0x18, 0x1) tkill(r0, 0x15) [ 732.014220] binder: 23260:23272 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 732.021548] binder: 23260:23272 ioctl c0306201 20008fd0 returned -14 19:30:08 executing program 4: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630cba2da84100"], 0x2ae, 0x0, 0x0}) [ 732.433755] binder: 23301:23302 unknown command -1173593330 [ 732.439833] binder: 23301:23302 ioctl c0306201 20008fd0 returned -22 19:30:08 executing program 2: socket$isdn_base(0x22, 0x3, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = creat(&(0x7f0000000000)='./file0\x00', 0x120) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$KVM_TRANSLATE(r4, 0xc018ae85, &(0x7f0000000040)={0x4000, 0xf002, 0x9, 0xffffffffffffff00, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:08 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) mmap$xdp(&(0x7f0000ff9000/0x7000)=nil, 0x7000, 0x1000001, 0x113, r0, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:08 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x30400, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r2, 0x7709, 0x0) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) getsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f00000000c0)=""/109, &(0x7f0000000040)=0x6d) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r5 = shmget(0x2, 0x3000, 0x106, &(0x7f0000ffc000/0x3000)=nil) shmctl$IPC_INFO(r5, 0x3, &(0x7f0000000140)=""/80) 19:30:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="4825efea7a95bc919a4eb4b611e4590563044000000000387440c0d7411c7a50edd5fa57dfefe6afc3a818bcfca64a9b7d802df0328b505dd536b78baed7a0cee8cd76bf7c0b7670d40e480ba05b9c4bb173cd4f006c32be0c09cbf331e11eac797a814e829d962f80bb3bc74cd547df6ccf64a2957ee3e4e5782c3a39300dda8e22c3831216c1eb297051914da5d4e3a35aae937e09152ddfa0e8cc70f7092ebd55"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000005c0)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@dev, @in6=@loopback}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in6=@local}}, &(0x7f0000000700)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000740), &(0x7f0000000780)=0xc) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000007c0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000800)={{{@in=@remote, @in=@empty}}, {{@in6=@local}, 0x0, @in6=@empty}}, &(0x7f0000000900)=0xe8) getgid() ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000940)) getuid() getresgid(&(0x7f0000000980), &(0x7f00000009c0), &(0x7f0000000a00)) gettid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000f00)={{{@in6=@mcast2, @in=@empty}}, {{@in=@initdev}, 0x0, @in=@local}}, &(0x7f0000005040)=0xe8) getgroups(0x7, &(0x7f0000005080)=[0x0, 0xee00, 0xee01, 0xee00, 0xee00, 0xffffffffffffffff, 0x0]) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000050c0)={{{@in=@remote, @in=@loopback}}, {{@in=@broadcast}, 0x0, @in=@loopback}}, &(0x7f00000051c0)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000005200), &(0x7f0000005240)=0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000052c0)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0xd, &(0x7f0000005280)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) geteuid() lstat(&(0x7f0000005300)='./file0\x00', &(0x7f0000005340)) fcntl$getownex(r0, 0x10, &(0x7f00000053c0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000005400)={{{@in6=@initdev, @in6=@empty}}, {{@in=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000005500)=0xe8) getgroups(0x8, &(0x7f0000005540)=[0xee01, 0x0, 0x0, 0xee01, 0xee00, 0xee01, 0x0, 0xffffffffffffffff]) getpgrp(0x0) fstat(r1, &(0x7f0000005580)) getgroups(0x7, &(0x7f0000005600)=[0xee01, 0xee01, 0xee00, 0xee00, 0x0, 0xee01, 0xee00]) fcntl$getownex(r1, 0x10, &(0x7f0000007480)) [ 732.799505] binder: 23318:23323 Acquire 1 refcount change on invalid ref 0 ret -22 [ 732.823181] binder: 23322:23326 unknown command -353426104 [ 732.828967] binder: 23322:23326 ioctl c0306201 20012000 returned -22 19:30:08 executing program 5: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000340)={{{@in=@loopback, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@initdev}}, &(0x7f0000000440)=0xe8) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480)='/dev/zero\x00', 0x0, 0x0) bind$xdp(r0, &(0x7f00000004c0)={0x2c, 0x6, r1, 0x24, r2}, 0x10) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r3, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:08 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x401, 0x80) r3 = shmat(0xffffffffffffffff, &(0x7f0000011000/0x2000)=nil, 0x2000) shmdt(r3) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000480)={'team0\x00', 0x0}) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f00000004c0)={@loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, r4}, 0xc) ioctl$TIOCSTI(r2, 0x5412, 0x5) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000080)={'vcan0\x00', {0x2, 0x4e22, @broadcast}}) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) dup3(r5, r0, 0x0) write$FUSE_NOTIFY_POLL(r5, &(0x7f0000000040)={0x18, 0x1, 0x0, {0x7}}, 0x18) [ 732.933864] binder: BINDER_SET_CONTEXT_MGR already set [ 732.939338] binder: 23322:23326 ioctl 40046207 0 returned -16 [ 732.951294] binder: 23318:23329 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 732.958744] binder: 23318:23329 ioctl c0306201 20008fd0 returned -14 [ 732.984262] binder: 23322:23330 unknown command -353426104 [ 732.990182] binder: 23322:23330 ioctl c0306201 20012000 returned -22 19:30:09 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) prctl$PR_GET_TIMERSLACK(0x1e) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)=0x0) timer_settime(r3, 0xffffffffffffffff, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:09 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) signalfd4(r0, &(0x7f0000000000)={0x6}, 0x8, 0x80800) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x10}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:09 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1000006, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r2, 0x89f5, &(0x7f00000000c0)={'sit0\x00', @ifru_data=&(0x7f0000000180)="3b5ebbb901391860c2a6aeebdbf6afb10abb4a8112653b32394bb6eb5c81bbf2"}) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:30:09 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f00000000c0)={0x0, @aes256, 0x5, "54fac7ec474af75a"}) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f0000000000)={{0x2, 0x4e22, @multicast2}, {0x1}, 0x42, {0x2, 0x4e20, @multicast2}, 'syzkaller0\x00'}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000080)=0x8020) dup3(r2, r0, 0x0) 19:30:09 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = inotify_init() close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x6) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1c) 19:30:09 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(0xffffffffffffffff) recvfrom$unix(r1, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:09 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040), 0xffffffffffffffdc) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) bind$can_raw(r0, &(0x7f0000000000), 0x10) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x240802, 0x0) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000100)=0x7) 19:30:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x20, &(0x7f0000000380)='!ppp0mime_typeppp0prockeyring\'-\x00', 0xffffffffffffffff}, 0x30) sched_setscheduler(r1, 0x1, &(0x7f0000000400)=0x10001) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440)='/dev/zero\x00', 0x4000, 0x0) ioctl$KDSKBSENT(r4, 0x4b49, &(0x7f0000000540)="898bcae608256114e28d58193b167465e3990811a70f349e4f153b8363cb4e9533bb8bf3295e055ba5201aa21220e12c42684b2282376133ae809fc1d437f2682bfb71124fea5afa3751b8e0d55d0bae6430423af7d79ea8eef446db6084d920d500b88979331f09e746bb024bc0fce5eb05b790ed2e340abba10abcfaf778e47c997ac53b29f9b31cd53243f94f3486aeb9ed42f2b7196b1984edae905516d95d5552c7e30c2c681fb78864eb2fc0d3f2dd65068a576b09672a7d84413e4caa3b276be7c64ceccaca32b33cf01129676575d0093850086cafb59167ef03f02a31a7b23d238b4695fe54fdb9a6ef8513ee8a148fcc27") ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f00000000c0)={0x0, 0xf9, "d053abbd5a0e1e3dba817caeebb1bda3290e0a4fec1f8fde208eb938313ea035c28aae31325d724bc1bdb7372fc4bc8db0ddb9edb15eb87c33b9e568ff8b514d1ca091b84246197c4410a8552ad2b5beca0010ffe73fe3c538d02c85d1441264482ed3291bff476bafea88abe76c123c51cc735edd064c7ee14cecc506cca8fcde1ab4fdbaeed9800a8d7270b9fb9ad0bd47a25baf722b138ed16e7254c02bad480321e6e557ab2a4150971905eed53384b1855f7f6dccf62e7bd8459536da473617ea65cf186a633064b265ac015b4a819b380b7383331e02e9c0e9310e922e43173ae7e4072f0dcf36afb413ed3879bd47fda4fb3044aaee"}, &(0x7f0000000200)=0x101) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x84, 0x1b, &(0x7f0000000240)={r6, 0xe0, "ef04378f0aa0c86029329bd58a19ae234c3cb7a364da6305c3bab43292c56a794492579bc3a2dd56022d96e38429921478f83b6dd31e546164417505bb5526bd754f4ad65f09e1c1bf4d99f3f220a628ac4fc7f655c5d20d05adc9a6d34baf750b5690b6854ad3d84ddbe35917b91b59028f2e31a32aad3b196f8583c0a7daeb6044682173d37a6859cdfea4103493b799291a70937eb5cb6fc1a7e798046154fcd60aacfa103901b660a999b557b5a1b88d0370cf33343f420903ba47d0ac59dd32203a3178108cde7405db1e0560c023d96eafed74d2f971d2d894199e6f6f"}, &(0x7f0000000340)=0xe8) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f0000000000)=0x100000) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:09 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x2, 0x100) ioctl$VIDIOC_G_OUTPUT(r1, 0x8004562e, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f00000000c0)={0x3, 0x80000001}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000080)) dup3(r3, r0, 0x0) 19:30:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x100, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) r4 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x400, 0x400802) ioctl$VIDIOC_STREAMOFF(r4, 0x40045613, &(0x7f0000000100)=0xf91) r5 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x150, 0xffffffffffffff9c, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f00000000c0)={r5}) 19:30:09 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x600000, 0x8a) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000040)={0x8, 0x0, 0x9, 0x2, 0x2}, 0x14) 19:30:09 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) getgid() mq_open(&(0x7f0000000000)='\x00', 0x40, 0x40, &(0x7f0000000040)={0xce50, 0xa000000000000000, 0x1, 0x8001, 0x1ff, 0x1, 0x7, 0x35}) tkill(r0, 0x15) 19:30:10 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) ioctl$int_in(r0, 0x5473, &(0x7f0000000000)=0x81) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:10 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040), 0x4) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) sendmsg$SEG6_CMD_SET_TUNSRC(r1, 0xffffffffffffffff, 0x10) ppoll(&(0x7f0000000080)=[{r1, 0x8006}], 0x1, 0x0, 0x0, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', r1}, 0x10) 19:30:12 executing program 3: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000980), 0x0, 0x0, 0xfffffffffffffe03}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bpq0\x00', 0x21}) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='ns\x00') getdents(r0, &(0x7f0000000040)=""/46, 0x2e) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) io_setup(0x208000, &(0x7f0000000180)) 19:30:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x100, 0x0) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f00000000c0)=""/86) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:12 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0xfffffffffffffffe) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:12 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x3510c0, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x2, 0x1, &(0x7f0000000040)=""/146, &(0x7f0000000140)=""/86, &(0x7f00000001c0)=""/155, 0xf000}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f00000002c0)={0x7fff, 0xb8a6, 0x800, 0x0, 0x1, 0x6}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x2) dup3(r3, r0, 0x0) 19:30:12 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(0xffffffffffffffff) recvfrom$unix(r1, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:12 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0xfcad) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:12 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0xc8000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x100000001, 0x10}, &(0x7f00000000c0)=0xc) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000100)={0x2440, 0x200, 0x10000, 0x7, r2}, 0x10) 19:30:12 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) fstat(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000080)) setfsgid(r3) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x200, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x100000001, 0x8002) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:12 executing program 2: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x10000, 0x121400) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x0}]}) ioctl$DRM_IOCTL_DMA(r0, 0xc0406429, &(0x7f0000000200)={r1, 0x1, &(0x7f00000000c0)=[0x9b5b], &(0x7f0000000140)=[0x4, 0x4, 0x2, 0x20, 0xe000000, 0xfffffffffffffff9, 0x9, 0x100], 0x1, 0x2, 0x4, &(0x7f0000000180)=[0x40, 0x7fff], &(0x7f00000001c0)=[0x2, 0x20, 0x401, 0x7, 0xc00]}) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r2, 0x0) 19:30:12 executing program 3: set_mempolicy(0x8001, &(0x7f0000000080)=0x100003, 0x4) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-avx2\x00'}, 0x58) 19:30:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x0, 0x0) accept$inet(r4, &(0x7f0000000040), &(0x7f00000000c0)=0x10) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:13 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0x2040) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205647, &(0x7f00000000c0)={0xf000000, 0x6, 0x7, [], &(0x7f0000000040)={0x0, 0x80000000, [], @value=0x7}}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000100)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000140)=0x28) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000001c0)={r2, 0x38, &(0x7f0000000180)=[@in6={0xa, 0x4e22, 0x7, @local, 0x200}, @in6={0xa, 0x4e24, 0x9, @mcast2, 0x5}]}, &(0x7f0000000200)=0x10) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) 19:30:13 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) socket$inet6(0xa, 0x3, 0x900000) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r2, 0x40505331, &(0x7f0000000000)={{0x711b8f77, 0xd08}, {0x40, 0xfc}, 0x8, 0x7, 0x2}) 19:30:13 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f0000000080)={0xc4, 0x5, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x10800, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:30:13 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) close(0xffffffffffffffff) recvfrom$unix(r1, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:13 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x44080, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0x5101, &(0x7f0000000040)) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x2, 0x4) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x83, 0x80000) epoll_pwait(r1, &(0x7f0000000040)=[{}], 0x1, 0x0, &(0x7f00000000c0)={0x100000001}, 0x8) 19:30:13 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r3, 0x0, 0x0, 0x1) pread64(r3, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = add_key(&(0x7f0000000040)='rxrpc\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="225f4541820d73dd9f08222b33d39675770d9332974479702f58d81c72c0ef73b0d1ddbd3e1c1ea5203f49f54d4e2f0d6fc166495c3bcd4c4a67137655ae193a2c2e27be90cdb8a1d258d88421c2abc8f689c1067945e08ebe61eea89ba4e62c7c93a795549c022e48b71b0ab777e245bc1d3636fd858feb80ada0b6850812f9b55b3aa197e90c3932fb8c823b704f39e7001e3b8f63da9a2e4dbafce3ced34e6c716cbb8706511a165745031984e58f8be0ba7aa48c9c3e9296c7169b8987326a62999de90fe31fcf1f8436277046ce9a18ec", 0xd3, 0xfffffffffffffffe) keyctl$set_timeout(0xf, r1, 0x80c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x0, 0x0, @loopback}}}, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:13 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:13 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x101100, 0x0) dup3(r2, r1, 0x80000) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm_plock\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x40000400200) r5 = dup3(r2, r0, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r5, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r6, 0x8, 0x70bd26, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x800) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000200)={0xf5d3, 0x1, 0x4, 0x5, 0x3f7}, 0xc) 19:30:14 executing program 5: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x80000, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f00000000c0)={r0, 0x9, 0x5, "ea6230dd9872aaaf3244a9906ee4a76a4873040bf0f76f40f98bff68a8e38edfc59216f9a0eebe5625855b9a91617376a2a82464ccac77d61fc245c65bb7a590c610d9b6715bb64183c1f985724004d175fa9ef8480284ba6cdf9e79aca1be1e7d48be254709d00a00609a64ecd9a65d004a93c8aec86893422fc7252fd9b043b835cfcf5859efc40c0879cf3b4602c58a51dc134969682a81d182f5d58451f0781f62cdc71ff323725b767b5f025dd296ba5fa8360f04263491c019c461a8ccc1a4681d3634b3177a2eb9eaa6a7af002e2d2f7bf1685e901db33f55106a8933e66f47fcca731ac95f4b4bf07e09bf79f504a6cfa796eba7c3849f95670505e60e46c1adeb267eeaa3fe8a97c995827e5e95e358d47bc78cc29b1d25f8bb4d87767dbe1fcad0b1b2aea11533e336220571e54e2798b0e9bccdfd0994cbc252dc7fe94ecc2947cdb1b9774b3768445e258435dbb276f031cc07a73c86047df25d06cd68ab33de99b9d30e020b7dbd0b7e40df4dd9f8c33f77ea047242d4fd471323785b32500943b170b302272730bf8def8be2ff9da5866859090ab4b8326b7d04963872440dd594952ab1dcea6dd10021455d5c7e7d6f2afd69b8e84c00378c26ff4da09dd8ef999f5527e14467b2fe04bd409cc1d480d3a42762bed644624f8f9e2fb0349bd754692bafaabc16e6c980fedf2a9189ecbe010ca059f8aa5bdafa1a9570cd15111456c669830677f7c10ab3a34d21fe94133766fe47d6ed21efbf7c9a3eb01775b8bb8bb5a616fa203ef8f5a1ccf518a187f5be70a56b6aacf03642f0387b5324c5186aef3fd0d6ec8469eeada0066f1ab3ec6fa25b9ebf4b4888b4137424219f6310b038aa6aace73ad00ad859a2a31e9245d376abef0c9dd01157d8edc7b61965fd459f03a34873e9bb47dc28dec7df6373b57a5ddeccc0859ec942545b54e60a2a528e7df5bd04e078a38e8074c8c7417433a35e7da98b4f48df6aa5654f88708b98cea5c2f25e37d6bac7fc68056b32c8667a56bbf5ab6b34d38d98f6b1998cdc1ef69d04d80aeda16bb278199dc65925ec20842e0e065ee9e3cca74984ad5e197888ff5c567cf19559c3cb80d13b45a517df2de5ae43b96572d0d982d4160e42f150a4ee85ed4f1ceff78ba60ea7926cfbe1c611a02d06ad40f26b3f10e201d340afefae2ae4a1f5dc1198ce66fbe749b8005745d5bcfbca2a9c99c78559bdb176066cf1213da9dd6b0de7efebae62ff2ed63066b8345eb88e2aa32a5355cc345a065ae112110eb6607f719eb172e66206d96bc5f625f2d30914066fab7998dabfece3a23cf245ba797bb9448c20eeb167d993fae71b0aaee14ec25e0d829b4f773f211c8927cc2e95b86368a4c77275fddba3a20a0681b032ec1805acb7dbe6ca8da1877a829bf617d32a3e7c1af295e6d3afd06f560e83d9ddf686ee315b84d7c90bf2000e27a4463f4a24b9afabc8d160d50094e2a3f1e2f960a46f6adb9accf8249597ad4776a60f92ad02a8bb35a4af27e951d57ded4c9f2c277d6311bd1ba59edcf769ae058d6a83f52bcfe30e739aa7990a05debb8b4cdfade07b52adb33b06ce3d96c6ae6e78bd975b989123afbddc591210fd2677a9befe64a369edb4d5ed2b86f72d54595b20bbcbdb4b8ba4ff72c58d024751a798fac4c2768b515246aa42b27a8ee181aa1a75895f65077d1b8ba2ed847afaceeda0dae4f0319fea124340e222eb15873af0667ca0c76fc6222e2eb95a392407838019820ac4b814017eec16f4c2c98d5acadfe40f2a9160286c6e48002064396b2f7e258645442464c86dd450ceb2125a52bf4e30a68e283547b47d5056070eeba599ad293a44977622c85eccb95db9de62660fa233421423b3194003e11b043e0544478f84d92c41b3fff43f77e8a0c4b9c9edd789fdde9fd4ace3565392d134b307a28ae85b9773f7fd15fc9a387f56cdb0e92520698de020b511f6fc397f47fa92ae6adb827454ac6247612dec1e0350cda6f71065ce7be68d598ca46d47c59a319ecdae8b3a93ae9ca92ff823633f6761c0a9c04452a98c7ffead45b97d1b72a0cf4610dc0ee90caddf9762e607b5dd8c8846ef60761b78fc7441da7a3f2a6544bb49d521762004403fc81199a47821318c696cca9280c7741109c7ccdd93ca76587deaea7e43caa8608dbb9ae0f3b0bc9f1338ac1db85eb088deffaf00d5b96041e97f1dce4a51d0dc4a7eecbf71544a60209e381f3a192ccee07cec4ad1e40e1deb88fed0b6ab2e9cdcfaf8ee2e7d825e39256bacdb11235503c251c6964aa7fb485b60c7e991d4ba0bfa99d11b596db64e53babb6c738be0b8ed7d32dffb3d1bc4c0ed62b275b862586da24912f5fd3a69a07f319b3efe37c44f798c4a2ace30b7b52b0a6d58ddf7079232d7cabbc60081db2226e22db8a288eb837042ec47dc1257737f5977c916c55cb3313bb3cd39616ac09aea431fbdddbdda90c6b44230f234a4356346fef3a19534d65fe6311f07d57921e8e592438619b8329e3de4a818bbbf113cc27aefa0ea4976f80954d5be8567050ae5b82dda87898880ce94acd0b223be61f840d274f386eaf13b35010959453ffc780b2a156f8670408bd75425d9b33a9e262f2090a90a4715b1c91e477de8263c24f32ebc4033631dada208a37d4acf7548e67424b5d4ab185699d8a1d783950e9e0f251112088577b50696f192ea31de34d1579916a65c94450bdf4f07d41016cbb6bb437372e14e563c8dbe42ccc0e59b333daeadef3e451318a5b9b594cade193b344a9963668bd25e51e9dd72951ddf42b43dc06ada3ef3d56cfd7ce5549f0e89c013ffdcfa2ccd613814e3de15464c8a81ebc9dbdde0935a394057031f1bf09f8b980fdcf9709184fecd930f0dd0858fc13baa7cf79900fd8d685c0d689dbcc12834596864e898d99be69a935111b7c55090c18f3e650c57db9c30283e365d6d81adef33b04f35f77fd62bcf66443cb7d33baf13ff91711840c1f06b3301133839e85c879d118c09470831fc2cf1e58481e956202713d94db5414f9b022d25d1c573d3b5a96478978258bea6cde7de7a5aa3fed27ad9c116273529b1254b0b03b2d485617741a362f7674ed78bbc446792b53b62a15ed1b475b22aefa8d209f0360000738689ed0e6000197c7d5bb3d4472ee46b7fc0f889aca4a399de08a8bffba1baf349d57b0f9a2cebde97ca5870e12eb548eeef2907cad89315795445844ed064562608aec311ee6b627077f9e8a71dcae7a7b5379106d9f0b9f13a882717acbe1bbee4e0dd10e4dcdc66e067d38685e78ba317b6d13a05a7347e943175a20e6a5155f2a73c491041668c8435510f17e1c592978154fe54504db74bd67f3dedf4e1b13c751a31fb8001a8f67c02d82331d37fa66662c8cd70370712aa135f0872dea1f5a8861e68640efdfa6ef845b8f9bea6e59a79a1db9efea245f30990c92a6e1206b0153b00e863504b7a2b945bdecc76280ac1aa74507514b0af7224d3e99e804e01d958f3fdf964f1b97d15ebd4ab8bdc22c5b03883af8a1c6bd8e65a3769e235c68f7b3f8fd57713da0059124717888fe05b5ea101fcf4628113b355a09797442cb7c60da454fa14878233fbc0a39b3920537cc78235418ab32d33418131737a13897be34c85d7d17d3d64d8179959b2ba4ddb8cc9307c746927e68561e1b77078efe61de4bc7bcb1eb2606cea4831e84ce07ca11361817c24c0e91ef4db36241b7f2291645d1d3cda98bbe869eb7ab23a03838e09e99f65b7a536328b95bc188002486261c149bed7faa32198b144ae4c84234f91a2445a68f0a634ecaa0edbdc1a50ccab0442dffcc6443fdc2900841ef1d62b6c1c656384b414f1e37cde023251cadc717d66fa34305b7af410b15a9cb61ba88fff278ac27ef1e9a07e100474a51d6ede51976996c57ce52db243a44ceec4a4f0b42082168cd5df73bf582bf2d7c3ac798db838ca14c9eeb841f568f9a16af0fc4c270405bd82336f472c8848815496430091f45ffb5c17ad00f16c04bf2e1e7c2a8e809179de1fcb616ed5c1557ac66b61fbd4e44b559cce50d1e17842c779325d10c04f6d82c5c21051e0ac5ecfe80384d97b65cbddb4069c906db52159124b5698a564f2457a0328d05b8f4ae85f6a6fc906393d2a1dbd2fac73eaba08ef96df557a347a080e72eda3ebea959464b51d277aac770887f97f418f30da6ea019624f195f3ab338218e66769e50ed562d1412e2655cd745c462234564fa1e3b13788f100d9439ce5996055ae1ba1f80b68cfa96830737eaa74763ab7e1681bb6d81968a72268ea7533fb8f4b987eead0841009baeaae8b3aceae862ed9d4c13218d3d67abeee7b38d3990f742519567ea613ee0811aa857dffb244e4df8bad846ce1cfccd465593818f36b7fb7ffebdf3f43d6980eb8c263753f04f301ff67cc260c37ce898a1f6336695fd983e506ccd2d729843836943685e4972342826521d440f8ca9980d5fe57916a3f73005a598222716e2c9ca5c135cda8aa96ad7b290e7e4332d20c38cff759f2462d0d7ecac12aa742c94e7f257a4d6f0cc6737a8c6379a4b3a9595fc622fa35d0e526cd2fe369f2ab11a221d249b40a17a22def640cc7ac9879c8e63da817ba347ad5d7ffc5c37670bb1b5d17f9d4452de0409b123fbe76287293c2395b52340c5cee32cbfaf609350b7666ad054c4d7e690b35bc96ea4844fc29bcb308bed1ab4b879bd90888772980769dcc33f942cae5ef9246712ec005e720349d6ef0099f36b679929dd37b3c14a2b8246c53482a6c024ef72137654f656ca00e6907fe326f3cc700a7a998e90b2875a3829ce8f9f032f4cb9f4317755c5b6d88a94e792f389bf6a53af396e8705b0ba60d6e51a63254f82d026a2b990c1e896bd81329be0243143138bbbc97f83bc92dcd15617672a490a4abdd2fae1af5aaa02a985824f9c4f3b2d9fb2ff1718499c98f39d597f6864b82896dc031cf6942646f4f7d0ec628149660ad3b307b1b94c9287f4655d4f9df45e52d76be114c028bf22892fe87269bece4a7593da8fb135a2d644531b336ffc8e0fc8c0ce04ef87f937ca6327d3e7e170db5009e126075f2e53d05215d2f38d361f999507d1d5c272c99975e6cddeb0b161a87008955daa913a9a7eaf7426d41ac067aada50f17fc2febaed0a956e2c3073af24fedf0a76eacef36d807307eefe47e2447d78651493c82111e0356a19aef7d4b392fe1d95d3aee3358bad61053870ac07b4dd99314a968ee19a62e343760e9023a41de820eaaed162bbd6a1f3a3d707a462217af0f872cfef56b7961737bc55157d4bf3c2084c1bb9ab75ef6d803c2c5b9824772e15af979489840dfcdb50adbfcde752a883217fa13bc31412304b3d00d3ca3db9c131ac5736353b490609c60400c90617cc951355961f1b2ff56996af29708b1365453453a687066d332e3a7adbf122142339d9458506ca27aeeaa5d7a57089e2e1aaf617ff7252f0ea6d86a446bda35460b61b787aef7e01ab98c42f9944b8f260b57a5f4d92a0e6847b54b86140bbc2d386d6a07ebef0379bd5f8fee799ab3a02d7e8a725fa31977686b97a4be654295428f5cf6fda59d12b9bf733259648f385d348d6a0f2468be270246e51df5fdff77e1934a2be525557ec62867a6f1dceb06991f8558747ab6e3c659857e97bb21ac6016ef285044f0c6934abdb33237d57f0df0e426adf421db9abb46148ded705facafabad906de237e0a3e81b57d102a"}) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000000)=0x2, 0x3ac) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000001100)={0x0, @in={{0x2, 0x4e21, @loopback}}, 0x1, 0xe1, 0x1, 0x4, 0xeaca}, &(0x7f00000011c0)=0x98) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000001200)={r2, @in6={{0xa, 0x4e21, 0x7fff, @mcast2, 0xffffffffffffffff}}, [0x6, 0x1, 0x7f, 0xff, 0x2d4, 0x7fffffff, 0x2, 0x77, 0x200, 0x80, 0x4e7, 0xcedd, 0x6, 0x2]}, &(0x7f0000001300)=0x100) ppoll(&(0x7f0000000080)=[{r0, 0x8006}], 0x1, 0x0, 0x0, 0x0) prctl$PR_GET_TIMERSLACK(0x1e) 19:30:14 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0xffffffffffffffff, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:14 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x2000, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f0000000180)={0x4000}) sendmsg$TIPC_NL_MON_SET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8200018c}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="80000000", @ANYRES16=r3, @ANYBLOB="100026bd7000fcdbdf25110000006c0005001c0002000800030000020000080001000e000000080001001a000000080001006574680044000200080002000000000008000400fcec000008000400000200000800030004000000080004000800000008000100030000000800010002000000080004000080000020000200080002000500000004000400080002002000000008000100000000804c0105005400020008000300810000000800020006000000080001000800000008000400890e00000800020001000000080003008023000008000400811a0000080004000900000008000100170000000800010008000000140002000800040004000000080004008100000008000100696200003c000200080002008537467108000400183b00000800040005000000080004000400000008000400000100000800030001000000080003000200000034000200080002000900000008000200070000000800030006000000080003002a00000008000300ff01000008000300857000000800010075647000080001006574680008000100696200001c0002000800030001000000080004007f000000080004000000000034000200080002000200000008000200040000000800040001000000080003000104000008000300ff0f00000800030004000000"], 0x1ec}, 0x1, 0x0, 0x0, 0x4000004}, 0x1) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write$FUSE_BMAP(r2, &(0x7f00000001c0)={0x18, 0x0, 0x4, {0x2}}, 0x18) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:14 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000040)=[@in6={0xa, 0x4e21, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @in6={0xa, 0x4e23, 0x803, @mcast1, 0x2d6}, @in6={0xa, 0x4e23, 0xfffffffffffffffa, @dev={0xfe, 0x80, [], 0x17}, 0x7fff}], 0x54) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:30:14 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:14 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_ACCESS_COUNT(r0, 0x227d, &(0x7f0000000240)) 19:30:14 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:14 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x8000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:14 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r3, 0x0, 0x0, 0x1) pread64(r3, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:14 executing program 5: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x5c63, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x20802, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2002, 0x10011, r1, 0x0) creat(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x4000000) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 19:30:15 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x0, 0x800) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={r2, 0x7, 0x1, 0xffffffffffff541a, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}, 0x20) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:30:15 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) syz_execute_func(&(0x7f00000001c0)="410f01f964ff0941c3c4e2c99758423e46d8731266420fe2e33e0f1110c442019dcc6f") clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000002c0)={@remote, 0x0, 0x2}, 0x20) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, 0x0, 0x0) 19:30:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xfffffffffffffffc, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x2000, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r1, 0xc0106418, &(0x7f00000000c0)={0xe8, 0x7, 0x4, 0x7fffffff, 0xa, 0x20}) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) socket$vsock_stream(0x28, 0x1, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(0xffffffffffffffff, 0xae44, 0x1) 19:30:17 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffff9c, 0x0, 0x1, &(0x7f0000000080)='\x00', 0xffffffffffffffff}, 0x30) ioctl$TIOCSPGRP(r4, 0x5410, &(0x7f0000000140)=r5) dup3(r2, r0, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @local}, 0xc) 19:30:17 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x7ffffffd) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:17 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:17 executing program 4: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0xd8000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:17 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r3, 0x0, 0x0, 0x1) pread64(r3, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:17 executing program 5: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/11, 0x485) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) ioctl$TIOCLINUX6(0xffffffffffffffff, 0x541c, 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = creat(&(0x7f0000000180)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) r2 = dup2(r0, r1) execve(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK/file0\x00', 0x0, 0x0) ioctl$EVIOCSABS0(r2, 0x401845c0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0x0) 19:30:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f00000000c0)={0x5, &(0x7f0000000040)=[{0x0}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_UNLOCK(r2, 0x4008642b, &(0x7f0000000100)={r3}) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4068aea3, &(0x7f00000004c0)={0xa3, 0x0, [0x70a000]}) 19:30:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = dup2(r0, r0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_TSS_ADDR(r2, 0xc048ae65, 0x0) 19:30:17 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) read(r0, &(0x7f0000000200)=""/233, 0xe9) r1 = semget(0x1, 0x3, 0x203) semtimedop(r1, &(0x7f0000000000)=[{0x1, 0x0, 0x1000}, {0x7, 0x7, 0x1800}, {0x3, 0xfffffffffffffe01, 0x1000}, {0x0, 0x6, 0x1800}, {0x1, 0x2, 0x1000}], 0x5, &(0x7f0000000040)={0x77359400}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) ioctl$sock_inet_SIOCGIFBRDADDR(r2, 0x8919, &(0x7f0000000080)={'syz_tun\x00', {0x2, 0x4e24, @rand_addr=0x20}}) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x39, &(0x7f0000000140)=@srh={0x0, 0x10, 0x4, 0x8, 0x80000001, 0x10, 0xffffffff7fffffff, [@ipv4={[], [], @loopback}, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @empty, @empty, @loopback, @ipv4={[], [], @empty}, @mcast1, @empty]}, 0x88) 19:30:17 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:18 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast1, 0x1000000005}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000400)=ANY=[@ANYBLOB='\x00'/112], 0x1}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000240)={@remote={0xfe, 0x80, [0x2]}, 0x8080000, 0x0, 0xff, 0x9}, 0x20) 19:30:18 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x6, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x10d, 0xb, &(0x7f0000000080)=r0, 0x4) 19:30:18 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) setsockopt$sock_int(r2, 0x1, 0x0, &(0x7f0000000000)=0x9, 0x4) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:18 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f00000001c0)='cgroup.subtree_control\x00', 0x2, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000000)='cgroup.subtree_control\x00', 0x2, 0x0) close(r1) 19:30:18 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0xfffffffffffffdfb) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/udp\x00') preadv(r0, &(0x7f00000017c0), 0x199, 0xf0ff7f) 19:30:18 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:18 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) r1 = syz_open_dev$media(&(0x7f00000000c0)='/dev/media#\x00', 0x5, 0x0) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000140)={0x9, 0x1d, 0x4, 0x20, 0x7214a1d7, 0x2, 0x5}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f00000001c0)=""/207) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000400)={0x0, 0x3c, &(0x7f00000003c0)=[@in6={0xa, 0x4e23, 0x4, @local, 0x73c}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x25}}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000480)={r2, 0x3f, 0x9, 0x7fff, 0x1f, 0x1ff}, &(0x7f00000004c0)=0x14) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000020000000000000000100000000000000030000000000000005000000000000000300000000000000"]) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f0000000380)) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f00000002c0)=0x0) capset(&(0x7f0000000300)={0x399f1336, r4}, &(0x7f0000000340)={0x1, 0x2, 0x6, 0x7, 0x7, 0x4}) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x20000, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x1000, @rand_addr="e23a50c958bef6dbecae1743091b9829", 0x5}, @in6={0xa, 0x4e20, 0x0, @loopback, 0x1}, @in6={0xa, 0x4e21, 0xa45c, @loopback, 0xfffffffffffffffc}], 0x54) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) dup3(r5, r0, 0x0) 19:30:18 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r3, 0x0, 0x0, 0x1) pread64(r3, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = dup2(r0, r0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_TSS_ADDR(r2, 0x8208ae63, 0x0) 19:30:19 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:19 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000011000/0x4000)=nil, 0x4000}) 19:30:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:19 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp\x00') ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f00000001c0)={0x1f, 0x0, 0x7ff, 0x5, 0xff, 0x7fff}) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000140)=0xc) getpgrp(r1) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @rand_addr=0x7f}, {0x2, 0x4e21, @rand_addr=0x6}, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x24}}, 0x301, 0x0, 0x0, 0x0, 0x81, &(0x7f0000000000)='ifb0\x00', 0x80, 0x9, 0x101}) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) dup(r2) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r2, 0x0) 19:30:19 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{&(0x7f00000002c0)=@in={0x2, 0x4e21, @broadcast}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000700000083079a4900320800"], 0x18}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x400000000000211, 0x0) [ 743.740766] binder: 23665:23666 Acquire 1 refcount change on invalid ref 0 ret -22 [ 743.867940] binder: 23665:23674 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 743.875409] binder: 23665:23674 ioctl c0306201 20008fd0 returned -14 19:30:20 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:20 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") writev(r0, &(0x7f0000000000)=[{&(0x7f0000000280)="3900000013001b00edc6e91f48ec5804ab0ec0480d0000004600010700000014190001c010000000000003f5480000000000ef38bf461e59d7", 0x39}], 0x1) 19:30:20 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000240)) 19:30:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2f, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="006340400000000000000000000000000000000022f1c7e6970f4ae1f266ac50000000000000000000000000000078"], 0x0, 0x0, 0x0}) [ 744.444836] binder: 23686:23687 transaction failed 29189/-22, size 0-7864320 line 2994 19:30:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:20 executing program 5: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) 19:30:20 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x1000000000004) writev(r0, &(0x7f00000a8000)=[{&(0x7f00000002c0)="580000001400192300fb4b80040d8c56286932324ba7e680129643c218fe59a2e04a03ca8164243e890000000a215a0004fbf50dfff80003a5000004000000005e0000001d30221f1000010007008a96ff1300ec6b0f536e", 0x58}], 0x1) [ 744.649453] binder: undelivered TRANSACTION_ERROR: 29189 [ 744.737814] binder: 23691:23694 Acquire 1 refcount change on invalid ref 0 ret -22 [ 744.835457] binder: 23691:23700 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 744.842979] binder: 23691:23700 ioctl c0306201 20008fd0 returned -14 19:30:22 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x1b, 0x80097e) accept4(r2, &(0x7f00000000c0)=@alg, &(0x7f0000000140)=0x80, 0x80000) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000080)) close(r1) r3 = open(&(0x7f0000000200)='./bus\x00', 0x2000, 0x0) ftruncate(r3, 0x2007fff) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000180)={0x9, 0xb, 0x5, 0x1b, 0x5, 0x6, 0x4, 0x153, 0x1}) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mISDNtimer\x00', 0x400400, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:22 executing program 2: r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x8001, 0x20000) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x14, 0x11, 0x100, {0xc0, 0x2, 0x7}}, 0x14) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x200, 0x0) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000040)={0x9, 0xbc, 0x1, 0x8000, 0x7, 0x3}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) r4 = gettid() getsockopt$inet_mreqsrc(r2, 0x0, 0x2e, &(0x7f0000000180)={@empty, @empty, @remote}, &(0x7f00000001c0)=0xc) write$cgroup_pid(r0, &(0x7f0000000140)=r4, 0x12) splice(r1, &(0x7f0000000200), r3, &(0x7f0000000240), 0x9, 0x8) close(r3) socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) dup3(r5, r1, 0x0) 19:30:22 executing program 5: r0 = socket(0x2, 0x3, 0xc) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000140)={'nas\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xcc\x03\xd7\xc2\x9a\')\xbf\x00'}, &(0x7f0000004b40)=0x54) 19:30:22 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_ACCESS_COUNT(r0, 0x1267, &(0x7f0000000240)) 19:30:22 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 746.335579] binder: 23714:23716 Acquire 1 refcount change on invalid ref 0 ret -22 19:30:22 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 746.466113] binder: 23714:23722 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 746.473464] binder: 23714:23722 ioctl c0306201 20008fd0 returned -14 19:30:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000007802008e"], 0x0, 0x0, 0x0}) 19:30:22 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) mkdir(&(0x7f0000000300)='./bus\x00', 0x148) r2 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x2, 0x2) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, &(0x7f0000000080)={0x0, @data}) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000000)=0x2, 0x4) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) r4 = pkey_alloc(0x0, 0x13) syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x20, 0x480000) pkey_free(r4) ioctl$sock_netdev_private(r2, 0x89f2, &(0x7f0000000280)="468b1a82add3f9e3715d8603b8334eba033e8fe9914f0339ded0161d59cebc28471847c05bd02ba4311cae51e757a619d3902bbe407399a3c830e8e546d854e819ff4254db14ec5af6d85037b24e58de305e2c8288ce8f3177bdbcbb0ff921ab613c") ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f0000000340)={{0x3, 0x0, 0x5, 0x0, 0x40}, 0x98ed, 0x80, 'id1\x00', 'timer0\x00', 0x0, 0x79, 0x2, 0x1, 0x5}) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000140)) tkill(r0, 0x15) epoll_pwait(r2, &(0x7f0000000180)=[{}, {}, {}, {}, {}, {}], 0x6, 0x5cc, &(0x7f0000000200)={0x7}, 0x8) 19:30:22 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r4, 0x84, 0x65, &(0x7f0000000000)=[@in6={0xa, 0x4e20, 0x85, @loopback, 0xf10}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @rand_addr=0x80000001}, @in={0x2, 0x4e20, @multicast1}], 0x4c) [ 746.677420] binder: 23727:23731 transaction failed 29189/-22, size 142-0 line 2994 19:30:22 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r1, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:22 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 746.844187] binder: undelivered TRANSACTION_ERROR: 29189 19:30:23 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:23 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) ioctl$KVM_GET_CLOCK(r4, 0x8030ae7c, &(0x7f0000000000)) 19:30:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:23 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) pread64(r3, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:23 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x44405074}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r3, 0x908, 0x70bd28, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x0, 0x2) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:23 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 747.509051] binder: 23761:23767 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 747.516709] binder: 23761:23767 ioctl c0306201 20008fd0 returned -14 19:30:23 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x2}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:23 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x1, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f00000000c0)={r1, r1, 0x7, 0x9b, &(0x7f0000000000)="6712d21d2c16c2021ebe5f8b7f3781f769ebe6fcff6448e8752fc247d948013bbbce225fc0fca6a4632aeb0ae0053a636f2095be8c7a6510f6c9161564e70cad92e402d8fbef016faf0abe1bf233f561669b6cb83397431211f382eb8edf5ec18eb0cd06a1cedf3f7f282df1f8f79e847d9beaad689b77601f0b90382c0c611f43f16957c0cef993a45212e368fe787c2f7e2d17832693cb4b3ff6", 0x6, 0x8, 0x26e4, 0x200, 0x1, 0x1, 0x7, 'syz1\x00'}) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) getsockopt$TIPC_IMPORTANCE(r2, 0x10f, 0x7f, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 19:30:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:23 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:24 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0xffd, 0x30, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000002000000004, &(0x7f0000000080)={@local, @multicast1}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCGSTAMPNS(r3, 0x8907, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:24 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:24 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x800, 0x0) close(r1) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0xa02, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000fffffffe) ioctl$DRM_IOCTL_MODESET_CTL(r2, 0x40086408, &(0x7f0000000180)={0x4, 0x5}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 748.514380] binder: 23810:23816 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 748.521701] binder: 23810:23816 ioctl c0306201 20008fd0 returned -14 19:30:24 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x1) pread64(0xffffffffffffffff, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:24 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 19:30:24 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:24 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x400, 0x40) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000012000/0x1000)=nil, 0x1000}, 0x3}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$clear(0x7, r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r1, 0x0) 19:30:24 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) eventfd2(0x100000001, 0x1) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000180)={0x0, @dev, @loopback}, &(0x7f00000001c0)=0xc) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000200)={@mcast1, 0x0}, &(0x7f0000000240)=0x14) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000400)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000440)={{{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@broadcast}}, &(0x7f0000000540)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@dev, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000000680)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000700)={'veth0_to_hsr\x00', 0x0}) getpeername$packet(r2, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000780)=0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000007c0)={'eql\x00', 0x0}) getsockname$packet(r2, &(0x7f0000000f00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000f40)=0x14) accept$packet(r2, &(0x7f0000000f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000fc0)=0x14) getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000010c0)={@ipv4={[], [], @empty}, 0x0}, &(0x7f0000001100)=0x14) getsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000001480)={@remote, @dev, 0x0}, &(0x7f00000014c0)=0xc) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000001500)={@mcast1, 0x0}, &(0x7f0000001540)=0x14) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001580)={{{@in6=@ipv4={[], [], @multicast2}, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast1}}, &(0x7f0000001680)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001780)={{{@in=@local, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6}}, &(0x7f0000001880)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000018c0)={{{@in6=@mcast2, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@empty}}, &(0x7f00000019c0)=0xe8) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000001cc0)={@broadcast, @broadcast, 0x0}, &(0x7f0000001d00)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000003a80)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000004f00)={{{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@dev}}, &(0x7f0000005000)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000005040)={'team0\x00', 0x0}) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000005080)={@dev, 0x0}, &(0x7f00000050c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000005100)={'vcan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000005140)={'ip6gre0\x00', 0x0}) getpeername(r1, &(0x7f0000005180)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000005200)=0x80) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000005b40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000005b00)={&(0x7f0000005240)={0x894, r3, 0x100, 0x70bd25, 0x3000000000000, {}, [{{0x8, 0x1, r4}, {0x1ec, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffffc}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0xffffffff00000001, 0x7, 0x4}]}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x2}}}]}}, {{0x8, 0x1, r9}, {0x1d8, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x5ac}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r12}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r13}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r14}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffffffff1eeb}}}]}}, {{0x8, 0x1, r15}, {0x12c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r20}, {0x13c, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x313}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}]}}, {{0x8, 0x1, r23}, {0x120, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0xf9}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r24}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x1f}}}]}}, {{0x8, 0x1, r25}, {0x7c, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x13b}}, {0x8, 0x6, r26}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x20}}}]}}, {{0x8, 0x1, r27}, {0x80, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r28}}}]}}]}, 0x894}, 0x1, 0x0, 0x0, 0x1}, 0x20040000) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000), 0x10) tkill(r0, 0x15) 19:30:24 executing program 2: r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f0000000080)=0x80, 0x80800) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e21, 0x4, @mcast1, 0x80000000}}, [0x7, 0x80000001, 0x3f, 0x2, 0x8, 0x80000000, 0x3, 0x33, 0x9, 0x401, 0xfffffffffffffffc, 0x4, 0x7ff, 0x80000000, 0x4]}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000240)=@sack_info={r1, 0x7fffffff, 0x8}, 0xc) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = syz_open_dev$vcsn(&(0x7f0000000280)='/dev/vcs#\x00', 0x400, 0x200000) ioctl$KVM_DEASSIGN_DEV_IRQ(r3, 0x4040ae75, &(0x7f00000002c0)={0x1, 0x7, 0x7, 0x100}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x4, 0x0, 0x27c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) dup3(r5, r2, 0x0) 19:30:25 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x1) pread64(0xffffffffffffffff, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:25 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x1) pread64(0xffffffffffffffff, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:25 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x3ff) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000000000)=0x1) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000040)=0x1, 0x4) tkill(r0, 0x38) 19:30:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:25 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, &(0x7f00000000c0)) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000024, &(0x7f0000000040)={@local, @rand_addr, @multicast1}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$RTC_AIE_OFF(r0, 0x7002) dup3(r3, r1, 0x0) 19:30:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:25 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 19:30:25 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) dup3(r0, r1, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:25 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) sendto$inet6(r1, &(0x7f0000000000)="4a63f3a56f25a634ec738bcd4d36475a4b6d19ae30c81501f327abf5581af2047d6dc06c3a853b09df48ac80f0f12671efcb0686ab3e8319", 0x38, 0x8040, &(0x7f0000000040)={0xa, 0x4e23, 0x5, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}, 0x9}, 0x1c) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) accept$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000000c0)=0x1c) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm_plock\x00', 0x400000, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000100)="9a420ebbbb0ecf157cbc5368df5c1df3a421b266f5baef8f36c9aa3a01217803d6a4b75a43f028dd03e9f4c0ec4fbc1a7388d161eab31af77a1e2acc2433a2457d743c371b4046826d8b8c90acfd467edecd00f5e4b3634d45", 0x59) tkill(r0, 0x15) 19:30:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:25 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x4, 0x0, 0x6) fsetxattr(r0, &(0x7f0000000000)=@known='com.apple.FinderInfo\x00', &(0x7f0000000040)=')selinux\x00', 0x9, 0x3) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') r3 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r3, 0x80dc5521, &(0x7f0000000240)=""/232) [ 749.767166] binder: 23864:23877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 749.774773] binder: 23864:23877 ioctl c0306201 20008fd0 returned -14 19:30:26 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x18200, 0x0) sendfile(r1, r2, 0x0, 0x8000fffffffe) ioprio_set$pid(0x0, r0, 0x100000000000000) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000640)=@assoc_id=0x0, &(0x7f0000000680)=0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000002c40)={0x0, 0x5}, &(0x7f0000002c80)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000004000)={0x0, 0x9af, 0x20}, &(0x7f0000004040)=0xc) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000005440)=@sack_info={0x0, 0x8}, &(0x7f0000005480)=0xc) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000005700)={0x0, @in6={{0xa, 0x4e23, 0x3, @mcast2, 0x10000}}, 0xfff, 0x7fff, 0x7fff, 0x0, 0x200}, &(0x7f00000057c0)=0x98) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000005800)={0x0, @in6={{0xa, 0x4e22, 0x6, @remote}}, [0xfffffffffffffc00, 0x80, 0x7fffffff, 0x9, 0xffffffffffff0001, 0x3ff, 0x0, 0x7, 0x100000001, 0x1000, 0xfffffffffffffc01, 0x0, 0x1, 0x0, 0x653c]}, &(0x7f0000006140)=0x100) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000006500)={0x0, 0x101, 0x8001, 0x3, 0x3, 0x7, 0x2e108567, 0xba, {0x0, @in6={{0xa, 0x1, 0x6, @dev={0xfe, 0x80, [], 0x28}, 0x1}}, 0x6, 0x8001, 0x81, 0x6, 0x7fffffff}}, &(0x7f00000065c0)=0xb0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000007ac0)={0x0, 0x1, 0x7}, &(0x7f0000007b00)=0x8) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000007b40)={0x0, 0x1, 0x3, [0x2, 0x10001, 0x6]}, &(0x7f0000007b80)=0xe) sendmmsg$inet_sctp(r3, &(0x7f0000008e80)=[{&(0x7f0000000080)=@in6={0xa, 0x4e24, 0x6, @mcast2, 0x6}, 0x1c, &(0x7f0000000580)=[{&(0x7f00000000c0)="33bc8afac595406904fea3e53727d0c8bbf108bff4ba4ce2ed9a67db1565a4a4c2ec2917d3e64a67404b6065a3e095f05dd43d5dda298e9fce7ce33bc442eb77e9f0a26de59435b3ea54c92ef9f39fda2f484bbd4e054a799c0e80a0f1ae067efa2f32c5f04f5ce5f915a662af579db002ffd763ed0e9873e099a04b298251b6045216755ea7f47abd43325737c84d0f969dd2c9f814f727d4f97a6abfe3f9787037fb2e6a3ba7c897e2e84bd72fbad509836db436fcda7eb6fdb9a2d5624b2c951b6719c7f5f4ebd0adf7d494b9ea046d13a4e68120f6867f514bc8bf25926a0097c0070afaf8acf464a80b", 0xec}, {&(0x7f00000001c0)="a649c61cb49239abda6f57f9d941734d0d2be81b1b04cc533f0dd9ac2b5802b532396903e44532afef99cc14a5d85fd3c620d5e30c3d627bb91c73d671bb", 0x3e}, {&(0x7f0000000200)="94b4139a079eecd1137ecf793bf50ec60c25e0a2c3a40f63e6dcc98f0b729aee77c40c8b", 0x24}, {&(0x7f0000000240)="d716ec5de6075c2823ee39cb407abb891c702e4ecc4159f1f49e4fee0d19905c632813c1138fe50e7615d4bb728346a8da819c55ae1b3ffe0e096d327293514b162c2439ec46c6fe16b9d09ef442fbeb9bde2f3d6a929de6e36c31234beb", 0x5e}, {&(0x7f00000002c0)}, {&(0x7f0000000300)="9b65ceaad800d6a7a0567b794ebbee18f9e857cfd7b926c8645f45d3c1ebc691aa37e1fe05d8f71ad682df68c55741a239249adb65c35520d777e6525d2b756c7a037c784e8fc6d74754bfe999b7df820aeb4077bd47930baac519632d5926f7396106c302778ab7baac3e5670dd0be970f0f2473255396b3584aff2fa5e57e3a48112b19bb81a8cd111123c34106ddff7558b9e84b4efdf49025e43c36add4758b96f5ecdaa01bed120f3bb62d6bad2950dd824e314f7f9bffbc69d77b7d8096332e5fdb4e1c766c1f363f89c", 0xcd}, {&(0x7f0000000400)="64f424d56c4b5231959b11e5775765d719f106b7e7feacda1707c804366af55332dfe6a12d5e048eecf98c7587a95ed02f19991ce0139ef6149a476aa745405b7cf3027facd7d73994aeeeef5ae75b39427c3a0dd32acf9c260b54c091051d1ec87284f195a2aac113ea7a063cbfd1ab611c1e124c9cbf838a", 0x79}, {&(0x7f0000000480)="e93f13c044aabe5181d1fc7a0d442e3da0977181586d376c0dd8aeadd39fba0533da50fb8cf24b0a31161b7038daa2c5d5c128d3a896835c48c9154075307d5be75f0663ced9c0b8fa62d5cf1f0abdedab8c0a46216aa399c96ccf0ae415559d519c16099f5b6ea29837aee60303d0e2552feb5faaf5e09e45b9f80436217680baeb8d4ac4c0440a9268f4626d60e0340b1a7e01b55a02ebe2912bf5f53aaa75cc5421f4e38c8bf42eac0b378d6966", 0xaf}, {&(0x7f0000000540)="c8dc5b8f080990672a4508a883a9e6b6f82a11880a8ebb3001ab10a4f7aa92bb0654", 0x22}], 0x9, &(0x7f00000006c0)=[@authinfo={0x18, 0x84, 0x6, {0x9}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x5}}, @dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, [], 0x27}}, @dstaddrv6={0x20, 0x84, 0x8, @rand_addr="709baa66419e040fd615e46cfc3b3eff"}, @sndinfo={0x20, 0x84, 0x2, {0x3, 0x201, 0x20, 0x5, r4}}, @init={0x18, 0x84, 0x0, {0x5, 0x7, 0x7ff, 0x8}}, @dstaddrv6={0x20, 0x84, 0x8, @rand_addr="e8209deaedb75c82da875dcc81664a51"}, @dstaddrv6={0x20, 0x84, 0x8, @remote}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x4}}, @dstaddrv6={0x20, 0x84, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}}], 0x120, 0x40}, {&(0x7f0000000800)=@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10, &(0x7f0000002bc0)=[{&(0x7f0000000840)="9c3c13f37e242e89e51471de11ce31cbd772e0c3adf5c673809c144578fa755740f8869fd17175f7537d6ddfaa9c79ad52eb599f2f6bdc588025c877d4f45de933b3ec1e8760e941cf46fb60bfc05b5c", 0x50}, {&(0x7f00000008c0)="6f8396c29f749c93591b346b480f386fc4e7b228e5cfc0cf20d6ce56fb5b386147c31b744af87c8dd5e30971e94b319efaaff42d9891845dbf433c2c55d81be4151c74d4a6b57968948a3d89a32891016e29920c4cbf79186454c8f3e6a4bd1039f5cfc71d61da04810e18346cb75f87f48dea44dc6d1e8027edc3c57f1655bd84e0207400d60b6b1a9b1e102b249cd3df443b4762521c95ef150d67826acdee398e0a4c1a8a03ac5d46732143b7b14f863493274335072f02e834c1f2d3f984dd09be9a5f0641fcd1e4749c0a8b906c42997d14d1316e48a050bf1bdffbd9c2f36fdb558a4cf1ce0af6b43cd41cf583914d166edf28637af862349f52cad1f8a5178c970bb74f00e6ee09841ca101192864e504237fa8a8aed71deac64afb1a00f0dda86390448d2341cbb1e3874f670e52fba9deb09997af9dbf6400f255c10525f5fdd61c3a6a13b76e4db46066d71416c884799d600c239ade28eca6a2268201724fe7a388ea0ea15e1c7561edd4519638ff3f74ccc7bbc0187dc4dd530aed352cee53b28303ec242902c58318d33b44eb8f84c125544d274b442380bbee2b58e20cd020ce14239f807716bf79f321daa117668d06f3a7c841a58f34099478b726863f869d2347664b2c0464bb1a21c7f676f6e1e1c9599d65dbe75c99d82d7bb7a0f2c58813d3af65f27cc05bba1f6be9ac5303cfe7469f4620e2f38c0ea680b6a9b1396923db11bf843c8fdec577ca45157d1f292d12b41fd45c8e81c5c61d2a5985bf93ee21a84d742abed19bec7165d4fbe0fe2438bfbb7904cfe1ef97792e532a0379106ca4fba998b4de7349660e36cc1c189b2ad313cb453b1fd65aabd967f81530b927580627382415660e352a581fa873a9c1dcf85a77adc234986d0a83f8bb02a1abc43102c9f57b4db9e163c580d70f424628507edae1682df0b0189145fd29b9df8bb0ef6db5822a17bd642ecc49383269eb92671bd3d0b3e9f1a1bf7940928702bffdad5ceebbfe2263fb02f45e06c5110b2cca435a2240fa423cf74d014dfb6477ae9100842f791c68c219f30e5a7729e116e85c4aaf95482ab8043656b02c2eb9c089d89442134339a7fadfb8696b0c0fd3b1583514bbcf3565a41bbf1bfa1287512a60ecfbc35e4332fc8af308343ee1c42c700480c40ac8c7f021edae081aedfb8f95f953723dade80e7c8d7d7273a0444e736aad848bd5fe19ee1c1dfe893358306d4654473a3fb0fce6a1bedf914543cc72333f1656ebdd8de8633696ea8c8edbe1c715d0869316e9349152b23f6a2932f41eb78173aedf39e1ba4223fab57605de40b87c44b935912ea50a4d54bdb39d950fdc052b8a0d4cd2553446d3c70807c808a7214922f0e03445084d471a3dc18baff8a8334e514fb47761f3e93a0df14e5b2e5d84e5d1c0b872569b23afbbd111bb725bd1fe759339c1237e16a9582da8d63ed06fea411e913c4a57f56f5e4fbee229bbcb69c0e7807ddcb1d2573cd81613503682c6ac5c86fd88749878623887f9c4283f15e424c11206dce3a4d341edcbbfa030f4741af3f0d4f5a8600dde822208f9f2f3579948e5b15983322580de5130244ed0eb7c39174a2fb3a907b5bfee0c1b65659835bc7a90df88dfba6e8b43ce2b87bcc0d96ee6876e56a50692abc3b6ac49b5e740ecaea2bf563a13c1e6d29201e881e5ac56f9566cf70d80bb40fd1612281d202da75f5f32a65be4ebc1ab76ea3a56e22cf545fef623cb2280b58b3d408f54a5e89c36e7b312791c07b706fdb28a9713d227c4b9a81b39b9e8d2b6891e0e9c7616bee22b3526d49e288793e58919362d42dc72f48d6aa9117400788927c211a9bb5e24c44d17f21dba3e79e04b1ec66bb4458742eebcfe227f3238544a79bebdf95ed3f9ecec460963bdb673e191022fd7331c8a2fbdfa8d308b9c6007cae8f8aa71a31d03af68eae673c5364b339aed3652b151bd6857e47eb6f30dff59b475073b54125db604d467a1bab26a5f97612328c5afcfc14c0c2a730c08d9f34eace1c71defa15b52359c8cfe35f45a31c463ce6a2015609b88872b93571ed6e69bd3c873f8dfa0503eed0295455152d81a07cf653ef177e928571f01c1cdd618e3ca902cdce883b1a70348ca5cc4d3a53dda79efe8261e3bab11266e88706169d1f58c69e8b45d923e97288b33cdd8432ea5bcc83080f3d9713438639811132683ff9711b8c75573b1da7ca89ad24ab2f1dd0067710c6755b4a86a3622139a7016202ca67a2b28caef70db6096d82f4a7e766bb46f1c9ca8181b1f2f1244df07956999579ba1d915273506c96dd0f20c078ae7bcfb13720db8a8c89c8001b4f4816eb42f632315a52ffa9206298fc50510fc04c3c9aad5193d5b6165e3f28044bc23352fa19373958df9f632ac38ce6769a0d29b1298026931b8be94f728e7b1cb0c497fc3a448861b66d95bb7a6eec262d5eb12a2ab89a705fddc0eb1abb7eb0ed6825f45c6d03158b39aed2d488997f252b1189b328e894452c7ff77a679bae62a881cae3f6131fc92e4b96f70f2461527efe3d6dfc1de4d7f953f9e5bebf970d5041bfad7dbd8c533dfae4dd367f55379449507dc9377f46766bae82927f09a8d13e81b8385845c6baf67e8adabae423de4e54e9664e1b2c226647fa475a6613c5997ea95f03bd19faf05b82b7b0d4972db8de4054aeb8928ae90f130e19bc766aeac0912058fc8f622a8e79ec820a8c6f6f61d1f2137256133e651a34e83ff6ed0fdb0b6f1df7cfa12d54674f4b01cf040bf5f5e8d00c51996563a7721c712da44f09fc100ec4fa47df5df2bc2d4e81dbe9a3c2cfb2c04d25ae65a115a64c99e2afd6f59b05d0fa7b78f791142190e379c312e0612dc5ccbc0a2c721973678b96fa1baf784c325d050fcf3d1d83e1eb495a8310edae9b928253bd746578e1ade9be8c37630ffcc5015da91f0340501403b420c72c1032fe434a07b24ec4bc0e3a5207e8a8e3b7a3c32c27ebccf65ca147cfb0e39bf319683d937d74a167ca3cea7cc99ac29a379db4d5a3257e7a34b1d058917dd6e616f09024816cb52ff0ce18394553978fcc506d048623be2d378c8cd20b87167b937332d44bc810ede40d56c712146ea11a800c1c9be81eecdf96a233f1a4c5e0afb9b29241a267c8919b548db603874b536cce304272c832951fa963f0311cfb9941740fef6941f44439d4c21be52d22a2796d9837620176b60cd61f3a74572eeb8710c9a82fa55ff3d44663dc4a29ba0d652fd6cdb958800d64b558239bc60b57be4644825db83a34a6733594c7a94f6509283dde1c608ba6305f13e944c1e35fda95ec78549dc42dc83a08108dda419b7c9d162e905bbdf9e71fb40530c14d38d413ca969f876b58f52302b3a706bbbc37a3c49a8c9902ca493b27dac5b8b76220e1bebb51d5058795039ff60f2b534944fb8501c7ec1a57851768b70e9b16d632cc0b9728a2c7d608cb0e8a43ef6c425e79a16f1672f511b24babb0786289cd3cf65416d33274f0a52010dd40b872fa9aaa0e24f9534c5fbf4432de1ab24fedde45cd43408c74b8f00a6a05209a198b0b6bf289dbeb4c80a39936a41df89f78b5a7c2a27c4a416d930cb11aa9925eee8cb46530f76aa71ef7e04c69c52a361b96da937e3fd5c9bdb1a3cf4443aa9b05af9d94473e8af6cc10902708548a799c8aa79deee3c2bd2588d02619744aa2edcb439d8d8c862eb7978b5ce881bb900e4776c9983803b34990d13b537d8cf39a3de3e2f7b4136956a25fb623a145a24e4e9b61390ff57aa0a3f7b75f4dc5b57c738e9acdcea225298b592467122f6e518c9ef347508ca81881d71f415ff242ca995ef3f7541eff692dd87bf22636f8c47ff1e716008e3d320c2f15468312aa1772129989855d7736d0fdc19eb436df738acf3b7aea19440a67f8899675aa7ea05ae2dbf1017db3f135c205e11bac3d9cbddfb7baaab9cf49d77aab5b02bf032f84d243bab15929e80fd6fe65e08a3218a12ef607a8c00c427375a64ff1008d92d9d71d0636726ae95725a3f0613f33ec79af7cfd8922cf3090d2ac0c25872ce30a12eefff05a78b9fba81aaa60a32639fe94fbbd22dc7a02fe0b57a7124bc9052e2e3482f0b811180ee8f4c72988e4b1e0826640affe581fc9e7e48dccf0baab767c697da99babab0fb7e0fc11312580125ff6ff6b92cfed538379b23153badaeea2bd93930e868f3845ec50029d2b26ee53e5837ecf77f49c309c22f8d1f33068449c63bf1358867d2409db0f4a74db0930ddfb5e9ad50c3a60f3d0ca1770246f1fd0f366f470c911d0af98218c70a16c567a0493c953ccbc445c49c077ee8c066f3ede3dafdb8195833b23cd8c8c4025e8e926fd3659cf1820b44f1e6374dcb2bf43ff5ae51fbb96a643b10230fe6be8a71a6d82ab2b5ae3c12ac49a8aca3f587c3948e8c5a362c9d786c9f4c50fe29adcb56b4a31c81bc6bcc2b43ccf91b2ee53d5f317d9fb71e33a652cd148676fdfb19c7468ca75c2cbce3d3871c48e844f74c9a4cba6ba68aff0e04918468d3553046b5d3056b1348b25c15546b41ef0d3afed73858a4a6778b07bfb7dd1620241b83ae5975658176063a959dd0637591ac15ba9a6d8161a4452643d789b2031dbd98d9c6939c40c8e347357a0c4b6f859a40eac9d73b460656ec815f02868fcb3625721800f1cf2a03121ff8a74471a00505dde13933271a538467270c94c6e7dfd754f5c7ae1d7a0aac9be3667a40e62bf627e74646d2accd9cf6875edd70f9bfe3a3e18aeff87b4104cb96b70d1494ec4982beb46ac612cf9a24660c817881f0036d402a80f8aed6522898907f484c4ee8776b46429c7e2c512a33e6ed832e1d45b8eb3242c6ef7898a563d5eeb4136fcc7d2f6d3a3dcf86fceae77a5a10823cc7242c78ad74b4b4bfd15c03529875842046bb7b910bcdc95c031f86cee0d95df5d105fff8d3862d0578e4736d68020864b2badb86e6700553ac2e2b1c817eb71120b980ee7eff228e0212e234696ae3547273804d4c3c46f308488d654d95850a36a3f6d6117f3df210979bb03579f70f5ea30069e45488c81349cb5ab256de5d3ccad8b87dea2316b3f447409a4a30a513452b4f15efbba85d8f8bb32bd3f30bab1195970a79bb0ba898ff602461f7ce191228978116853b86e45dc223dafc8d93bf53f0368a5894372be5f442de74dde7473de39950e1898e01605581a7dbe0574ad0e2331f897142106b33b9af235d3b663d2dfb3153b3a8c872bbad3e8516a4a7e123e979e1334593941e4f9846d155b087afda112c215f1eac027c4541dad4ead7fc4d7699f5a0d019a2fcc616bd274ea4b717062d7fd28d6ae96a641cd0aa3e6238b3a254d9dac976136178ca515ddb2427787d0d271f877ab68a9ab1982877df9496ff995c47748a7c7287935c428f479c4e9d87fda9edadbbd450fda569d30881dfeb8e1e65e3ac41eb5f6c99f8aa4c395dc21166ed3da64a5d57e20a6ca6e16b17f836f02369dbfa39c513ddd4834ddc9d61653d6aaa1e8f2c5b8669e61903f8c18428a5342e28ce6228dfda6eccf27a0a8a0fbfbc44bfabdc21b6c9d3aef65a5da4fd7c6cf57ba13bad9e03c89e90a28f01bb80f9a1eedb2d7892c63ec65636a93d351f4960d5874f9a8807d45812a835b814059951150d9f409cb31180317f5db16455b9f09df54fcb2eb8451b2c747a7ac7c42986bd9cd01a0ccea959916ba68f9fd2e2a77b1efcda3099ff18799f073a9e3ec1552387969d40ee7ed689", 0x1000}, {&(0x7f00000018c0)="3ddf8322da132b0ebaf753a308ea62605b9c7cce436b55d07c646142871a237ba2ffe11c5a16beddb5b060455a", 0x2d}, {&(0x7f0000001900)="3e3b4c91002ebfa2708c527898ca3980501479d07110b541ac547eedf42da75eeb3f39b0ce288fbecf4a81cb5a5f5bda5376d4065a5309236be50ce783e74c4a4d3befff88da2541861ba447856f652ea0c2b403845af60dc7c90efffd0b4a194c5a0cf7a9a6742fb84a145d359b1c4a0c6418f801133d2447abd8675dd74d2e78bc03a722f9614c271bc6274949338d4c4c317f4657ec141e83fb4f63cad03e3af3561a451e9d2aab860216fe5f9304eb0ad594ba774bf3784835e7878c9dfa43479b5563285d81f0d541e13b6219e86de4d25574731fdc6e959f068663ab094f9cfd302556586ce98fe12ba05660fb55fc6d957040316c8ea3b306f99e2150fa758c4c06c57bdaad60efc27d0e9146be1904c3a461a789f4ce67779f114846a76f9bf486fcaa66dad5cc5d818a2c40ba33b4c42c41b0221b11d9c867a8fce2d8fd6382c12fa406c9d5b9156862d3db69b31f9c41743a92da7ec6f081e33176958d005b4de1b2d8183370ef6a1504800a6fc4e8f2e26c880d8dcd6239d3fd8287770f37872d6fc38e2dc5db601f5b75d4adeb2c768522412695e8b8a254d3424d0890f12a2379a2ddf231f1aac16fcdbba7e8d1bb81cc3b2e732493b98d604f85e5abc370e8efdeb9b70e8b1d30c9d21a8da871dcb2c2e589c42e5389701b2eee0735e76314b3bb908016d086e415105e088c9a26742187242faa0e9f1bd028c07e822b32415a3e3b37fd44729f2ec123dd1d086a029fac73ac78686284483085806e284a3bfee77773a5f0117b3f85262b927507b10a655e2e79d447e3ea88dd3601f72f82122c877d5361e38b249fe2b91abe98800c59b62a1a14055b471117b6441fca0017aa1e2df65ebbba63828a0e5e726b02225f2d9621641d1273f0c0441f931181a13bd28e5828c195ae51f85c7d6a8a9051daa99b1548c3ac69a9b1c3ad74069bc7a85ccadd6e2808827405010b144b2130416cecf12ffdf4dbbb28c89f927830b0858543d15a2ed5d76db39eddacd7ad0d3689921e6b636a5e428f1d34ca6a3dffea014fec789dbdfe687a1f867b3e4f28d13f8bd07a9b56224f03b422d2b9c39fcd0d2745a86d3220bc3295133da27e34d386701f84d00f9a7108be328030c8849082b48db3cb7c6cb51457d6e29b6a176d7d16792b54bd848e22235cb8cb601ef4f44059192aa8df40844acc723761efa1d03b834d0005db1f146f052083145abab9a6ec972296a1062a1b79e98171890b7986a5967003010bf22602e46e1668fc34f9f3a2ef4a522e2374084cd5c1a4bc4dab57c0d1be78864e5bde3f992f971ab063b17eab9688d35cd05feee8412da12722bb5e525a7f1802055c58f6fefa4875dcdb5b450275e52bedb19175e4b8be1353a50b2d2c575fe5c3d665da46719b644f6d7f8abee033ef7b4aaa508c7e2580ea088ecc71ff4c700a10b19fb8f106c3717d7a3b0a24def7ec86de5386fecd4131baff35ce82a5a1de598325925cee8a94fc3cb49ae2b4feb02f0e33f3ad0d54b0081724e7aa5bbc4a3e39f64e25a7ee94e7ff0f69cee297afbd822dede743239f4ef834fbd19fbf0775feb392a02ad8ce7ff5ed2ec6fefc3277702323c0ce66320f4f1b6ac726869943c4248059017e1e77b711b0892737849b0a96797bc72aaece3b86d9d23065246b38cfe8ee2c39a10d3a4bf55d5a3f681976bfa6894e44ca77b6d9f3a89f89a0f029eeffeb4ccf1e817619b6dc0a266077c85b195d28df9641f96db9f235294a81c21316208b4c6b7b67a0db7d4fbb622d60f62b211a377998312bf46891f69cef51461735dbf05d5831974fe5054d7c1e5cd2cff95ef3b4a07b6e16c64ca7977fff0e040b8410128ce9d40d3c36447f8b303033c9e680a9ff5fa713dc72d2327b994c32ddaf5d4128a5d4234f247a43c67d881f206533be0e825532b9d297ba817746ccbbf46a6947bc2b54b80435d244187ce865269bf7525005879fcfbc2fb2a839a7b34282f4e5dacc8820dc7d5c7cdf2e3bedd618f849cc74953fac4a943d666ab46d700784c7f8e4661a577a3197a39abe89be67bdee0d40271472c945899d8b1a6043f43162994d7af9d3bb0389719b780b65d375b4f27a1bc1ce302944e5dec4159221d2393043c0e815a932975683b8d26d37a42c4d251961ccab9aa2c6908e45d17ee8f743c8b4c7c462558ad79273b95dfeabbcab8b1667e80aaad5155acc186e3bcf10e67de4fcf13a5828f4e4c7c21ed7b51eb9152c6d21f91ae56577a1ce2e35ee288a1e8846cbed1cddcc26cb585d9966d0f517d46fbf2f8bf465357a26e3d6b138498c7910b1be1e98d4fd4599fc2624687d8badfa5ae28e556aaad9d6f0bb983407ebe73b9e7fec3ee69be6b508f38b0c09c276e3dc26bc95732d53e3dc6a00f759354278d75b08176a5451f7910f567cfbf4b506d95ef0304a353ae9628ce7b3db3b062511a440b6acc04be8c77503817e0414a1806dffc7aef2f47a8a834b2cc6a30342f953cb33da5e598b4040f00ebf0a15f04d3a156a673f71e40c0e44df78428273a135c411626d19dc8a9cf59fd13671535165527f79d67ec0897b8021d66167218d488172302eb8f4f7057cc87ea06f19253bbb1a3c0a04520f8a531dbf95927b2984267bdb9099bc06a8ce20547f87193d68dc6d23e35ca748bbf2976744fdd9bd3c4ee7c7352fd81998772ca76052c6b8483e1da7d809c9aa0fb20d3c8ac7e43ed96dbf869d73bf5799bbf8dc1bc7590dd0fb868a19799613491c31e12c119b5e20ec391e924eb8179a79824d8bef141091dc805d360f4662fa5712a750acb93baba308ac339b60845adf38b862dbd6e24057e8ef54748e6bbc5bde4d0624f01fdce9def5e9e0cb9382cd17a05be2af8d8d90329e8fccca93c508e9f226246d6b7fd1b80426c8304cc9fd511f9f57f43de7be629c7cce5dd1bbff8fec4b30440e54efc41af2e2e394fe2f739bf1233651b78d6751f4444b16ca3ead0b3e8885c358d3129ef5dd728ab3b6a042d8f75e27c326ed0b69d66b3aef9f11e808464b7c92f3b4ff979db9a5f4779d227eabe5e367116342934d9e14e8a85daa8b5c4400107132026e9b27a1602d6c2269f8e9dd59bed237286ca1f545c245176462934729adc7ac5671d72f7a191148b59cd1cae914516f98b9328fc8d3c30fc79ca0d32e2ab17da2d00c6c8662d49e554a069bca010eb2850a8b1b1d8ee623a09d7955ce7e3d84d60a7d81f6c864a0c3ea0116db725c0c49cdbc36937a264de3d4b90b96a4fb87ef875dd9e94104dda72cfdcc5caf1cee3e0f2abd347cd88c26c568997e9d6b23e76596d2d53c7d9301ecb0b20d1b9db60e6c6c66df2af5169f331c8a1deb68c6ab80848c06d8feb7212fd5bfd9c23a5110dae981ce922ee2c54b9894ecd4895b25466008308e71485a5c98b0cf116c8b7d57263426154efe8a9f392e65da4191fa8845a391b127fd19a58280bc2bad3d06c1aab2f47dec01b5e4216d03d49a63d0e57349c36517c49e7e9ffb2397d1ab09fdba9321118156458f590d18d0db869f71d3ca06f57a23628d54e9124cd18a866c7a1b1f949f5f663989e0098988ac26456125d7156b02ebf9ab4951540957fe6c1dc69d28a991b15f4821031590ef5a02e456af16c7b23df8e44be71602319736e95830fce9548a6067a96f645c50899f94859d6c343b67fca7a9f0678dbf9875d1522db38a83b8f20b8d9bec118796da00ee33f7cb51f94fc1aa1a4f89f89275134994efca24dc8e9b559191c7601a4126b37e20b1ce3aba897f524e71062982171c07bf7bbc799f6bec9f942b5f6d60ec246499b13f21c1f1f1bbcd2c36d5469f10e13ebc65859f68da53cec9a31b794b5d6894c0c4f8140be494f1e0043a3b2062e9d54e200be9fb31efd7966848c2a2ae0bbf34ff022b73c11f7c136fd43d85bc73639f0680a68e655a444e4025ae0ddb498bb708574f17e29fdcc0b119c83aa7e71c2cd0647e40d5f719015fc9d69c98e0af705f2e832a3136548529a98c91ad2972258e4fdecc13759894a502a3a270bb059a3f9f91fc31ab7e17e25a14bbb1148490d4d9e15276282eeb64c915f7c71b92544e6dba09e7fff8f85a54521093685a45ae26b25a574e16d6787ff04ffd8b98cd7250d95bf705ae7f057045ff5b2f57add893a353071dbd71586bbf55ec5984537ca9295179083c4a3accd9c7cc4e5ab050723e4b0fdc2493d7b65ad2a6e9e0f6de955b5f419d8e20d97d05fa19f09777851091a8f8b91d4c064a9b4350f15a1ea87ca39aca425b6214c06ef7c9c459bdbf9f3b59d99b600d0df81ae0176d9a61b9ab03264a9008825501cf600258368c6ced78bc1bb7393f91968c12fe0dffe1ca4f037a646cc9c40b5c836abea96105b6ef8790430212db249a7c5797a2a496881ca4c7de5f47221b117dbfc1055b640178287106bb342a3e28bc3a92c67f867bce842aa4cb3185ead1e7db95efc52406adb6dc0cfc90e8535d39a9bfaa2f0d82a60bfd416e51476eae69487ffa74ec57d3b883cb5b62fe09a504ca9cc8649315d43b4c446eab7d0ace3c1282a0e3070c6eb4b6ec6519c4e114ccc7fbc319aca99f33e8665e651c254dcaa46696b304d26d30b1f0d364ef3b1ba3b87939a165b1409911fb462a23768962b84a106c179747e7903a5e6ebbcf75ac935c637598df80912d15a6c897e354972ac2552900e65814de7a1959ab9ece4c2dc99619fa8581f95d510c983d7accb6eefcd35b1fecb44a34693c03310dcdff32757dde6108e16248afbf1681af612038cafb42aa172eaa092123ad8848c91f58084cbc64bb508f0b10e27ce54306626322aff24feafa0f5a22bdcd914ec16d7fbc4560255289d7e8126181b991e0eee6d232cfbe5c60731e73da02f64a1151da038494b38be8cfe92f497345591d61b5de2058396cf627b175725a0f461fc6042e15f53175c6779bb6e55e7418342460305608c8d25bf98b377c35de9c159cc72fff632654acc827b69e536a5f801affe8d1e67af85493a02eb8b8838f36de4f11cf63e9c0c098619877a9a887a93c78e2b613c60b1dcca00939399f4e3d263e13a24c089542b7567b083a3328a3c9661d600d9f0b162af1176e589e88151007df56f1049b904e1477c59f17f27cc5c9f7ce3b9e01443a3be410cd2479c94237a5655cfb551a54f59929a50389172a21b13ed92951340dabc34a220d7bcf1961712190bd9eed7474c6eb82d8edd22b2b291d4b1614d91a1beb243ca5540d37868877c957da0028517dbbfd1d08c7d113df5ee9952cb45ad6a56374b16d1558f37c5ea6d408f121cb7da6f844e02efb5bf4f339fbdf2ca2849847cdb1d151dee40a5f638b6fdd593bf988c4a38d055e1bc1a4ebbaf90d309383189d5c10644ab6c74d64fc4f33a1d80fd935c252cc4861eff5d77057757785c7b23b8abd5370383cfb62bc653e0632ff6f565fec18e28dd4c7a61f75c5f3a829dff7754ecc5c439fbfc6bfdfa52725384292cf28eacd5b174b6e894c83218872e6806f8c9f0f212c6c671b1f927150e2aca8b07811f4048dcf6543546af9cf0ef3d443d1d544f3b8ca395fab4b925eb75b879cda32be1534cd407d71e922deb0c91d90a6ed05a1a9087f53f87722c9da01a6ec0774460281ca21e086850a49742b4345e72720d95f9cc2a5e6bcc06ab82148b8b8d0797aa36fad91ce174b43884a3846064dadb7a054198c85b614b5e519015e91c037b117da1ec0ece2fccd15fb7e0eb5dee061a0565877a3c9f75fdd", 0x1000}, {&(0x7f0000002900)="7a711929d61f86d0f276e5164a69e87ce119d07676e5264c36cf112e6b252753bfe2b4a08e45c435185fca3daf354df27588e0128c37edfbcb3eeda9477c4a57f569cb45148639bf13734656def0c521050639df2a7b352e49e5e4baff1b8f0718c917f1d83f337238eb337a891b4cf6ee9e4f07a6d9d8fb850bc074d74827fde79b3b6254c5694576d53da9cd10fa0fb2ea399e6c26d1db0ec0fd9aa34fe10f0c6bb6fc6fe4a6809732b206daa8251fb649abeb67ddc677fbdb7aa3731a2ecd5c1149d11839c514daf36783b4da2fc488d131ea9b332c4c7f438c112f0b2325193279d7d5eb6b2d669fd2ffda21bf556cc946c028e0", 0xf6}, {&(0x7f0000002a00)="14337988121986d586f1c0c08aec852cfd9f9cc251a8ca0cd26596877df48fc1134162bd42aec9aadd74c46ab0e00579d953a97538d7f9a59dc6be00f1d13313729ac3c573d8daf8d3a4a1b778f2e709fbd170c2e4d95abb401f9292798288f3b54b553014b318ed4d6829d401eb8da3c16aab6c3aa64c5b890154ed3bfc98b13f1e32eae07a380ed02b23cf4df84dc179b4e954cfbe76c943dedb211a8449ea9efa75eb5fdf22fa7f4550eadaaf1d5f2f48708024bf6eae1c8de269d600c513", 0xc0}, {&(0x7f0000002ac0)="b382589d31aa4d39bbcd211ae1f4aa8997475d00a3a105019c529970606c521fde3c7709f646e765b8dbb19e35a1223cdb4c9bc9131fd322df543e63a48869ad01800dc6c9b2cbc78b49c1b87eca5da8a5cc5701aef660515c822fd342ec6858be0b09619a854c0805350fc3a60d57caadf589b41758941519833d66bc8d8f39c3769769b9dc4edd981fb1bd150f3fb0bf44828e", 0x94}, {&(0x7f0000002b80)="45f80ff096b0005baf6720db54cbd569f6b2194a75ffd8cc96be19909531bdc4df0efa4e225cb5efd6d1948e662e0f298f9ab17014", 0x35}], 0x8, &(0x7f0000002cc0)=[@authinfo={0x18, 0x84, 0x6, {0x7}}, @sndrcv={0x30, 0x84, 0x1, {0x3, 0x2, 0x9, 0x0, 0x95fa, 0x80000000, 0xf1, 0x80000000, r5}}, @dstaddrv6={0x20, 0x84, 0x8, @mcast2}], 0x68, 0x4c080}, {&(0x7f0000002d40)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000003f80)=[{&(0x7f0000002d80)="e4538c89b7bf5e333cc68cbc5ca835c91b420785d5d696578f445526a0c30f759e32a551c0bc93f96ed0c2d499b413", 0x2f}, {&(0x7f0000002dc0)="8b22970ac6aa6f1d32edcf9133cb70e73b32828e07321e86d6d01ba3e6902f690184b1a3058e8d695a82cb0332ff9d77beca1872d24989c8c2d9cb5815ab99f5d0e4951c93509c1d000febe726306bf174a6a80c88403b8ad86ce23b72a6822f90ef00c7fcb05e640fa88d3304f5ce2a816be58386923f4241", 0x79}, {&(0x7f0000002e40)="c366909a2f4da452bf5e1ee6e040f9e2f4ff271b6ce5e3cd4e088624ec1ac96e32925c3371b7acacba6df05683335c8760391bfca01e35fa78cf786dec2b38871867a581420be18920da8abe5190350e8879ba25744c4f82ad4013017f0ffc46a8397fce2d3ca716efa7a3bcea4b2a0bc5c2ab8519074ae8de18ec42c6aec4d16e5dae59ffc66ca2b13d83061820d43c5618f963cc2493f77619c94e59a9f7c5d81a3128c3edd1b830296ffad372992ec2b9b30ebe40e7552c6f3c8ee9684995b6fdc728c07f82963d2ff1", 0xcb}, {&(0x7f0000002f40)="da794e76fdf578ffb7d709fca85b290a71866c73387126836a4e", 0x1a}, {&(0x7f0000002f80)="e8806221f99306bc9bb3cd55bd548be922daa611471053d367493328fb93c543fe86c4cecca4f9ab88aa1fe354521a0d8506bb94c4b75ef5da34b65ae2a61a9e453d7daffb2cf7716b2ebfd90961aa44c1ea12998a968ac9b5ad11322e75f49de0a5bf1bfa76fb1f003e8ccf6d3744d6f15c774415a3116c1d7f4fe50cb3a11979b200f4257907a94bed3636aa5bd8f030cc162362d1d328cd226240fb2e62259c423ff500532051c1edc86d92431bbf56c55d656f1b5a72c1696333d9948c39f927a6d3ebf5bd6dbeb27aac30eb6cf0fbb62f1acef8ddfcbb9393167dadbbb391b4892c590b54306c7a813c1690ac00b4022dcfed7215ef891710097e817819da49f99ca452dd5b74a4a81271813766e1b99b05088ac270be2064715b4ce1f444a5a6aa4447aeca913161a5fa441c8d06d7521ce3783dee7b6d3f3c77a4ef380e95f1a3bbf5234f6a81dcc2e323e1a477b120b821a2af27025a2e86d5b9c00e536a78469d8065b44a209395b9c1b437de20b88bdf6006964f4ee2de8fcb562ab73155593814cb2cd903631c331439c605937c6e26b8d63a1a029ae2f0184b2e7463289e839ceccfc9eb585cb9caa7cf12c77ac70e68f8a294cdce528d6dced910e6fb6beee9d67fe70db9e6e119a88db80823ec7b25748c9afa59919cd88f28da47e13adf91a46316c3de7bf59699fe7a3f795b9ab6b9ae3032e623ee5313b219d4d66a26066c79bbadab0780984bc7738440bf75bf84051e617561429bf131395452cac7c23dd12ffe07ba9dca886fdeacee3c60410ed68b10b4f8e32a364b2221b1cc6a597533677b251745734c4a62180677102e2d9476eeeb2bdbc32eca24d9d31a4c285f4bdacfb0ecda61a3e2e9f97cc057f153ccfe7e498e287f04b3bea3ef8430d80c8f406f323731aad9db3072c51a11960aa5608f5e45c24eb27f048343789b1e294168d9dba3449b5c0d1986fdb3350d65a27dda1e86d2ad678775d2e3753d0987f9e1209c3c8ad244c036872b100f0055f4ff36f3c5998332223fb8fd496683cfc079d13004ec74c8bff5f16a440cb3b971857904d9aa57bc3640ba3579aebb087b9bf8a07867091269787739468681782de31fe1849c0cd144ee19572bb4322d42b7980ea64cae8bede8696e21c2a5bff864c2158567587e192468d94847b5717b500d4dcb898f2bea4e50f09f3e8049ff4b7785a499be8c27945bb5abcaed89a2381f005cad13291083c0dfdba40e981d6b3e400b38bc55e88790a4c00705bbe4fe602344d3450d0a8a10bfd3fd6ec788fd80aba9db21e3e7712216810f34e674263d524169a4f32931253b641a4a452c9c975fb15d05a9af7892cc9b339ac2b0c21070d74786e546a82d5ec2d5449fd747c3ff2c07e0fcfbf18ce16325da2c2ff7625326d9d34938b6bc2723013dbee9c214b4211c38a33d231d8feee0f982825dddd6bda35127cffebb8143e2a75e9d486a4b2ee636e3225073e2282f5c00603b9d05c29d4499894d1206d35129bec83d112aaa7edcd76634caa44eb36708d5bb423e0a1c0157f8599ec374fe0163a1ad36313b1e9c4245bf24ba17a5aafa05adf67f063ce58500acd41b2a6b4ef2a804ae8042f89e456365d68ba69de1e0c71b73f9ded6c12c349476cc050115db47f5b258076f09902f2b3cdc2a2d73a12e042398f11d286c45ff789a26af3dc85c6211682e05976e1803043f878c79951ffb4c833a1200e893a9f452248c8666c12e0b9f98564b39a3e997b28e9ae2d4e0467afb30d7e0bc2c6eb7a6f3fa2f7f8dbf55a816748c524ebbf934c2412b7f27c39eb7f9bc7946bdc320d0c4fc469b005d7c64a86b0ad99da1e130bf4d6aa03fbde5a6d5002af619aa7c84f228855100972e629f45d066d9424a5b6d5720e938996d15161f479ccc589f0eb1016cd88e4fc01be962d83798b28e17722f077cff9a4eaf98453106babcf96b41981dd8de248e7a1b120d2974190400cf5c9890a9401354cdf1838b2eccd3f74e4b5dda448a30f8603654db519c6ebe14ba73902c54427ee2969af4de7f1cdb1aab7672eca68ac731afaa4f00a1b523641339e0017b626e15422fa8f2d8e2e0e3962596005e3c57bcf668e86f244eb55929486b6421524f72de6456c4b3a96aaffc616ad160f224d652bac82d4e8438b627e0a4a6cb119711bb67b68473f75d4e0c87571bbe235014fe6629be5090bb045fbef65e10cd54ab2f505081caffa40603ed41e803bc12aeb6fc25e7a58ce0a9cc55b44863eb553c738f091c95696e5caa150aab4c4d8f324fc384bfeae88defaa84ef366b257dbf3a89a7365334d2fa198ea4c569e57c96ce2953572e9f219a9e997e137b2a511860ac9777861fd851f81a60cdba6bbed2a9c9e9c0f87122aab554329687c93b14628d4d34ef5fe2bd151e143e63857e9c7ed8e0b3033a3481c5a67b1fe32690041635aafcd4bcdf8fb205e1e4affca566b487920dc864897ec576ecb273571a2e7d239c7de6f053b76f058f61177a59be7c6f9381018fd397229d906ef4f8e341ffbe00c7a5e9aae8f4f03d06b833409ca92a7fb988b27feac8a2a65368425d6315e6fad2b3a2b5488bc57f256ab066abf768f33a187d8d3ee8d8cd8862feede98e7229949f4c7fdad94ce3739d0c01cac8c6dec516c92cb088293ccd4a03464cab958048dfbbad893546844cb3cfcde8c91326491884f31f64bacd62aa0fba7cc1c442fed3b3914920ef9a1542deca97e9c785dac2e18c2f72e253f93bd081dd1a4596425f072224178ee28256a3b29ded9a26ffc307d212c5921eaf8c131ec4cd85939cac6f7bcc9e9d85a0ae5d41a31240a9c300d58c3c2742af22f804c997ea3fb55fe1c0b3d5db9fbb77e36cb85182587439eba5050e2a0031e3a4955cef59714e129edcaa7f0e958a37f9bc2a93ec4ebfa17dc94dbd21d4f1b969274882cb521c589c6896150f5fa2048fc0ff54cbfe561e2068fcde90f629a177ba22440f4d2da6e3832d89a053a92e7a86d540a356a07818d803a7bb7df2ae85351dbc327e4a51bc73183937df45fbf09a1844b3d453d0d99bbf0c482ba5951a077bfc381a95f148bc8bf70da6a2d11fbcbe7079e7ace88ab35d5e9fd437fd00971a3d27f2e41b43313e37457c8d9f47ca02d1a19f04802aedf6cda807c54ea7d362ed2794d079339501eca06a57879409a9eced21dcc23cce0919661db100cbff76a24fa9b82fe3d827845688106a8db6d77260d400aed0046b68290e3642401e811adfd08d6398ce621a2c3f3f95682231dbc83925524dd25d6f258ab46d5d89c041c8964b945e5c59ffc202b9a1b50f8dfc0a5e60e4bd25e65b8cfc11165caaee7d77687c3c0f741f6ce31f58411bd1799fb3a2cf2e36b71a4f2731c29e275ec7d4ffa31e4661c2c0f797f884aae1c5d2c7e6b238d3043b5ee1dbde32ad3d4efd2d2bada707738ee34bd1c8510f4580b372652b54ad6ed6fb73cfdb2e04d00da54de3a27b4c350a8e36aa8248d5090262e20305b7fae570e1c6618249d7a38d17ad6621e7e43cd7762b132d54781e75bc2c014edde9fe27b565a66ecd02974e866bb1301fb075cd182a080033f3de95975f69d5837b1170089966aa824c3a0f94f1b7f71660b5f22882f70c908de6f3bc6eb505cf506a6be028ac4aeecca886e6ff605bd6d1c1c89ffc0daa2b62cb9f2cd282715a4b69ea9881427224b1a67ea6783cc0bd41a570fac2fb4774f48214fb71d6eca168e215824a6d1502fcd678c1d21001b56e0be03629e5b269bb5a52f1b323be459c10ae7fe1cb89b2edd12a489e19030bd43b9a516d407ee3c26d3da3c92c81ccc76f706d7342fb69c8c967c5c2c093d238309c609cc6790aa88aa54d49a3831a932438b14ab39c30cd0b27bf94604e57746efea919a6a67d3a72bbd2ca81baf2c17ffce3bf57b8c26e809972f446964026a5891ec20b483fecbe55bfff525e19aa64d22cb7fe40fe338bf8d2be514df1c7ac4fa84d15f449c9173ce03590bc77404dabbfd189bc5a376148e0e402867f03e56b57809204d282d55273d4203d1d12a0cbe2051abeabf66241417c7c3aa03e24906fef0953dcb1677df1074c3d6f8e4610d924d0318ab413042fdb41634f3a36452fae8aacaa6b1e0853890c3553034069505cb49920c6451b93b94a6e52a3f869ae42e4842b67fd5f2753fc7ae8c8f922f6de6a52943f6c5bba1b32a8bedc3b8fdc50929a3c85994206786590c108ef4bec87cd88173106527a4cedc2c97b55e52f494237471193ddeea64698215bb0ccdf84f7d854bb896fe9fe7828c166506247b587a8c807ef340cd7209b43affca1fded9e3a4d0ff964a2a2a1cdab4eb5f208d63947160836eedbd6c40948d6378e1609cf5fccec572ee9475778a0b418c4d7d3fede3578ac1d75e133e06f7d2a9bd1feee60066ad15bbd250440ee93e0b8f5eb064db28a8bf9a1ab5100b5b2af2c2ad6998b9f16c0fc6fa8fe629d24806e93d03060be71a8d072e5e010b3baa5166ddcf9787853f20507b3e5e30715cce0655d07dffceb6571ee152ba4babc8e91eaf1b40835d1e6a3d76414babb8d38f4e5f126de47175468cc9007d310a0f1beda4a66959612fd5a15177a1bfecce92575d13a37447284f8069d0b335fda2ad5c7fbd2f525193cdc7b08a9516d5df6023a1f02db9ac1f82d39157f45f031d6bdd689b0f071916fb4f7cc6af3d3744b5c3dc367a8e3d8b547ae4626bb60cf87673cbc736914212ff5823c241b7db6d4e1a7bcaf4d9a3fa82af96b01493a20b0fb832e8cc14cb6121f12bb7773061407485ddd472e4cc5c0915a0f841dea52650d6ff42b04813e835eb8f3f942c86101577a3fcbe355b653a031006576a3ebd040401d8d8b971fb988b5756b60149926fd9600e1ccfb4ea566da28f102f6a7e0aee57f1cb3d55e2da7ee6a50cce3de4dfd81f44591ba9d4fd7ab24a18348029e1219b522b1935b1b84430ef3560e46e5216c64f61101b51b50e4224cce1e3f353a82296a5afd898d17b2500c5dd75843d917ab7ffd5c227863307782911a6780ece0a572971a071db2486bbe3e212cc0b30e6924ec760bd4762d5c5d2cfcc3c037e40b4c7ed9ea2a2f939b09ef37b6b5b6b07ff4bb7ba8fe1e9bc9d546772d83b3659f94030823ae92287194c3af8a83f7b00ad754c93bea1ef63357bb2303b50436fb17943e462a6333fcdd2f6ca0456ee3a83b420cb72c5e347dfc411900f017604a9f97d0ade43de78979052abbafa7143ffbc304443d2e6ae956dadd3e34f7fb8560e737cda9628bde68df96d75fd59aeccdce3d6158ce52406b067e920a77d41b80e4a87a99be80a9873fa7c97131e24915e1223b2c8e69241fa711b45c53fe66dd6f64f4bb2304c90653e3eb1f9b978a08664563fb7b2dddf5c61a65e92ecbccb3b5cf43c650c844323e1e535c65dd0783b9ae6f6fea424f3ecede13ea9bfd74ffbbff7366ea8da7785bf9e5e935081f4291f15ee231cd9ece68c9628b7cb2837419d4b7857927441b42a36d2fbed3687a2fc50150e8a8a8b685f48647598161fb49e639f0e1eb61262b306e60f3c79da3fa6cf38dd8a95ab83efff307812a57124f633cacae9a599879f8ede197d3109739d779d7dea9e9d2b325dbb733d6a000487916634feae25c5cefe48792d542b4adacf75e047210fc5331fbe4cec9c6f04e0cc1bf11c24c8333687fe985b79fffd59bfb1bcbbfe5202a2a770ab14f6fd4ad01dcc4e103d584334037b1f353df33d8bd0a5a954bf5ccfdfac4", 0x1000}], 0x5, &(0x7f0000004080)=[@dstaddrv4={0x18, 0x84, 0x7, @broadcast}, @dstaddrv4={0x18, 0x84, 0x7, @rand_addr=0x5}, @sndinfo={0x20, 0x84, 0x2, {0x1, 0x2, 0xfffffffffffffffc, 0x7, r6}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x3b9ac002}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [], @multicast1}}, @prinfo={0x18, 0x84, 0x5, {0x30}}], 0xa0, 0x20000040}, {&(0x7f0000004140)=@in6={0xa, 0x4e22, 0x8, @remote, 0x4}, 0x1c, &(0x7f0000005400)=[{&(0x7f0000004180)="4e7154bbaf1d3e498e22eef0a545fe141c7de497222174b349eff4b4aab7011e128df8625b48786f9f0fa67ba147376814a05d850b004f3dac823da9d2683daef5c98464355a82429d7f60a5e8be8eedd6f2f3d65a92004f3f68f47669c8770408fd05381ff48ebe8d9c33589749cf5637cf838038035438eb4be6d91e1ef04a33d8f23e0a2eca5aaf6272752fac79b4c66aa6666de674b4d562d45a9934f1e8827b401d425d", 0xa6}, {&(0x7f0000004240)="276bafdf3787a2f506e8ecdc9b1bfca86e45b1ee47be2fe2da5240585dd717ddb701721732bedc62eaf52b3ec813132d5a82b9cab7f667d9bfa315faa37177a0170baa3b0670dbe75014029ee4f924e8f58805893817e6feae04a6cdf6e89235c5eb9d5036cac2614de5baa53dc5b6a48708d726ae6440a50ddbc7c8f0c0421c13528030", 0x84}, {&(0x7f0000004300)="38e6457edb828d93b2427dd63975b0b198d9a2ae6eb4a806c3a008850254c939f7db02744621bca86eceeec098b05c31e843e580af04ecb88d3e5cfbf8941f8a546b3ab2e7ba4d2637868a15ef6b5967900e495a5ee1ed27eb11269e0cf5bff092acef568df51027b79f46fa0704ef2d617361046bdff67008075eb92963fae2368f3cff2e04a9ac85eca7543596d78678900204b89b813c27d3e64f633db793dde3b716225c325c4b1defb3666b11f2b51ff450c189bee010281e1cbee56c34469e32aeffe0211b51457e6e165d17cf483a6e2f74134dc09f29b2ed7aa338cffe1379f859c52c8fdf4b8a20f44f2a4fc3d268a904b2183b4e3fb627438420dd80c08c515b4ac9bde8dd218d24588ebb4774346133cd2c63c85c66d7e69dbab046cfbc5547c11b8fde755642dac6fb18ab4b96b291856a4bcb5cbf930596c579afccdb08a123b836a882f307b2fab331174dcd95fb602aec36de022b5c26d46d08ed94545bae1f99a929baf8064aa3b4ba161124b11038aea717442fb895f1c620554abc976b2f35d9fc7dc881a16802df3cc85cf3bcc23748b9443f9e04ed0e56fb103a070cd46d870eac056e5388ea6ccf22c145ecb7e2bebd931e5fdf20d85c5c866136353e9343e582b850afceeeaf86bb750b2832a543bcf45ea69d000cd631274bca900ff62fe4dba13539d31baa5053d25531dd0947e0bda152b32c8d39b9fea77218c64696d0f980df39ecfa9c23d686f5cdc26ad4f4885d949533760b5c77d2452df115585062ef0ffd84b95f4b75894c30535154ca13a678a5885c6691053cf0563c0ed2d334e54169d76b868b94a4f96266d44afa032364ed70eb175dcba91888f3dc2eb3b53ca00cd86c47aa9c020904b4e33ab2aebd4dd0849a90bd8b58456db9a67c95d7dce015c7d90a06d5f9c08324bd7435f7765ca02bbd6e1aefb01640e3fabed2ce34aaf86c7d1d9f566f1cf434bf7eadacb9fa2d441b975b25b0b755146e8105b79a224f0d824cbe60f1412ca5469aa19eac1b4a91057eec86ea79b5d5b791ea1129f47d24789cd835dfe74ccc37c915343edfeccdb0fe6167752f888d28273693240d64a5e2ad2e09bf3030f9d66eb4ecb8664b6d3398cfd2d56716e814af53639ebaab647cb1798bece593ee903f0b3edd9248cc82ccd843cf4e78c0329cdfea07f6a3f44c2ecf3a0aef09928a4e88fb786a6247582b13ddefefc31f4fb26b88277bf3a8b8604bbfff7744ecbb38948a9bd95bbd1f3c0300e4c32493935990f4898349e82fe527701cddafb984023b29dd72a58e77a6e50f771d78bacc3f673daa7010d1420a3cafea10412d19d9c0fe2b5a7f65756bb1f4b11d3c8edee939a6b3049de2fe32a980d6c0ef04bb85c5346f3014152ed7967af85d70627f4318691f4d844d714146487aa73ced1d71d52aaf2ee18c7a73ad133decbbb95345761aa39267d739802123ad62e66b4ce5ba54f3032e3d023e338f3ff46fc43cbbf16c3c68343a1db95444ddfe99bb2bd0a3b1093cbbb83badd9c5567df58a1d751aac7316666377d320aa99012c8207135a803dbb22302e062c76ad22b54f285a4709dbb2565de37c029ad2bcb12df3433bc81cbdaf69b415d81e052c685a440c9b849a985d141c6ab18c4c141676e85d6c376d2e0ca54fc0ea63607219be8b5737216b474a1114033a8908d9834d04c6428ba197e1fce9a0d6e6c772031e5bcd8efc9f3833ebad2007b4fdb5d11fc89097f7f384883772bbbd01c544799580515da21584f8ee1f34ac903b7c812dd6b53b8fc6c07841bc8b30f65fbb8a37abf03f0ad4a79b5fa919ca1c2f31217b3800f23014d0d6836f95a5d1db027654ed519d55774311b089c09f25d06c9ab65edd5a9d8887fa39b809403ebd93d3514d16e1cda68760335413e3b9aca3492c5433aa598b60e41662d93b95da228f54a93da77e8ea16105de5d0feca6dd1b8bbddc47ff6f261f89f5b24ed701e9a5c6dc47a6d983c8222b1b2ea0c503981af9994f4a7816e265dfe1f4ad81dbc4d44912c748742d112359d41efbf4526905a30d1452af8bce8ea23d28e02a78cbf8d300704e6a0794409a5d355fd55d0c5fbf57f05829d5faf55227b020eb77224964785985217b3c6cb81d9a2cdade75fdfd98bc7b3a15bb136f94044324adb4364d6d3ef2e500d691bb4cf93b1b07a0e8a4106cef6b64540d11ca5b0d7b3a6cc0ff6472a6a534b2b3d5b518157c91ca0632d9b2860d858b583f871f3a978341cf19f9774779eb0dd56b7bff52bae5f981f1c2234091fc8813dba7022620a5675d9d72cb4e4decf3381d9683fce8f8c08ddb3a64929b82bcde634311ec4fe116a25747af498467a3613d4349f62cd69ba4d19680f8b0163e805dd9f4f3f742f923386fb4fcbe8e7c45dcb3019f47820847db5d6c48852f5042515f0194a81707b82dfe541d2d61e22b711f3fc2b3e72af8ec163b396b28b6fef5af36536402c666a3ccf274f2c2330f11bcd93d6c008e9831c2e490f34f87e2bc7807fd8c4cf7348954cfdee6815fcc2772cf8e4bfe31023b14afc9937de1d37b5b22df038e0abe44729f688ea39840ba31d20f0b310b8b898ffc699a29bdea26917319dbc00a60878436559b927d79787434b07614046ea6ce34060d3a634e91f7acf6b17670302ce2022d153898e7bdf4711f5652c6e2959e64fb631ec276a7b33c54d7eb6e147a2cd7b909de946d6823e237bdbb7bcc0035a24dd20b61dd1a478387b4bfa9ecf2e7784d9e377772d570bcad9f9b8c25776b190d871e7393a7b6ee967a69115cf01904ebd727905520af6eee3b863393760a45548c54816b20246d17c39c8df0d533bd15bd334ae2192450fb57fd1cbffff3166a8bd42713f0066a5b1931d4d8aaf90a59bd0472e0b7da74fc50f6529b419da77f69b50f02095053fa0617f70402ac631ad127be7b30b1bbf83d0fedca1535cac83e8998ea686b51bd872d7a7004e2151de4d7967507c0bd4df851be08f844ff706a56a5ed0e7db7595e2a4a52dbe4c01a06e4cc1e9a8a33c7fd525e154199d16d926946a9b11802ed59c212c5470744093015d1982cbfc9b8e5a2f2a1ee2db3e43f9437d3f4875e7abafe8b95c5787c1c38dfe1cd5919993e6dae419aaf1527094a264b521ad797dc5307f82a9743b966f97a56902a2ab2d68e3af6ed9754ab9f6d9406f398329bbdcf51288adb2654c9bc30b5bfaf6a1b99ed5e415e86552c6d2bfcb4a8bb0d17473e5021542fb3f0d5f9081904c6f1a6b1dd2178b03517418f880e46c440b86e1d1458af7f9996bbd5e04be08121491207e23010e31b3de5ce428726b42a660520fa0375919608aabc8b7198aaa741a9bebe15c5ac32e973086c6cba52ee0fbe4a9aef85475dc822e6f2c923cd60de0b03578f2c86668bae5498e8b7477abd6a36550711a387e00160102aa900da84280d1f654e9b554371df32eefff7299fd9a479f002792624824e76bd0eb0482938d48ebf6d3163fa7e8a569c2d72c5050f4bb4dedf6e7cb2423c41e20e09478cf6ed2e19ea8dc8fb3f1c84bcf0fd44667e8ac1fd4f71196e0eb47e01016e177b6959794a1d29c07e7326d51e0dcf0633f2cf59964b3345fea3caa5a36e891877bab7e3cb7698c048c177f36c9bc1bab488201aef7e69ca3a0318b719636673aea6a9a347ec2689deea482962b701a58f60d5a36f21e517d853a2028d693fd87b615c1e16c37585ad723590b28488b1129dc2f093ee70a53d42310ddf4d712c620b0e41ec8ac7e504478c9b01cc2c1db3d9121b4e942f32c9a67f7c5664e8f936b5a74542d227d951a93fe9a915116c2b41af3a9ad5527d6b6055b7c96306b8e7edd1f637f8fbbe2595eda51baa1c2dff8296ffd91149162415856f22bbc8fdf8cd0c9d13f320074e1fd5a6878cbf22497950b040df31950d056f3255541dbd0d1f642db39f3d9fcc524e49b5d5f6f675f5245705dfe3a13c9aac06b6eb67e99f715f7d9a31fb486d07edf1f1f68961b0530ebfdbf50edc79aebaf14afdc6eb6d8b175b11dc15be76d971adbd0dfc980f6c75fbccd2c84cdea7a778df21666bc0284e34e4cda73a43467f9eb735244defc2a0ad3f6bf22975826b3eaab74b7a58c37ae468432388e7cccb3f54a38d2a9b7f2067f06c245da0da28d77c83ee762fbbbb432b32af6d1898e807a20a8e4efe57afabbbd3682f830e34b18154bd5315ea00c5ff46083cf074cdc2711b5215763188c17c7e55c3e00c88b6c8e80bfb3903da262c5f78d4c478ad6d276a3585672e2314afb77b0108ae30ff4f8866444a5699b5fedb357406ed385e314d7ebd97b19854302dc562221bc90b57651e1f2e4a83e4c53643de20c7f0483429b16cf8ea263e5c08adad8baa49d0fffa3d15589d8227a968be0a1b963377e248412d6af84c15aa83f683cc2a5873ae2b25770268e6c018f59246c0047cc586af279a5e9082e5801813a6dd0eeb220d404e9c08a7a56b23d82b3beaec76d8da6b71ff0379de6a62d20e5e8b0084e5a2bb173cd14523685317f60248e8048b8f7d287dd6045e2a64104a88c0ba9a7670e1e30ab05b75c66e305816a1b99ee7360a06cff0d8da93b370ec457f2182ac0fe348b5218573744c43645a0b6ca78a83f505bfd44c1e29bb5b92427b44f404d10f636c3b0f7465e6d690cdaa4897da1560f49286f991338a5159a1d55ca401c1380665aa69a8d04d2bebebf80fc1e4b674931da2c54a5cf60e4c67f3a6361303fc26a93905883a327d0ffbcd6050d15cbf1c868fa84ec207dafecb0f8ac888cb00054e4ccf2500b4e823c3d61b740d48a4219b6c27c0eba0fc97cfe06c0a33b1ed98c70cbe0d1c167c6180aecb00dc1896a2fef01666816132b4a5e9a5dec0d5a057df8a1ad4f04778908437fcad41f29f5326a94740ef3a1b63d4aaef61e3acf6e9e9a6253943f80c4b8dce3f5951ab952ed3cc5008b432615ace980df7499e81845f936bbc43d7d7f8d4124a61d6509c0de33542ec64e070a104343344240d716b347a908f4a5b6ac8aada644b960f605d61c3ebba2f394f0613dbdffa192fd2b40a7c86bf907a928d4a15a31e151d144e7d97332a244ea2eeccf780c689cdc170cd217ceb76bc6ee311e0a0145d7d39828ed85c1a37f2ad7e18aafe609f59c30467dd285e4c9e3d4f04b848e9fad64abd9d00e523552e7a4a45df9f26cc7366c450e5f00b8522e3dab897d1b43e5c625a91b133fc6a25c42aed2af79c00d755acfb9c723d0fea1f3ccf3b1c1cc10816cdc2d7d7307f743efb5daf8f6f5c6d1716568f8f0858e4cd6123d827b5e793d4904879280aba5c0bb3299cb9616692f931367a72bc2c8d5d9c44ba0fe5d1b40f8187d871d51f15e53584d4962f049167d8df2858aa3f7bd773e9ed38bed4a236ee4239d9bbf45ba6f3886475dabc78f26a0dbd38b128609265a8cd7ac6302335a1a4e25719730166d80c6c974f2df965c96f020aa77667b3fdfa399f0a497fd380451940a6a6d14eb05e55d5a4e56de0a6bd9d4cc2010e827b296041d876004e568a616e5ce89ef8de25615c49ab33ddb06806a8b5708119654354a084dd4007846715304c01936f4bcd5ecde5b83b820c94973a6d2ee735c0f84e7bc9f9c0f4dc3ba3ea3545eae8eb4b5a04a5e8c10e651a91fdd8e5679701d278239db8008fb2837d4f7ba8547c9d4290e35a66d52b9b9c0687452136bd8c61f59c967afd35f8214ce1f41e5e410286e999cfba720cee0ca2ad621d97a66a6d8082d722a3e58e8126", 0x1000}, {&(0x7f0000005300)="5bdfab1dd94e1c6bca8c1f9468731cb300a633c1c7bec68552a7c5375ec5ede38aba60feb5c4c365b2a894340f9e9af04af93bea57cd6e9fca0649feb1ef6e88e709b7322d7ec318baeb08fad5a98a021199f88bc2a16bb346ca4269a8587cfc50149657095b5a0848b558d21020ffd67b2c42f4c87f7267bf815a479b30cc041370e65dc41b2a529eb1d4a6e301a6086f76802b6e722b62f2bd11e4f0b17260dc664d6af6ae1b22bcc45bb9640237d3833aeda39343ff7c327eab65ffb552065fb2dce0729fef111fc5df987388d59e8c2e3434134422b6c92fbd4dcf02f26ae560aab7", 0xe4}], 0x4, &(0x7f00000054c0)=ANY=[@ANYBLOB="20000000000000008400000002000000060002000100000080000000", @ANYRES32=r7, @ANYBLOB="18e7ffffff0000008400000007000000ac1e000100000000200000000000020084000000080000009e4da600000000000000000000ffffac1414bb200000000c0000008400000008000000fe88000000000000000000000000000118000000000000008400000006000000ffff000000000000180000000000000084000000000000000200030008"], 0xa8, 0x2400c011}, {&(0x7f0000005580)=@in={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f00000055c0), 0x0, 0x0, 0x0, 0x40000}, {&(0x7f0000005600)=@in={0x2, 0x4e22, @local}, 0x10, &(0x7f00000056c0)=[{&(0x7f0000005640)="d2d08c7e3eea593a292993003d5339ae8c18ad6bcc88f15c5243a734b7106a1ffcce64a9251ff6eee689a8775620d5d60012589843987baf31b3b280e25790aeaccf241c70124ebd28c0ebd5cb625f4e00ddee3359e2e6b20db425d420c5f53180f77c", 0x63}], 0x1, &(0x7f0000005940)=[@sndrcv={0x30, 0x84, 0x1, {0x2, 0x81, 0x8, 0x1, 0x2, 0x800, 0x7, 0x5, r8}}, @prinfo={0x18, 0x84, 0x5, {0x30}}, @sndinfo={0x20, 0x84, 0x2, {0xc6c, 0x0, 0x7, 0x8, r9}}], 0x68, 0x4000000}, {&(0x7f00000059c0)=@in6={0xa, 0x4e21, 0x100, @empty}, 0x1c, &(0x7f0000006080)=[{&(0x7f0000005a00)="fa9d0d40ed10", 0x6}, {&(0x7f0000005a40)="454720bd6748d6b69c5416b3cd7aaf43c5219b929c591516c217474a3dd71c2dacc8a5b385b142422b6245dd8313d88955be3a9929c7dc136d79c5e1036f56087e74cbbe0c3ab6127c77eccd8250", 0x4e}, {&(0x7f0000005ac0)="2748542a24a448df5ee75a59ebef709de32f21b4363a9cccf247cc8fbc5b2a379977c507fb09e36a03525cab4114401fa2346aab9352b80a7f31980bc20dbe0eaa725540c54e9674f05e7888be174dfabf1a5888deff7baa2bea3114ae84ef2535c8c36fee5b355634bf34acac34d5516c4f3b86a37e888c3fb952dc8169958515572a030f887228d3ba3bbce2407cdf1136a6117cc58a0f7049ae251f88b1546f3ad7db319a9fe6201ab564047d5dc69f8797faeb", 0xb5}, {&(0x7f0000005b80)="8064d09bbc1ecc6ab65a6f7a8f09c18c68b67602cd579d761f048244a90e3aeae3dc3c7bbece985dc56cd1a84e71ccac393a4170860cd5e78e93fdeeb1050ded0d1f1ddb3692e064e022b0928c0387ee43a1d338c699de2b9c5da2b4ede05cdd4cbb4dd79686985071d06cda21c411b275414660f65b513513756f", 0x7b}, {&(0x7f0000005c00)="9d47a14f68201752b862ae1ada96cc318b09c6c3de81c09f63c6940db2285cce52ebca304c771b16c1c2df563f64637d4005733662fe0836dd0c17a3065a25df9fd3e20f851ec7725785ddd838724b33bc93252f6ec504179ed4abe87794dcd3a250224cf8cc38dcf8f35128bd4a5d3d901a4ddf8d46c3df6fd0e99d54a373a22659f86fc64ddb7144fc2a2588bc019a18bb11f9146aa5c3f63a3b7e3fcd58b69f288e760c9ed1419c4b2bd32f042784c7742ee9fff6c86918b33fb2b7e29fbd3bc78cc63dac75b468c403d94db2f4aca31a2efa2f6d8284d728859e89f96842a0db05f76e4de8095f00c62ef9fbc904a3732496f924f3c43360f52555", 0xfd}, {&(0x7f0000005d00)="f074f752c5593880b00f6fac9e367c3d6b160c8352d7771fd02d2e6c27144cdfae03f693462e71cf558a0ee838d6cca4adb0d3258a38668bb3a4f1000a769fff49324d40c61f5a326d7683ddab01640849a3263ebbc6320792f9b94883ccc4043d3cc4bd", 0x64}, {&(0x7f0000005d80)="c225484601293ce3734793af9ad4b6e386d7b80eaab09c49d8e7bc047ef43bcbb305a599ad0d42fea8f85a182c1b7281b1c2b14b65ac2c3a8926577564d595d43b490c9266824f56cadf72e2c933efdf4d20ae82d2e5acc9b29337bedc0f1e7f79bd87ed178ee87d3ea45be1412b4229d27b074b9bd33919ac27247fff96ec8b4fef8d82f418180229cf09917cf93ca585807e054873a30904ee864f6112b8f38c21f8cdc7cea390e91029ae39c34b660d683fa36d9b503c892b78352a5e89695884b14fdefeb317d3cef1a5c9cc0cc750fb", 0xd2}, {&(0x7f0000005e80)="9c26b72982fa6c20fd20befedc24745edb2c3ab0b2bf7494a0bc7aab6881ebf37dd5ff014febf28e5fd218eb69411493de50fe500d04ffa33efad03689ba56f929850b355f12c3fc12efcda548b60e4d0e141989de5bf3667cfd71a8bf1d49a00832229e7cdb6a9e4be2e5d937a08984d7f860f71c4b87e329daac720ff4f409fb5e22f91b01bfdb966cccd74172d6401c42e959cce1174b22d2feee4aa72441bb028aa3989ccaa88e07b36ecea52dd457", 0xb1}, {&(0x7f0000005f40)="68381d936a3bb0828a2b0cc2c271cfa1515d809d1aca7d42d1ac52354c9b28d0781d704f58da210b3f61ab84a96d61cbb19c", 0x32}, {&(0x7f0000005f80)="38ffced16c19f11f8ffddfa359726497e10d41800a4fd8d867f6b7aed4e81316b4162651c220e2ac662a5b9ca6906645f1e5f25ed14aca7df8902a24aa113aeed83d2bbbd72e8a29f9126a185b6e4566d6f2e91997ad3ba82a30ac53049745d1b0ca26c098a28fd0f62ab8e632384e34787b80493ab718c3ae1363bc2c9cb985d630df1f43faf4a26c3a6c41a31a25647ee978d3f1e80d509cfc9d33e109c114fc9dd2bb55f61e45ded26a8ccb9c939279f2a38f4f1d86dc651bd116d15f0b86ed860494e4553184b9ab83feb0c9e61b10b8761f1a0bd901925efb89dd9cf3283e76f98e1c", 0xe5}], 0xa, &(0x7f0000006140), 0x0, 0x4000}, {&(0x7f0000006180)=@in={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000006480)=[{&(0x7f00000061c0)="4dbc0837fa7f6ed753df932d793a6c27ac052693de1b", 0x16}, {&(0x7f0000006200)="7ad51d07ed2b393b240422", 0xb}, {&(0x7f0000006240)="2331fdcf03ff68f1da90c5c03f50e250bc3a96a5570b9386b66b19e2ec08a21e397d07eb2b98186e0de2a153d3e3d58654e6a66b5e45c9db66833de24d86ccced02f779b6976aceebffeff9ef9cd635299", 0x51}, {&(0x7f00000062c0)="a9493fb5881facb25353366ff37657a5be999244fe5ec5", 0x17}, {&(0x7f0000006300)="3d76008298600b3678caa26e8a5733317af87d6953b9e785c65d4eec0aa2338448bce532268c124f1fa45113317d50c7ae835f1e3a599e9d2b9bf5effa2d0a37dc09f7964521dd845e64a658275f684e15c901eaf016a99fe3d1618a7b4710c1c6ced5b185ed83258ded341258afd310bd2059d15911c6949a7aca701a9d1f821c526cc59d87b86f343cf7ca44a2f13b6d22e27ed92003f15fc2ff6ba45d21b6c34401a5bb28dbc5c1dac07ce22341dd6badcefe0c43f88c582eae87e336533b", 0xc0}, {&(0x7f00000063c0)="45bd6897b04286cfd8933e43c0c90d8522b71284506558d846269755b21daddc11af81ea414e13e477acd3870de31868c05288378bf6a5dfe3bb5343b9992754", 0x40}, {&(0x7f0000006400)}, {&(0x7f0000006440)="8bd528836f346bae15b42c3d708f966072dc0c86e5c5", 0x16}], 0x8, &(0x7f0000006600)=[@dstaddrv6={0x20, 0x84, 0x8, @local}, @dstaddrv4={0x18, 0x84, 0x7, @multicast1}, @sndinfo={0x20, 0x84, 0x2, {0x1, 0x1, 0xff, 0x3, r10}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x100000001}}, @init={0x18, 0x84, 0x0, {0x5, 0x7fff, 0xfffffffffffffffc, 0x1}}], 0x88}, {&(0x7f00000066c0)=@in={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000007a40)=[{&(0x7f0000006700)="1800f8d51a727b9f94fd4a49f05e0340ded9e1b280533328a3a938ec23695d9f52ff66a993cb12ac10f9c6a85be6d8d2a55bd100c207f7246e777c575309f103fb5a979cb55871c6f51aefd36b924868806102eb611310ecef8d9939db9dcaf0f94c239d086e56a7357abc4db7ec0def9d5685260fa3fb6038747bdde7073abe35d138c1bf949cc939286acdfcf48730fc0633a467c6143e6bd8a1f1e2988fbbf591347f2b0346bc7ef11cefeafbeb02564d56ff475ae866ef91c99123d93500a11e9237063b4d9a470fda324481a15867cb6e46930eae547c", 0xd9}, {&(0x7f0000006800)="43c0e3b4b241", 0x6}, {&(0x7f0000006840)="47580bed6f1e65260814c4371f7eb5f55bab38de9708af9d4d2516fd6ea7905a160e14347777f0628a80d157f221fcc67a347b0b395a6c00b3a304e69a02bc78422df3a585cd79ca8e162b9e5e425f35ebf9c034f43019e4bc62181762c368b0048dc6fc01b6c0171d167725b36d1cec1bb14a0d1cb145868940257a2fe3ec2daf26f5649c612046bfb533b14bd45b29fe14368bf1cdff07511461d5728075af252fd088bce4af48961cefea7341c7571f0678d6bf0e2f47944671977ff19ac694b7a23aace7da6a389116c7e95163204a1914c67855d38de622e9e2bfc267b6a83497bf9ab89355e18d6ed857a7ae092e07ecade0da54c0f71454d2", 0xfc}, {&(0x7f0000006940)="fc838d7d533af992d819834e5c1f1dcc5968b218aa8b926bcdc94027c098c9ac02665b41d4658305dba558fd8757f0847a4e05f68ffd6ce3c8b9075b29f4e74cd9b96c557601bb5481dfb55fff1a71bc274f1d4462369c186e35f4dc988cbe038fa25a762bc40f61ec8ef33338f04da63acd6ec09bfb28d31e06f62f781e88878e67bb46475766a2a489ca1eff5be2633f61d8ca9f9c89848aa45f073217f568263bab252f529929e5df23b9bca673427da64a9d48051338b83a991849820ff71fc9e6fb93c6937ac18ffdc6d3996b53add781a730d4e5c27835298b62eb8659d277f24e8f82c50dc09bd5bf4068e5d10bb1086d0c3b789f9a909fc34010196643a5f7401518aed7494728115b06c9133411c2f955f42cdb2b67d578e0919e48cf9f243109c77a7d66b8cc977416981007ebcd4ad39df6a6df10a6fa1c198ef7c0c8e94c06692fb0646a126f26983b7a5b880ee8f2b807fe15649468a0e7d26e037f5a0ab3819cc32183f92bfc1742b35f3bdb380d3474adae12a4f1a1e080a7bd49e2a33712ec8b5d9fd74d229a1a4f02c3e3c67fa2c36656488eb0b901185aa66c557e506c155413a1cffd6675772a5420fce019606c7de548f83b1b800f24470a6d469ffec52a55cfb2bfccb69ffb13d113f318440c1a0301b478f6b6869902d4cde54491f52c822e68dad73746af58e6ad7e405d82cc5ed4fcaa31c0dd95f73a829129f0eac036b77f8a3681d77086491ece002347f66c8fb9bf904da090a8ebb3fca63dcf9614bc7d9c6131f5bf93e9b4eaa95f9b086388a2af56367e4eb93b838de58b304b886d7f7e52c3c79725c7b4962de1bef0a878bfe594d30638fee8056123eb4ae01798b3f187bdb32cd6b697059645ed698d61aabac3c5c4451abb7daf9d903a505307102b489265fbf5c23f71a0a4f5b54565fb014209e6f4096e1859c73af745450ba78dcb2abd3fa9c4b1b7b4ec85848a077e688a247906cdae9627a429c1590cd97c312c682649f2b5cb0842c7d2e4304bff2bdd553e2e63ce185b4b7ee7b0a4ce20b3d3d91ac6fadb9e6c82ce167fd0e1359bf2cca06dea040bddd0d98668ac828db951a5025b3c41d8cb973c29a3fbcfcfc90c4679f7396d45b194949e09856a568c59fca04e682993e4d08bff48cb3e48e087e88bc8368538436d6f6c5ba33948e2173b088900c1a88fc85e2bcbdc2830bf8e6b290a3d1d08c9afdcb80738d08a1aeb5ee73a49c0e25b564fc77648ec109483260683ccfae7a1cd11c3542159f81ed15cd5cb30e706504c94371a61f9012c45d78925c3de0e46dbd0555a1f57d5219a7e83417c17560a11cf380caada7347759d98c1be04cf643951b0a60784327a80ccd8d842a8e7a45c19d6706bb0ca1e11ad0fe492d458021b2e522f84089921c5f8a540f1469497fe0fe43df8327ed9b5eb33c1334f59eed998222921a0df9b1069f7f48de6e4253d3d576cb1a5bea83a60c94a65a98877c95d667e73ae8e9c80ab418cc84d605df6a1aea20b3ae24c43df95a322350fd875c5b8827633181f18ce97e3aee30478a0f03cca2fa0e47aa3f5d1ffc48353d17fb21e61825cb2674166dbb0545beb08edf6d22597f2901b688cee8f26fdbd889826e5dc33c68972c578e5996d80e59101681926dcc3084e554fab8e06b374ecdb7de0bf87e07854ef0d6eaeed77753c2799c1fdd3de3d69f5a0b6822a82797af65caf50a45dcbfb0529c96f77560965aa27ba3d07b13ef63f4411f294bf578434966929787bdc13b076a805a6d245f9a711e397947f09db2aacecafaf099f5cd2f5542a48a0c04904722bdd85e4070edb5e1cad319f0969c08970c4a2240e894fff9663462ed6ea1161aabbff31b2ca3f9b4197c972d96cf1bfdaa55ae1a9acdcdd5152702ceeb6255da58f7fc0a191a68b458963accf0becb83b82e7bac1d4522759e94dbc5a351fa6500d419c4eea0ea8561a305225beadba5d151d9a0c809c8b00588fed7fe91708db57b9bae18e14986eb11a7ba6105a51411b1fa5c352016dc3bd6025a6208a5dd9ac50af433c4a0648bce7b7a007bf1918accbf5412418dfa1face5df929c8dcdb00430dddcfc9bed2f73cb5f14e210bad95695ff8d7766d7bdc9600d01053150f42d99a0fa4196cb0cb2379a722ea399c6be3b51820cafc6b03ef69a1a45aaeee69c70514b12b0b02fe05bce736e69d34eae25448415f8b042331641989369962b26d89c96ba2266f0114104ce89721453d8f5834cdf892cbc69f63949f6497ffcbecef78a7bbc11a4a85ee06a3a2591fd8dfd8af7b2ac8b566294247df75e3adc969cce0ff11aa940b8e0b649596e8f0b6b7c91417487527c9c8beeea66aef4626637ef802214a2d0c93713ac2c9acacfd8cc8925753cd1ae4e4339bbfdff234efff231e64433e38f25d449f49165c5d9d2fa481c3ef6967ca18991ee16d9bc96d07b7fe2e1beb0438ec5e7861b5b76b02fd009676f5af9a06bdc528b7c706a41a154ff0f93f909458a09f4f2560fea416f64e86eb22f92b38ab9ccd962f59e889e358f13fba8cf93ee12dd39644103118eb407f0b0edb5ba65bd1b7ed5fb00cac40ecbaf2681ac80cd5705a59ce488bf672c50efe020c50e77df124fc5f3f26ec0fd552dbdedc2a6046a93fbe4b5146afd58c4c4b9d10eb62ea46380b16cd37a4bce6e78ad94676e60533ac0869e5a850ee78552ffea80eda3965f576f640a4f0e8699353b3890cf13ca22be0654494a1070d2ad4df739d9d39812760206e3c2bbe2e5a38e299567e90b43f87781a751caac0f8708b9c2785aeb87abeef67699e3a7d8f8f6c4583981c3e58cc9bcbb1e60714389ab91c4393256c478f6a910e24bcdf8eaa0e6460b58164d683080821c3bfd9a2f167024df47d46c0d98339aaf4c6398ad0f26ab513ef4ba38daf4705b37f247d0a1f5b86c79bda569c7220117426c81049c9e1d2985c4d1fd8f80c46760b39c33060e3f65f0ca680ad6fdd8a65908169276ab3d8746124130e35fcab0aa128f51cd749df19cae74d996d39ba0db4e93d77569f0ef11ed27c1fa84bb719f905274615de6aa74a1fbce2a1cc9815dab7e3f8556da923eb854d8d973c7d33481c378ce57f50ac54d0428f776510809080b4e695fabd228c3f25c9b93f471b046ea9840198ff7fc1d893b46a26e4dfe88abf0a1b1fa8b690134d10a7e01e20684e95d705930f4c570be4c3bbe1f11464ff1759e5e728d6055f2f103c168e9bed4e36e277294845e91c24b5763cf820e7dd3ee5309ff5ab381d90d635e0d7da9848fc793a5935cead0e2c112879b40d6b7d5398f524937326143c0c53de220f74bc3f06f864e7905d8504e7de9d275bc5fb3302c1f43c96ff5bcbe0ac13f481b3176d8b2095eb83102fbb42681e868e629368b0a8d188c1479d7e92aa9e52a64e34f44c53b2466ac2d5bfdccfb4f7f805b3f89061deea4017a5798a2b2dc20adae9b5e505a65526140f81adcdbe288d089af716690fdf9656938e8de1be14e50cdccb52f6815ca868c44a3c96f1e40401ebf883cb777f05b26ee0fd9a1276d2573ebabeb229f9e11b868a44514bd0068afca1496011844bef82eb49085082f9218fd4f7cd828561582cbf4f7f78424dc94787197bcda8d9f928a39cd0eb59a3e1df4ec9825725a464b3db7f3e9f7f125727d868bfbdf2520d06dbc8dcd95fbc21a3180cb438b8b8df6ea3a69d6202dfee02664e6a581969f533080df00061e63567ed9a050ee8baddbf354e1a5707bbbb3ee85ff6d6a9dbcfb3bc6b8a6dd205b3df9e870b2f99249c9d3af1b3bb12786e5e7ebe2d264aa3b8e2aeb8e8152b0232c8e35873583ef6e69753e868b693538c44101f98dd1ab64b271eb7a978c8cab5feb7cf5f4929a97ea42dfcc79cccc9cf4a5422f105727b7be4e4f3884e0add0929320e61351eca246f5081c93228508a3b360f2b5c4ce56669132180ce7e1822c18987c8b1bed91b311163ae18d11379d6756af18ba512a17ef6798fc79346bb73cc88b17b4d69b18ddc0ec2b4ca422da1e969e92a0db5b7b1c383605cc0e860edffddfccf0a495df1c997aacdeec4bb38fdfef4dd0fbd180e7fe0bc2cfdef2e25e5de77b29d038519e97e4ae92048c4734d1d3afaba21d76d966b2ff231a003b8b822b92ca556eafcc5e5e43f7b3d83067893ac9ea2bf38d8a98dcfd5ca8734ad65762214b6a828bcc98c551071f0fe65cba44cb0ef3d52b27800fb5d37466bf9d031b583612ae6066a86d52f072a5e1eae5fa1e80a7047fc36d79b1a421afdc496a7d5386f35513bc0b3a87f470f9002b993ec4b75366f9dfa7baf8c3c02393f203cb6818260f4e816e0e0a85b87b31ad7f297a747146caabff322c2fdddef45286ceb4e330dd7ecbb8d6a73cb9531b4f69700318000d8918a772139872280e75f9b93e30b283c42f514ce30634be4023760ee811af9cb493bd1e72dc610549030ca807a3f68ead85efe58fe7ac637b53e60ac208c972b29b5ba6aa38c0228133dd0755f9e1ed4b2edd40aaf0489c8db2178e0ab7eb25cc5c4a1be44fb9ce19b132ccc6457822ddc7e47efd2b5b98a9bfbcfcf3c7eabdb30caba8cb7f6a758ec00d0b3346accfd880193570218f3855358c7085f5e31dea272f4f3a735bb0afca5ba8e3a0ca70e81eee992ae92b1797c82c4cd1fdb2817fff3a9c9d38279d8745a2deb2a425ccec385623142dfc8474a5fb919d037ce8812a0c059a87311866aea373bc150c5b899a7868fee8ccc2844681a715ecaaff2bbdf43db7451d5be63c257cc1ffba570281354a94989125db6f78bf7e0c872924f6375e34d49860d6d8aff11ad5a362addadeaeab84040e6cafa2156268ce0e6e051eec5ec443539033ef0dcfa8a3d240838786f35e5baa3117c27fa831556d097364d31cb976577c7b81d47eaf4dca4265c6f6fac09b7d5de990809dc217091acbc3b73ecc2e3de6f7a73826d3f03c4c5af14a3adffbb1ba60a3aca6e56413993f3308589a31bab3d7511f3adb6492da38856336fe5b8c1828f525831fa447fb80fbebf5d35c75fdef2a5d984c703e4e18c49b93bc481dea419a6ddda68950e46c381c069894ac2177c153d7afb1ed5f29875f060d3d12f34ca8b20463298c2ef7142a0d1088990beeb3d52e1931beab36f88c32284e1d777f6aea342556b436aa4c3e0e64cc3517ef2ae0c7a40bd5aa930431e3fd5fca0e56021a758c1c6e0e9d0cface89630850f36e6708a3463cda26ebb62918276ea309a3e215cfa62cfae7f59b2f65865a202ad100a06ac5198c5ac047d94167c67ae27a79e62e3bf25dff8439c35bd5d4705a91a8248440c48efab143aeeb3f9981cd026940e046b2d7a7f1ab730af27ce5876809a698d2af42768fee089136cf6ccb556bd7160130ef245469b2f0bc653d5af5cb6b0b32720fefffe907416c0625baec2e2572fa334ae9b1900b0e21d6dde74ccdb47a7651d0fda1a83d85c0e9e1ade84749cacd9c047e78c1d251bddcdd5ee59c52ced4019b1d904f0338282061382b95d2d09aa1bde5d385b459c5d5531a4e2d9e59e232ec9cdd605c0ae930eb1370c7e4449c9cffa6989ec91515b678b1c9ce3f81e7a6087705fbd38b4be74ee29a8443a39261fade54a30b36640d9ac88675d1d026a8be30228a23b08b51c9a8da5f0d3793ea1fc3b8f52c71a23eaf1ad3954f8980e9dd3c9e2fcdd76a3284227ff400e292bec9add71017f23edfcd60dac201e4c287465f3ee4f9cea52394b7f7103afbf5dc22a7499c977ef8a", 0x1000}, {&(0x7f0000007940)="fd40b14e04396a62b4f3a4e7e1a5edddb938d82144d4dc3a73eb5258f52fdccf302f215af469e3c33fc6006cfec378193f3b3189e0f9113f5fa427f3084c142cd2322ae5d97d499e1afb03dddd605d27478ac0716df9286f996126fae260f9b85c3d2530ee8ba82817741fc67a016ed882bc427aac6af14a8d408f0b70ab8ac7758779621ebb687059e9bf62809032163de31590e169d1ca1031c6c2457d602c7b89d85624da8e35a96db5943eb8d05b2ba9b28846d530a6e20fefff5a330f48991f3190d3e7d1405acf27c3bb084a13559215bf78f76da276ca920dfcb25e2897897472f7cd5b564002", 0xea}], 0x5, &(0x7f0000007bc0)=[@sndinfo={0x20, 0x84, 0x2, {0x0, 0x2, 0xb2, 0xffe00000000, r11}}, @sndinfo={0x20, 0x84, 0x2, {0x7fffffff, 0x2, 0x2, 0xffff, r12}}], 0x40, 0x20044010}, {&(0x7f0000007c00)=@in6={0xa, 0x4e21, 0x800, @mcast1, 0xe000000000000}, 0x1c, &(0x7f0000008dc0)=[{&(0x7f0000007c40)="ce659c9da98b8a0e3c113353", 0xc}, {&(0x7f0000007c80)="f58e7f059d2f567f8bdc69d056a99243d6ba44b448c959001a89a89283710237c790ee0913ea6f5db2351148d6b60fa206aca3bd830d0c6b1cc6de69fa60ce515a2cec20832b4625e7f74db090200068cd5faf7f5182eadc076dd1c39b91a4b3a586f369c4cfbaa5fe724c0c860cfed91c61e1ee5d1f26e38b4c5df1eda3545ffe82b94703dd48e694aa81f7320e46ac14aadb60542a710f4f486e2ba9d10312f1f2", 0xa2}, {&(0x7f0000007d40)="49c71fad23818b5b01ed63d84d175ac86186d6abfb6268251da87cfad997d841c798bfffaa9b9296775e2e7683dd31e96f1e90c9f2b71982bc6ea66c1352666d163a0c3feabc0e62324860668729345500ad72b577e55344a1a9fba3b0f559a4eabeb85c4166f60dd06c04bdf1915ce3fd8d7ec7159cda3e50d201dc37e13f96a8c2115c58afd9800f192b4f3bb0b583155948e06f778cf440a8592f463bae2e2e97d3e0a3404087b6c93eab44ec4ea1135d5c62ca0ddd92f9f2ca78ff2572c5cee31657904527e7751fda5c123c88a77c9f15d1a825d4525b3ca5bc2b50e149912e6f7dab7dedc4d57495b9cdaa7d030c285c3b26c041702a7ce922df3de95c078999a6d9bde022762c5952f476ea93a9e0dd4db63f02a732f5ac08bdf51ae71e48e26123aa64c0488cd86e28b98a2f7a23ee485ece0d067aa90c2d6034df60d1be26f0ca6f9b83b63d5f1bceb29f577f163d6f7f1d4a96d21c46dad6fd516fab3aa5255e3f40d24c03b81b8d67894379ec28a2a0d3a4ead993fb3d08f95b8d960d465cbf53846caa49fa01eab0c79cd4b77dac0fc6783e1e36db541792edeadd8b95fbaad31f24b084b42895e3d857bab9a60ff1d69363ed59becd2a49897ef792e939cc9a6387243dc885bdb46e3b1ecffea00023c999eaade76a4b1b4f7317da524ae2f0fb8b61fd42515fe9d3ee55fc4a355b14784e9326cfc1a5ed2da949310f5388d7506270924949d25f8e6b47e39006789c5972c62ad1e0455d3aba4d4fde509ac2c50fa60c120eeaac53390e01d32fbe15980715a78a5b2870bc687861b798ca56011c4c26beb708c18809d1e00d6e5ef6186d87c82e5210543ee81e9ec361f10a794c8435f494f230c6b3f682e6a188c7645e7bc9fd92b365a951db38ecd33e326a1c4808097f1a3ae3caac26d73913d9d541db51b60d54501eddd6e0f767681d28ab877e9d627d4be8ed974f400ce1fe18c1ceac28641eee88c3157215e776e8e364cff217b05e862c870b755affd5a7d9b35a26190066fc4a17fd302b5650daa4d8b315fc231b019f65cc5fbac1c26ee43c33bb2c898c0d18028629ddee769b9c2e17d2d113adf48e4106a694d96066694a543b0b496e44245d4f5e3b204ca084ce92a087e41dce04b65a632087756e15204b4bc93e5fcbf5e4687d7e7eadacda6d7caa615805a573c891d49cde580bc62b9836499df4f11d8f926b87e72c3f188f9ae01a22c8fbe7e8c8fbec7aa0f4b2ac41313eb18a0c17e4fbd9e30a4ced88adea5338264b3e952374ca814ba24b38e4c555356ab3fa9ab489d217a1a8af5d8b7e3a6d84bff3a79ef4144f7685b2b4fac7ce597360cfbb93283d759f4b22d065c487c7b5cca83102af3e14b6bb1bd2bdf7cb2f1faab914c39452d219525a1383fd542804b12d981fce7adc3b1cc819c20f8e6914b608eb7cf0625b6495e29395c0e7e4c16d6565d3bb2d39cfc409fe8a88d59ffb5c377386d3f0df6074c4ed8e871cc0c8fddd7f432c4dff3c43153a6e7c790bd3ff6d411b91acae027771f9761d8e9d292833ba4be1b3b2da9325fa6d944b6c0646324ebcfaa02825b6a86e37bde27f1bfc835d65732272008385b1dfba6cc1608002b53537a74b873d660358b9543f285ddd4525e6cf08a21fe5f49d5575ae609608a60d842c624ba1a368850b840d3e2b3c036c9597417698c11de453ad8d7dd9fedcc63db8764181ffff382fbb634ba32683b1160edefe66b0804b2ec2197a1b75f90d3b9b1152e825371bc6014a49598d84c0ea6b8be6f3289beed4b3617d55cf0b6fffc6e244594474a140acf1e75f9ef683cc316f3c63ada36141e84c02b0f6297b45d115b0b7a86ecd7c9f86fe8289be7efc2defb5074d7847b5a11d27c447f47c7358a34f17e7edee84799c27d49ed20e7b4b6e70715bae2c324a182a3740364074bea128752f541140655e1afbd57355638e7a898c20f3c273c82bee6021e0acc3ae43bea0075443804150de2e84b90f99572ec1f552864ea382939ef453c2aea2654eb54ef9527148b6cdb3050ad137e2210bbb5768ce01bb5521022f48cc96d81c7e6db5b151b7c56ed05679c0e6a5c22a32173533ac41696d6dee57bb0b7e8bfa182bebee5e6b9f66e864b8b0986dd7bce7b39e210afd70fc6bfd44f4410e93010d349650b41a2941382171fd6e00844f3d68f70d3f3c70992051b71b321ec042d0bb5e331268e8099e18aae1f9d8b95a87d0cb8a666599abbf30b8964c52d1ce47420f1bd1769cdea5ce545d67c3f74f93c01830aafc7ced8d5230c01bc270d6b0045304f16e14160c858f9d14f16ead8d663274badce7df61bb516e5b474542efef4e7aaf7adf349028cbdf640df9c2eb87d3db76d0bd8c144f4b6fa04abc475aa533efc9a4dc40acbbd2ae9ea361553fe1da4967e7bcb5bd13e654c7cbd80a46c164c5a08be33b711e858dae3fb94a1c01f367900b2386ce50582ef61d4c0db16f7d388b6595a896cbcb9de0f24d939c3810e08cb3e04ec67f6c5fbd1d993a08885606a616817e3a963a4761d7a5d477a6f6b33407c7b7bf111f4dc4acb8fa90be67f6456ff8d4e5c3783acd482d9f40376bde7f412a0184b98ea3ee3474cbad70f603a52c66e3f519bd3d5736be5cb53b6aaa0aa629fd5cfb9d60cd6689da94ed048cd2eba96ed5edf12643e7f3e01213b1f76532576119bc7cb8185ac3835d450fa041367c6edee3440fed577535f7f63dc7c2651bfc5b5570bf5cd7659d12026fc0c9fa495ab3e9ee1d7d1b962bb8cb01e11cfbeef46ae3fc08ef1261037db5112f5ba74c1acfb9e95aa92a5a5394d2e1578713530f29d140663972eefd08bd0947ab114d7464fcd5123e90757bcfa7c204872fe828478a1e8d4b83579c49eb326352d56aae02cc893d97a03ea5f55ff12507626ba3806adf06de39f324422d57476bf976970d38d205f286d6eb12c6f21337aedd65c23c7f84b9584246ca2c26ca4a1ea713663d6a2611c5f15b7e4c9101001629d2e1390eff4bea38cc914b8b1ec433e8621ecdf80c6051b5c6428cfa44c84384c9bf8c082345042ac49b7047c45f4e3cf67ac39d7591d2b44b5329d07506dae13b9e967a9162be26bd7707120e3d5e43c1cab0b2d7825427f95d2a3319bd46e8d6ade3a909e0eef1472f0cd0f3503012fb7afa8010fa5dc0ef69b029cb0c4387aed6212744a1ef6c4942e24c91d26747e438f5b0a4743334d984db988018689d61c4b06b765dfbd7cf2102968ba8637094e41939bd31acd8977d2434994a0e8a28c2e82050096fab85665a2591b0eb9dddc206f78d45988310263595e7538f8044e86567c9233f94885a8ffe7e79cd5773318ed95f7607ecdf7edb0db37e2b6c6e92d29d2843ab00fae4d5533817819463681b816fd6f1beaf7387ffc0268ceaa7743e1abdb8194c4685aa8340b3c0176a8d38c7d56c72a36afc074fc6068a4fc0af08678caa069d62bc4a2c75a26dbed7555cd3d1c8211bdcf8e2b21cb5665b9fbd68107f3e0c2ebbe662b6050467b4bec39e0aecf1d3ce045be1033625a7922bb7f7b3996abde11e3579516b0188b165921b31149c172464407fa90ef6ed63a339a8b40d7cd9d146dcf39c627a61c3514ab2cee991f326909b23e4b2879658da78e12129d093af564c8e53904097295ae2ab42ca7a63c23f5848b1ada504fbc7ae026c31ff34958cce2f7c40f8a003e541bd78a65998bb632f1d9386ae61f69ffe501c24e2cea335cab03e5f88e9d96e3a1c1034c88250f559d5fa5b9b832515ce482160a9ca1500ddcacf6aba9d24f7e046430d438f045e0d78bebaee9026d9a60cbc802eaeb86e9722d199e5ad9db6fd1a2e78529c621baf4d4b2c8ccc3fa011635c1ebb00eeac27840177509dc97a6db67471d1f4d27148e1a67f488930744accc14ff01b986975a2a66284619d0cee556d456b1f09344805ef5746e3c450fb0cac93d3c3d49c6b528ee76d3aaf2d53eb803761a4d32e710f0d5aa863387034f4bcaed7833a559c6b1634e39992d2d5f8f11b8791831906755a5fd3c845ff7c09f0e4b9e7ac0522a5d98314ede833bc5fa7e065340d196867af94a99602c795ac34d5a23168dc66c6a93be91ef6dab8380d4dd1bb652159fe4a896d13129c575a6c19a47307b6507e67ab473960e71bc5d567f82dda3b3672b222fa3ae10c5d4810664cd8175fee0cf7378846045768806c32881a8e3749a4d54fc5511b30889a427224529646f1028662ae212fa8bb92d232107ab06134274427033b453db888732d8a1e3a581bcb215a4060f3beac12a22dc294869470c469acecd4224d1456e2174b0882c57f747b91c504bb19adcfde75b5ef9fcd7f1d6f434dc9da6c96646bbe438f5fba91271511c15c21fc0e3fe0ae82a5889536a0a13cdb75c449c989915cd968afb89258e05be7852dd81aad1e8cfbde4bed85ccb4d071779021dc716c24ba367be90d04c92af66de74d7a6495c5c8c8c203004a7830d242f96ebbda61dde08011b1afac8e8b20976ef4479925e77c67b25fff012b0daf42000eea88f7d59b8eb9a86ab2b3abc3fd1f22cad5ef6afe073c477c8292a5997ee502a884a54f002c4f58e888045e399ec0564c98cf0af57448f01ceb5e22e5d437fdf0ddf37bfd257b8d2b0392fec427332584fc95b6bc8f7d47d1da8510ea66399acb6893d0dc7b021db7425e4e5a8a8a206843ce34b4ad243113caa1085e05a4cc7c09ee9a75a39bc7518095bfe1174347220bd53cb31600a79b37a75d9bf2d06cc9d08fd1c91a0ffd38dc02269e7981b39f36cefd7ce29df8be81b0263facd529e5c740f250d07bb74013b3210a21a5e40d5ca8cec88e65ecf91a5f718d2fdd1c4136126d49031e5f6f167e5cc96414ce66adf6e86e649918270a0c62536696eafd377edece296cd504d98540fa9775bd6e91685c0aa9a721101a475d41c6c5b4cffeaa919b66e4a20d25bd7bc38f599e3ab5d2760a654da857321171724b3a17b1b9b2737efc2b986f8496a55b45bb52c3c644eba9d760b100dd268c38a634906e9563e18ed4ee6b53c8110e56eebea21a379b1bea6ab24cc28c9223a076ba13baaab6f3864bf41534992d50298dad605f4f3bfe142604d0ef95a898fb2654fccf9538605bee6e1c72bd92e7be8eb07d7e6bfe516650af80c1a189effbc0c79609814e1a05fea71c6c3913752afac582f8c33cf6e1ef9dfad5af5701eae48d3b48781bec5e2849f6140e2c20cdae2bec5b22e49512d19955ff11535ad18eaede58f809cf501e1c2b700766f4e7803eb1981cc47abd1a16f1a1b8a9f7b78bb9512fdbb523938593b526d9453dca28133f1965c4735a5e6ae4ed865590bdbcfd15789b93b2f61c17fd55e6be3209e13f82b1d6a02fdb305c2a9a9b9146e75c54a6dabb9be0796280cb63b488e98a57c9fe665dff62e9ca1b6bede66daa8d3cf16626bf879b4739c39ad5c6ebcbc261cc06ac8ab5ab67cf3b100192bb1224618b9e3d52cb38238fb430d381936dc02e4cd9f9644cf5efd8353ff6f8cd7c4ef7297be5113bdacc686e66c220f0e37985e030d9d8b503c7292fbae60e41717bcfc7428ce65eb2997db7ee7a6a6f38182e2bb0461eb5ce025fd0e52ebc6cc7139e1af4bcebf4aeb022ced2320237f1d453414d1526f586b1ed16daac202ea5a0bda92479d90e154a38d2570555dab3185d6fc6aed8a97eb2f9728ccf854ad26da84555762cd20e7778bdd9fb6ce21ff5d28b64c26e84021690343e07624811999fcb3cba2fb56f5847", 0x1000}, {&(0x7f0000008d40)="20db8c", 0x3}, {&(0x7f0000008d80)="c3374318a689218490e5ab12caaf500c98fd11ef9bc8cd6d2990", 0x1a}], 0x5, &(0x7f0000008e40)=[@prinfo={0x18, 0x84, 0x5, {0x30, 0xfffffffffffffe00}}, @init={0x18, 0x84, 0x0, {0x81, 0xfffffffffffffff7, 0x0, 0x2}}], 0x30, 0x810}], 0xa, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) ioctl$DRM_IOCTL_INFO_BUFS(r2, 0xc0106418, &(0x7f00000002c0)={0x1000, 0x8, 0x4, 0x1f, 0x4, 0x7}) 19:30:26 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:26 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x100, 0x0) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = dup3(r3, r0, 0x0) ioctl$TIOCSBRK(r5, 0x5427) 19:30:26 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.stat\x00', 0x0, 0x0) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) r1 = gettid() r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) r4 = msgget(0x0, 0x414) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000040)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) getgroups(0x9, &(0x7f0000000180)=[0x0, 0xffffffffffffffff, 0xee01, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xee00]) lstat(&(0x7f00000001c0)='./bus\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000280)=0x0, &(0x7f00000002c0), &(0x7f0000000300)) msgctl$IPC_SET(r4, 0x1, &(0x7f0000000340)={{0x5, r5, r6, r7, r8, 0x48, 0x2}, 0x20, 0x2, 0x7, 0x10000, 0x0, 0x6000000000000000, r1, r1}) sendfile(r2, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x15) 19:30:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:26 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:26 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 19:30:26 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000580)='/dev/cachefiles\x00', 0xc0, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000600)={0x5, &(0x7f00000005c0)=[{0x6, 0x2, 0xffffffffffffffff}, {0x3, 0x3f, 0x7ff, 0x1000}, {0x101, 0x4, 0x2, 0xd8}, {0x0, 0x25, 0x9, 0x5}, {0x0, 0x7ff, 0x5, 0x8}]}) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = syz_open_dev$swradio(&(0x7f0000000240)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000500)={0x401, 0xc, 0x4, 0x20, {0x77359400}, {0x5, 0xa, 0x400, 0x3, 0x1, 0xaf6, "2f0b1573"}, 0x0, 0x3, @offset=0x7, 0x4}) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) r4 = open(&(0x7f0000000180)='./file0\x00', 0x123000, 0x42) setsockopt$RDS_CANCEL_SENT_TO(r4, 0x114, 0x1, &(0x7f0000000200)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) r5 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x9, 0x2) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r6, 0x400, 0x70bd27, 0x25dfdbfe, {}, [""]}, 0xfffffffffffffe47}, 0x1, 0x0, 0x0, 0x840}, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = dup3(r7, r1, 0x0) recvmsg$kcm(r9, &(0x7f0000000480)={&(0x7f0000000280)=@can={0x1d, 0x0}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000002040)=""/4096, 0x1000}, {&(0x7f0000000300)=""/145, 0x91}], 0x2, &(0x7f0000000400)=""/77, 0x4d}, 0x10000) bind$can_raw(r5, &(0x7f00000004c0)={0x1d, r10}, 0x10) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r4) [ 750.614144] binder: 23904:23908 ioctl c0306201 0 returned -14 [ 750.756901] binder: 23904:23917 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 750.764413] binder: 23904:23917 ioctl c0306201 20008fd0 returned -14 19:30:26 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) dup3(r0, r1, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:26 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) tkill(r0, 0x17) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x8, 0xfe00000000000000, 0xbdc3, 0x8, 0x7e3}, &(0x7f0000000040)=0x14) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000080)={r3, @in={{0x2, 0x4e21, @empty}}}, &(0x7f0000000140)=0x84) tkill(r0, 0x15) 19:30:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 19:30:27 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x1ff) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) getpgid(r0) tkill(r0, 0x15) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) 19:30:27 executing program 1: r0 = gettid() r1 = open(&(0x7f0000000000)='./bus\x00', 0x200000, 0x8) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r2, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 19:30:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:27 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup3(r2, r0, 0x0) 19:30:27 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000040)={0xc02f}) r5 = dup3(r2, r0, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r5, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x6, 0x101, 0x7fffffff, 0x4, 0x5}, &(0x7f00000000c0)=0x14) getsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000140)={r6, 0x1, 0x308}, &(0x7f0000000180)=0x10) [ 751.766352] binder: 23945:23949 ioctl c0306201 0 returned -14 19:30:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) [ 751.866215] binder: 23945:23957 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 751.873930] binder: 23945:23957 ioctl c0306201 20008fd0 returned -14 19:30:28 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) futimesat(r2, &(0x7f0000000000)='./bus\x00', &(0x7f0000000040)={{0x77359400}}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:28 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) dup3(r0, r1, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:28 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup3(r2, r0, 0x0) 19:30:28 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r0, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r0, 0xae80, 0x0) 19:30:28 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = dup2(r0, r0) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$VIDIOC_S_AUDIO(r1, 0x40345622, &(0x7f0000000000)={0xfffffffffffffff8, "12bed5d5493e87d8d5f0fbf6de732053754a20b95a33471ea7dce23e720060ef", 0x2, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x1) socketpair$unix(0x1, 0x100000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000080)={'rose0\x00', 0x1200}) ioctl$VT_DISALLOCATE(r1, 0x5608) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:30:28 executing program 1: r0 = gettid() ioctl$VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000080)={0x0, 0x3}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) close(r1) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$SG_GET_ACCESS_COUNT(r2, 0x2289, &(0x7f00000000c0)) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x10, 0x0, @thr={&(0x7f00000001c0)="3d36046ca3faa323c3e3c5733562d92d277f6480da2cefb7d0118c4341dd1a36e4a4b75866b480a66f3e4c2c7cb97a43", &(0x7f0000000200)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) getsockname$netlink(r3, &(0x7f0000000200), &(0x7f0000000240)=0xc) r4 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x0, 0x4000) dup3(r4, 0xffffffffffffffff, 0x80000) removexattr(&(0x7f0000000140)='./bus\x00', &(0x7f0000000180)=@random={'user.', '/proc/self/net/pfkey\x00'}) tkill(r0, 0x15) 19:30:28 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r0, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r0, 0xae80, 0x0) 19:30:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:28 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup3(r2, r0, 0x0) 19:30:28 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101000, 0x0) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{}]}) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) [ 752.683611] binder: 23994:23996 ioctl c0306201 0 returned -14 19:30:28 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x2000, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendto$rxrpc(r0, &(0x7f0000000100)="979c3b75c8289daae009d33e4a02c5103825d790b93af79ab6882bc6d22933703abed51b52318c043500fbbb5864088b76c7d510ff56c0d53976fb71e63e75f47f3d9f", 0x43, 0x40, 0x0, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2aedd6df7c1eef8d}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2576904f4064667b379c7a24738c727c8b8396f75a31fc28e882757b88b84c9b2ceb0ee52d5270a7a3dbe8aa75fed00881aa7e7f223fd51523965eec2f2ed7f504747cc62e9e4d21e4a3049698d9fbe91ddb9652378e21cb4092a60f782a748fba01c507959576bbcdd6db8b7261d87aa023421f31d3c3edd4e189a0d48b76970eefbc581f0d8405b55c00000000000000000000f9672ae974c355b28b164431c3acbc2d681591beadb889f4b36a496591851b7c6966fe6c85bc5df18e351a3d2b4da2c86a684cdef1e20b04e24c131ae8666c87fdac524df926b61d991075ce69a452b286f85817527571b15837415d8fdc8d6e80a94380ba13bac85c3750c64be30ec035539bf326235e8f36156d", @ANYRES16=r1, @ANYBLOB="040325bd7000fcdbdf250c0000002400020008000b000a000000080009000400000008000600f8ffffff080003000500000008000400b7000000180001000c0007000200000002000000080004004e23000020000300140006000000000000000000000000000000000008000400000000000800050000010000080004000800000008000600ff7f00000c0003000800010001000000"], 0x9c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) fcntl$getflags(r0, 0x40b) r2 = gettid() r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000000000)='./file0\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r3, r4, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write$P9_RCREATE(r0, &(0x7f0000000180)={0x18, 0x73, 0x1, {{0x40, 0x0, 0x4}, 0x5}}, 0x18) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000240)={0x1, r4}) tkill(r2, 0x15) [ 752.782999] binder: 23994:24000 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 752.790295] binder: 23994:24000 ioctl c0306201 20008fd0 returned -14 19:30:28 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r0, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r0, 0xae80, 0x0) 19:30:29 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:30:29 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)) memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r0, 0x0, 0x0, 0x1) pread64(r0, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:29 executing program 4: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:30:29 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) socket$bt_cmtp(0x1f, 0x3, 0x5) ftruncate(r2, 0x2007ffc) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) ioctl$NBD_CLEAR_QUE(r2, 0xab05) 19:30:29 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000000)={0x0, 0xfffffffffffffffe, 0x3, 0x1, 0x5, 0x3f, 0x8, 0x10000, {0x0, @in={{0x2, 0x4e21, @loopback}}, 0xed62, 0x10000, 0x2, 0x7f, 0x9}}, &(0x7f00000000c0)=0xb0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000140)={r5, 0x2, 0x9, 0x3, 0x6d2}, &(0x7f0000000180)=0x14) 19:30:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:29 executing program 4: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:30:29 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x20000002007fff) ioctl$TIOCSTI(r2, 0x5412, 0x7f) sendfile(r1, r2, 0x0, 0x8000fffffffe) ioctl$TUNSETOFFLOAD(r2, 0x400454d0, 0x2) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:29 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x48}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f00000078c0), 0x2ce, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r0, 0xfffffffffffffffd) [ 753.795121] binder: 24039:24048 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 753.802443] binder: 24039:24048 ioctl c0306201 20008fd0 returned -14 19:30:29 executing program 4: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:30:30 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:30:30 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'ip6tnl0\x00', 0x700}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:30 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)) memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r0, 0x0, 0x0, 0x1) pread64(r0, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:30 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007dff) sendfile(r1, r2, 0x0, 0x8000fffffffe) connect$pptp(r2, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast2}}, 0x1e) fsetxattr(r2, &(0x7f0000000000)=@known='trusted.overlay.nlink\x00', &(0x7f0000000040)='vmnet0\x00', 0x7, 0x1) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:30 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x40, 0x0) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000080)={0x9, 0x7, 0x3}) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) inotify_init() ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sigaltstack(&(0x7f0000013000/0x1000)=nil, 0x0) dup3(r3, r1, 0x0) 19:30:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:30 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:30:30 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x40000) tkill(r0, 0x15) [ 754.839781] binder: 24086:24094 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 754.847170] binder: 24086:24094 ioctl c0306201 20008fd0 returned -14 19:30:31 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x513200, 0x0) ioctl$IMCLEAR_L2(r0, 0x80044946, &(0x7f0000000040)=0x1) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x800) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_DEL(r0, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r3, 0x4, 0x70bd2c, 0x25dfdbff, {}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x32}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x44800) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x31) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r1, 0x0) 19:30:31 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) dup3(0xffffffffffffffff, r0, 0x0) 19:30:31 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:30:31 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:30:31 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x2}, &(0x7f0000000040)=0x90) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000180)={r2, 0x401, 0x4, 0x8, 0x2, 0x9}, 0x14) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r3, 0x0, 0x4, 0x0, 0x6) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) dup3(r4, r0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0xc) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f0000000280)=0xc) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer2\x00', 0x200, 0x0) kcmp$KCMP_EPOLL_TFD(r6, r7, 0x7, r1, &(0x7f0000000300)={r8, r1, 0x100}) 19:30:31 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)) memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r0, 0x0, 0x0, 0x1) pread64(r0, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:31 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:30:31 executing program 1: r0 = gettid() r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2000, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r2, @ANYBLOB="01002bbd7000fcdbdf25010000000c00020008000b00020000000c000200085ce8ce0284d0dac0000500000000001400020008000400030000000800080001000000440002000800040002000000080009000300000008000b000a00000014000100fe80000000000000000000000000000d14000100fe880000000000000000000000000101df6a8b61b35abd023e5fa094f8fb5fcefe4f42b48cba3265da96f2e21ceaf1d405a0469ed1207e324257ef4dad5186a45cc3eea33a8c11b645803bf5577b79f7066e6b4e18f8544093cd0159b955b43aafcb2eeee849ddd041f79f937801ff15774b8db8ad5263746fff8438c089d5822bf49b0f428fdbba41deb95a83"], 0x8c}, 0x1, 0x0, 0x0, 0x20040001}, 0x20000804) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r3, r4, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:31 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) [ 755.937742] binder: 24129:24140 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 755.945259] binder: 24129:24140 ioctl c0306201 20008fd0 returned -14 19:30:32 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write$9p(r2, &(0x7f0000000180)="d37122e8e55d2c50deefba27928b1b887892a9ebf595ebfb558dc8a4ff3a5e11757d71fcf7d25155b9deafed4a66d4ffc3c4991a29037b4e4ac55721f8748788a055814d984889da232535e1f8bd045d06aac4a6f477461b73487b23e9ca25d5b098d258b1ed4e4fa3aa814f215597f7a8fbf79118093797d771c11be3bbc16a33fedc", 0x83) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') r4 = syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') accept4(r2, &(0x7f00000002c0)=@hci={0x1f, 0x0}, &(0x7f0000000340)=0x80, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000380)={@broadcast, @loopback, 0x0}, &(0x7f00000003c0)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000400)={{{@in=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@loopback}}, &(0x7f0000000500)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000540)={{{@in=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@broadcast}}, &(0x7f0000000640)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000680)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast2}}, &(0x7f0000000780)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000007c0)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000840)={{{@in=@loopback, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@dev}}, &(0x7f0000000940)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000c80)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000980)={0x288, r4, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [{{0x8, 0x1, r5}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xb0}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x40}}}]}}, {{0x8, 0x1, r6}, {0x1ac, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x158}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x80}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x9a76}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xec5}}}]}}]}, 0x288}, 0x1, 0x0, 0x0, 0x20000000}, 0x44000) sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r3, 0x501, 0x70bd27, 0x25dfdbfc, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x3067}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) tkill(r0, 0x15) 19:30:32 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:32 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20\x00', 0x200000, 0x0) ioctl$PPPOEIOCSFWD(r2, 0x4008b100, &(0x7f0000000400)={0x18, 0x0, {0x2, @local, 'irlan0\x00'}}) ioctl$void(r0, 0xc0045c79) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x78, r3, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bond\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xffff}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x80c0}, 0x4000) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000200)=0x0) fcntl$setown(r2, 0x8, r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = dup3(r5, r0, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r7, 0x84, 0x1b, &(0x7f0000000000)={0x0, 0x72, "30a0534289091f1e38c8722b36fa4ec0a5fd69f43706404425cb927c1f7e8f9a4b615b244c9417825a529f04cede3a3f6126fe8563511d79c8151542180c511e30d83b0e39c5db12811fb54769eca9b09c44652351f6f57592f281249b7fdd42fde46a45a9497aee68ec2869c090f899a6a4"}, &(0x7f0000000080)=0x7a) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000140)={r8, 0x2c, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, @in6={0xa, 0x4e21, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x3}]}, &(0x7f0000000180)=0x10) sendmsg$IPVS_CMD_GET_DEST(r7, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x84180130}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00042bbd7000fcdbdf2508000000080005003b1500000800060001000000080004002e00000008000400090000001c000100080001000a000000080009004f000000080006006c6300001c000100080002003d00000008000b0073697000080001000a00000008000600000000003c0002000800060001000000080002004e240000080009002b73ffff080006000500000008000b00000000000800030000000000080002004e24000004000200"], 0xb4}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 19:30:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:30:32 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:32 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x2, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:32 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x400100, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x80000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000080)={r2}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x4, 0x0, 0x6) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f00000000c0)={r2}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) dup3(r5, r0, 0x0) 19:30:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:32 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:32 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 756.981378] binder: 24180:24189 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 756.988786] binder: 24180:24189 ioctl c0306201 20008fd0 returned -14 19:30:33 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup3(r2, r0, 0x0) seccomp(0x1, 0x0, &(0x7f0000000200)={0x2, &(0x7f00000000c0)=[{0x5, 0x5, 0x3, 0x5}, {0x6, 0x3, 0x1f, 0xfffffffffffffffc}]}) getsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_id=0x0, &(0x7f0000000040)=0x4) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x1f, &(0x7f0000000140)={r5, @in6={{0xa, 0x4e24, 0x401, @local, 0x7ff}}, 0x9, 0x6}, &(0x7f0000000080)=0x90) 19:30:33 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:33 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:33 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:35 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) timer_create(0x3, &(0x7f00000001c0)={0x0, 0x9, 0x3, @thr={&(0x7f0000000000)="9b68334dfbcb3cf2d7e81a95a92ab53627547c5cf1e01de79030488dd3fee4dc9d42b3fa70668978ae8d860e3a05b19b0921b492029540eb6d9668232981fbd4a97d98f6b8aca32b76896466f89c6a987c666bafc8cb25c1101fa2ded712b51520b3977d77e5fbc8dea922a10d8b33cbfe345fdbe221c0fc3b0bf3cb2418a2200ed30e43ff6709e48d9f24eee283ee17abd478b1b63ecd2e93e1dc8620944061b6311e69462cc916e621b2f51ba2d4272687800df55f303228d2f7ffbde4", &(0x7f00000000c0)="5703a07419a89ad514060717cc5d44e7a468559e03e174af68ce6f17eef0dccff737e4d6e89fb3ebd253bfcd5d91d5da0e841a85c82a5d965b12dd0284143637a68e71887736fe5c3664fbb8c64c4e13e557aca742d35b0532168bc842853d88caa82bf37d63caf9df9328747497d1e000fe76ea8f9d03901ade81636dd74fe41e4d395432dad922ba662e79c153f6278d62b0c4016a2898b6e0cdfa53135e436fcbcb59f0a9751770827247d3a6a5b81b82ff1612fdfe72130d5ee36dca07e28930a515f7cbc1f29098a566"}}, &(0x7f0000000200)=0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) timer_settime(r2, 0x51078168b4d34d3, &(0x7f0000000280)={{r3, r4+30000000}, {0x77359400}}, &(0x7f00000002c0)) close(r1) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r1, r5, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:35 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x10, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:35 executing program 2: umount2(&(0x7f0000000000)='./file0\x00', 0x8) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 19:30:35 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x10, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 759.809056] binder: 24225:24233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 759.816485] binder: 24225:24233 ioctl c0306201 20008fd0 returned -14 19:30:35 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, r0, 0x0) 19:30:36 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x400000, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x855a}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={r5, 0x40}, 0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000140)={r5, 0x7, 0x1, 0x2}, 0x10) dup3(r2, r0, 0x0) 19:30:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x10, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:36 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, r0, 0x0) 19:30:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:38 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_create(0x0, &(0x7f0000000000)={0x0, 0x2b, 0x4, @tid=r0}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:38 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, r0, 0x0) 19:30:38 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = fcntl$getown(r0, 0x9) ptrace$cont(0x20, r1, 0x4, 0x8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x4, 0x0, 0x6) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) r7 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x10001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x15, 0x5, &(0x7f0000000040)=@raw=[@generic={0xa1, 0x2, 0xdf, 0xfffffffffffffff9, 0xd09}, @alu={0x7, 0x4, 0xf, 0xb, 0x7, 0xfffffffffffffffe, 0xfffffffffffffffc}, @call={0x85, 0x0, 0x0, 0x4f}, @map={0x18, 0x0, 0x1, 0x0, r5}], &(0x7f0000000080)='GPL\x00', 0x1, 0xe1, &(0x7f0000000140)=""/225, 0x41f00, 0x1, [], r6, 0x6, r7, 0x8, &(0x7f0000000280)={0x0, 0x6}, 0x8, 0x10, &(0x7f00000002c0)={0x9, 0x4e, 0x40, 0x2}, 0x10}, 0x70) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r5, 0x10e, 0x8, &(0x7f0000000380)=0x4, 0x4) 19:30:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:38 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:38 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) [ 762.922943] binder: 24265:24275 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 762.930251] binder: 24265:24275 ioctl c0306201 20008fd0 returned -14 19:30:39 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:39 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB="0600000000000000100000000000003e1e1b51000000000000000000000000000000000000000000001e00000000000000000000000100000000000000000000000000000000000000000f000000000000000000000000000000000000e6ffffff0000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000000000004916f6c8bd7ec16d000000000000000000000000000000040000000000000007"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:39 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x10040, 0x0) write$smack_current(r2, &(0x7f0000000040)='\x00', 0x1) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r3, r0, 0x0) 19:30:39 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x16) 19:30:39 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:39 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:39 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:39 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x2000000000141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:39 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6) close(r1) fchmod(r1, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000002040)=ANY=[@ANYRES32=0x0, @ANYBLOB="00100000f9225b76fbd066719a788219c67a9a041ef2ad1571a1ab83ec75f85a3b40d4fdc7b7756c7a2de941b341a36496934960a0233c4115e45689ad6e5e4217f7a7c90e315a77ebc997358d82b6a999a22295377af700620a8ee624cb48b8ebe387a36a805c735c621c0020930f80d3610ecdeccf41c6cfadf09cb4702a77e76f58a397cf8057a49e12b3f3a2aff09bb8a5766602776431ebdb70f56b8c10637c246688cc84d172cbf94517425339bcc3c9b29ac3b27a208f2f323b95e551c40f990f6b70f9f41405887258166d353b0023c320062205f9ec02b912fbb1ee1a8f27a5299e3811a220f50f374955dc8ee3f76c295afeb935ac6548170601fd31c9d0f94e1d881866b3f6cf6b19f6c044b6cb9663a85332c9aa5a32097b6100d20c34a5b4accba82da19c464236c1627fa6fe6dec34601d2d07b97486d3d8f9db641d6dc1ca3cce917019bcaaa56bc4dae983b17ef6e1c356666f0963154a8fcf481cf5f93d44b8dbb8167db557f77d0df86a8fb98ee1cbeba603ec823dfa7fdf8e6c449be2650ac33da20e7e711b2bf094ec5f21a5b67ad0bacddd88394637f9f2a70496e7a963074f680bb2963b44d50a5f1597056e6a66a956c60e8a5999a3c0a83c32e5d286be8d8a498bfabdab871a5cfb3bba137a9d697abdf6d51bd3b14a9464d6743ec72ea536dcb8b13f2ab690474d87dd9a6c57060ab48b3b3f02a14b255dfd44318f39ac4e811ae4e930ee9aaa5cdc978eb9a31566b337f21e9ad74b3288520d22a656fff6cfb46e7f27f6724104b0b45a649692807c3d1108519b3bb7d27afd1c9724ea6367b920d073c0c13435c963edd5a25e707c4512f31f64a44f7dd3d96cdc93bcd70981e52e110a6a4d3ae7a653b55a873b02f2adb233bde2f631472ffa5cf9d4e7b62e25a1901228ef0c67d7237aef1ac6507dddb33323975dfb917b1ca24467f05b5f3ee2e0d91b87df7e8de80b6d96368cd7fa4f26285dadc996f478cacc83a9765a1e0b2cfbb18d950b74aca233ae2a3ebab671a41bdfbef4cabc11b819af1c6e60a5c6b68c56c0fb674ed96fb209152b4844c2a2a6dbf7cf190bae0c37514b22f7de75fcc66bfebf20afbe521e68de8917ff36ae3f87a916ccd68ba2bf2b87bfcaa4275a9afa0f538f75121c9259b808ca665c99b61e176aa3e9c5fd858ca2b7c693ee963593a8e12c79b7514389337b6ebb1d023c90bb8253527b5489982ddc963cd337d5303bb226260c3587edefe085e3e5011e3e1002e6b24f8056f7cd7e38b41032d9bc50e266a74d2863b2496e89061f7cf53096b0d7a4a6b5eb08d771f5e8a18d1ca748dbf1723f7308b3715471aaceb228f511801cc346c3c38314ece4ce785d1f92ed675877c06471cf6f2cb4549deabb67f62877717f6fdfd5bda8b0d6e26139083fdf998036e173e78da4a8a6ddbfa8335a57e210b1e1bf1a15c8c1838998ac06f08fd5877615b58e175aac507818bc6ea730a5f3357de0a9b26a83d4abbdc99b83e5d0e050290b3ae87d95e578d8a42f5fe6c8cd3c40c1c83671ba0990132afe6b9f473e551d048f402df205958fe25af0a5255e08f0fd910b4d5f58eb0c9ce7ec9719e10b1f69ef4c64ceb4d7aa8308b88dbf48cd62357dbca44e040bdc735f43c1b64117e613d6730b8f4105ac6e918ecae0823f7112c71a028e5a7adf3e29666014c47a48135c841d84e90806326b251cb55e4fd22fdfbdf339a0bbd91d7630f8277079a14bff86079a9701353f15c4349753d3b93858869d5256e5b012ab745e009bec6e8aa5263a85630906f99603d05bb6237b496443ece38b86b7db3012d9e4cb1b1f77f6a7edc311aab1f55acf86844d5243985f057278b77d73ca4903b3a55195682c0ae86c20f579c69d87904ea1e2996ad928a948235b9c042f652ac634a13def4ad7f47fb67cac37ef22ce85abf64a8d6e50b1370c67025bfbe01a1155e4b12759dc1b224d96062b9445fdb96da584ca4af1af1609f60e71a4935c4703d26460bcee86870bab9ec1fb8bc9e6aa7c3e9c72b68e399e7ed73b3f1672ba4497d382fb464288bdac5db670faacb9b28f1903e141381a595720dd376d1e4b43c194d6c01fc042d71fa1da172d7816ab77f0d098187dbfbbaac9dbf18ff82adce47b376c81c710a471d2dae1a95b4b03a650d77761171c2327f126ae4272f5439a292b2ebab8b496b13eafadecb02f9c2b8edfa38be28bbc3b6fc944e3c228fe44b1c413088cb9c616a239dbc0727b2524c1743ee9b298420357b2cedc6629cfd8c30d5166cd51ef011b453889bc0dd7e683fc09609fb5023f15583ddfb1a30d210c001b85aa5e888480becaa211bf048a6191d10b469ef7f853d0c6182ace99becf9005336f44fc82ceb2a1037924153f122629f35f40919bbfc9c0672a1124ff99432cb2e4803f340eba9530bc98194d88d1140693a2e1a8b8f99d5d92c69bbeaf82f32da607cf3002a4e6effbde941024c9537cc30f47e2fc14395bee2e58c25d04a60b230d00c056376d805ad8ad1b568eff8784556b1e51110447096f107def6433fb7e9b052b2e2491d35e2853926c590bebadf254528b5b25dde5d89f15ccd9de29937c22be70aedf0918597bd2feea1c99a5de0fabc7b5e44f1f731611924b1a652437fb4c095049d2adc1e0f2530d719453b0dc75b8f6754b62a1d8f205faf2b04d62c7adf10bb30d6635f15f64a56021f7231605f74a07ce56b61099f38d9bb978679470bff1575666cbb0939f9887fd18cccaaec6522e5dfd1d7215bd3dd3aeeb8eecd5086f8d0793deeaf0e84190099aaf42117cca74e2ae2f29e138e8d34d3e9b17006c1f89f974a244affddda2a7374236feb0f871e1b7da04cebbe5a3f7a0034198aa975fd0ba3545c28bd8fc964ee03b9e70809e51d441104102c8d5c20bb001bbff2981d1a56c16d8f326096591b01fa2e9e7692c79cb2e8412f52ca2889ef4904f90e564f25be94e26ec9a623ed733f43ef60a6b6ce4a94a4fe286a85e409b231a67e90aac3181475fed72b792bbc8f05b0a1d82c82a49ea621a2566e2267bffcc67d2a886d53c0a9e367736ee7535647aa32377adecdabe3ab83fd30b7a497bdbd20e32774e52bb6aeb228ecdbd8035a4743f7a0f85ff6b94baddbf87d4d9a194494f38bd9dd37455d296108e9d32f9f71470a98d3e3c727569ff5aacac6f469cde5b46eef4ce20d98cb89a65686ab0be3baf8e2de3e64032cc9044abb1674c3ec31e9ad4161a956a7aae645eca14669844da8c839eb684f6999291c60a7854ecf952b25868e4f1eabac173209d779c79afac74fe4b73e609f6caef548d8eb3b20eb1bda93cdb75660f0a66fe76cd4c53ad948c6f1668e90f7d2307e399b0e110948509f2f13a1469a1f38af067b0aca009cb1c062bcd86738d11048bf1e41c83c864286e751d9d3ded764b43c7fe1a149841b0d219515fc80fe5563f06cfb037798e401153caea6a026d23232aed608d6e1d28979b854d07743c6c617b7f6128f781b10f6236dce14db1530bea75b294994442e90b009a2246dd491df4d324595cb9d1ca856152786db30728026380e08f6bf7ff665b6290997e0ff1cb341ae3e8e3683ca97686d9b9caa811755f2d9e6d211cb7462cd8d33d289af34ba01dd6264b6d6a6d8f9fc686a22d41081bf51e60db00e181491dd9be07ff0f379de3bc03a9201642fb71c3ac9d01328b8c3fab23f06897ad0b965a0a07aa69400f78e3b37d4fc1b5d8f3c10b1371e71e382062aee5594a02323cdc3e63ff3af223afd621da71881c03c0ac7cf2a3b4aa93cd04ecf5ddf49cfa30936990fee938584dabfafc330cbb68784b6272242e73fb0da741e4fb25ba9d1acdf0aacc63be4d07c77678ca5919e3e53b7a2cce27296bdb6b45000000004d98f706b3937986e942196642cb1725159ed1997cccbf52594ec77dd367bda5449c0bb740bf82727e3e52eec2e3455121c64eb3284bcd7201d88f2362f3ee3c140a41b779517dea17f476eea6deb98abb81ab694eb6372544973146cfd9aba7df0408c6e04edab14fb7d37aa6c9f5afa223aa92596d6879e75c1e6b91d603fd832d3e54f048b399d7cb02cabec47fb2437610096f66757ea6a8bcbd3f00ee773acf8d549dda7b60722419b4603ec22ff41cf79db1839cb18e9d5e8296d9bcfc020cb7776c4730435d45dcb5a99e1acf11613f9dd08e75b784abfa40866c4a74a477f56f6955bddf540ba12c4ad7ec5fcf07bbc17a9b33136bee1193937ef526a056724c7fb7bf0b45efa3cf6ee8bff9f68a866d51f75b77a0fdda5a1714e46884deadb6f0bcd28e0390c756bde4ba8890ae9e78db63ea70d20cac7016597ecb9f293a8a2089c74cd329d010d572552419f558f20a843bf39dab8ebb308feab925ddc889b36bab0b499ef3eb179a5e0df95871bcce09513d3130473f71a62f511232bc28a24a389d93cb4402d4ce7f7a845de708fd01be13c6763823e7750aab8a16b439a462b1159b7cce082aa96d7e1600552f82dee397559185f5b542bf0b4ccedbff9dc0ba3a944aa008a3ad1cb86ec6b854799ed2bd820969cc1d414c25666c6c464839ce852f675f788f48222268668209e05173f6ffb6b9878695da1f9bab451fc0b58d57c34110ec041c9af8e74dd364ef336253d94adc98ad6384ba2989f4176c3b2fb3c54cf8d78e23cf4de1cf401fdb1f2fcd9baad2ac51e39f58a25d9e49453e2237789a83243a707362b0daa4665947b332283e6f4b5ab1cba3bd10fc0b86830a2535b612d08647b40057f677445573be0559111bc752d540a2aa0510b27b507bd07b831e0922b6f8511760e6e5746fbd3a7622eea7f5c20a9485c51460597aecd5073d64de02a000c62d368002f0db87f6adcdc39ee1d6504d821fc7367e5c8f334e280b2cbeabf1622ef760346c0639a296b3b632dea7aa9fe6ac1ba99d2c38aa8885d427919df3909c7676dbacbdb8752deb259e787ec05cf1f5bb20e35cb1e61a196b1ac548c4ce3c9249f7a25d671cf422c4a6c5c1199d059ec43fac2077c098b6ff8537c733961c6927c4a5e2f2b35fbf8c7e44d89874c4d63faa7499fe84d93dd71c833d426e5f5e1e19e578528d26892e16a22f9613b82227231e1953f922cb0ede331aaac12d447e4d02e1fbab230f1129e56bb039de05ad67012801c1962167d9ac0d5dd151487eeb1565c04edd27f33562a082987b51eb066f3bbc90634633c4194be7238addb71ee4956d898195f8946eed5925a3f5bf336e9ce7d194a1b9da3940e44aa6f4db953fd099c16395677dd3eefc0394eb1f037fa5a3cd6ddbb58a005e212efccdb518ab5c3ffe20c1a9bb9d9c497ea750b01a3d5ed353f2fbf45048e5fcd65d47253dffc7f30677a00f205c8553119c1791e7b75d97fc67952a6753e17a8764bef33dde7edefac902831dc784ed990388b06ffe7467211bbe381cc766fb00db47e01ffbe88ffe3a92c45db25e5cdd1aa57ddfce73cf16cf377533323d287e608b871757806c2d43fe64bb41b8d5d44b225beb893295c0f71be79f4cb5b891091f24898630f69d6c68cdb9bc4c66002eef91c32a389d39e8604c2ea5d502327320b8444e226ee4cfd3918e75e4eea53486e83ea2eebaa24093667fdc23eeb11c1b3a15a72da140e2b0680baf7ae38e4fb6a756e6bba01445829e8934cb4013647bd093723cdf19f05c82ab4d0bf2a7f4112d0e939831463c84a0ac5c9d6276b42752a0f6c5548021b59ad62799337ff5247da4998efa422f83"], &(0x7f0000000040)=0x1008) getsockopt$inet_sctp6_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f0000000080)=@assoc_id=r5, &(0x7f00000000c0)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r2) dup3(r2, r0, 0x0) ioctl$TIOCSWINSZ(r4, 0x5414, &(0x7f0000000140)={0xe5, 0x2, 0x7, 0x1}) 19:30:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:39 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 764.033914] binder: 24318:24320 ioctl c0306201 20008fd0 returned -14 19:30:40 executing program 3: r0 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:40 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:40 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r3 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000040)={0x5b08, 0x8, 0x4, 0x0, 0x800, 0x0, 0x100000000, 0x4, 0x0}, &(0x7f0000000080)=0x20) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000000c0)={r4, 0x2, 0x7f}, &(0x7f0000000100)=0x8) 19:30:40 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000012000/0x1000)=nil, 0x1000}, 0x9}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x4, 0x0, 0x6ca88482d9b7f773) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3ff, 0x400000) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffff9c, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000140)={r5, 0x8}, &(0x7f0000000180)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:40 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 764.382690] binder: 24331:24338 ioctl c0306201 20008fd0 returned -14 19:30:40 executing program 2: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000a000)=[{&(0x7f000000a000)=@abs, 0x6e, 0x0}], 0x1, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') prctl$PR_GET_TSC(0x19, 0x0) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000003c0)=0x2, 0x4) sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40800800}, 0xc, &(0x7f0000000300)={0x0}}, 0x80) connect$inet6(r1, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, 0x0, 0x0) 19:30:40 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:40 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) fcntl$getownex(r2, 0x10, &(0x7f0000000000)={0x0, 0x0}) setpgid(r3, r0) 19:30:40 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:40 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 764.957878] binder: 24355:24359 ioctl c0306201 20008fd0 returned -14 19:30:41 executing program 3: r0 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:41 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:41 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) symlinkat(&(0x7f00000000c0)='./bus\x00', r2, &(0x7f0000000100)='./bus\x00') r3 = gettid() fcntl$lock(r1, 0x27, &(0x7f0000000080)={0x0, 0x2, 0x2, 0x1, r3}) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) setsockopt$TIPC_IMPORTANCE(r2, 0x10f, 0x7f, &(0x7f0000000140)=0x101, 0x4) setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000040)=0x8, 0x4) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:41 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r0, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, 0xffffffffffffffff, 0x0) 19:30:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) [ 765.406620] binder: 24368:24376 ioctl c0306201 20008fd0 returned -14 19:30:41 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r0, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, 0xffffffffffffffff, 0x0) 19:30:41 executing program 2: openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getpeername(r0, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000080)=0x80) prctl$PR_SET_SECUREBITS(0x1c, 0x0) dup2(r1, r2) prctl$PR_GET_SECCOMP(0x15) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000000), 0x8) 19:30:41 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:41 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x2a8202, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) r2 = gettid() r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r3, r4, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x15) 19:30:41 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1001, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r0, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) dup3(r1, 0xffffffffffffffff, 0x0) [ 765.918276] binder: 24387:24394 ioctl c0306201 20008fd0 returned -14 19:30:42 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:42 executing program 3: r0 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r2, 0x0, 0x0, 0x1) pread64(r2, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="02"]], 0x0, 0x0, 0x0}) 19:30:42 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) r3 = mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0xb65625e4a941503f, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001180)={0x94, 0x0, &(0x7f00000000c0)=[@acquire_done={0x40106309, r3, 0x3}, @release={0x40046306, 0x2}, @enter_looper, @dead_binder_done={0x40086310, 0x2}, @decrefs={0x40046307, 0x1}, @enter_looper, @transaction={0x40406300, {0x1, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x28, 0x38, &(0x7f0000000040)=[@ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x1, 0x2e}], &(0x7f0000000080)=[0x18, 0x20, 0x28, 0x48, 0x38, 0x0, 0x0]}}, @request_death={0x400c630e, 0x2, 0x1}, @release={0x40046306, 0x1}], 0x1000, 0x0, &(0x7f0000000180)="351859256463157b0198dec60b324da911318007a7e2d5b90e6b0c70947a1d76db1c97c4a0fdaea3538cda1719273cde15a36b7bf3d1bde9e8f0d75335d3b0a6d9aebac82088ccc8c6a871effc7b98b4384b551da31e6b2355f3844e577fb9a26bb00dafe4d21f0ad3f6c412db3d742bfaec9c74fe1a413a0cebf27070427a19563a0af3bb7b9bf944e86ef8b7287f82a1fd838c616890baf95ded2c4adca470cb973d4e6fe8d5d932f8aa2cb42128da29542cc4507a4c82dda802d4bc4f94844254e54fd9fec721c96a8b046b4f87de1d3cc3f684bbe5533947b703736d863abd4b2d514e6769eb857527c207f6c2842b4d2a36ddad65c9baedf87aca870b0468b7b12420dfa2c55551b1e17e9692f12ae8d825e210daeeb5a7f8dd1d7d5efdedf99d96fb0d8261659b632eb8f810264a04b3b3f8db5392dcaae78ed940886b9b7456484b9ae923c8fdc1bf6711aa858f3347c4edf2144d350a415c6900e81118bdf420e05f2e631cb8291bfe0453f3b0ffabf565bc64b954536a85f3a670fdaf60e4f9f77e77c68f45e35ae4a929fc78c2542b00271d4d5e91f3312e2790ba8874ca8dc769057149a593cb77dde8b970a6c63ed06b484ba987225638698a2a5e1938f366c2ed66fbbc634de4220e2c1edee38c6700d68052ad468caa9d50d6c1b4c357bd962abe5834a15cb909e46f847f1de5e37f1730e9635810c02a87358ac244d903bcc159889610e6ba9cd039983d6cb9a7c02fffbfca78eff64a137f043044c4e51d1f1cbfcfe17f4fe8865c8d31e07f967e10277d2c05ddb46e33f5133c7a83245ff18298d06871bb5dbae1c2e536bae91cad2a225df25fa2ce00e09de958ab27026d15e614d14d8eb7aafa4299c49c03b6183dcf2929bd961b7b2f0f47c44cf31460b8462e6a84ac2f8485a01adcd7cab56760b76698182d944f03ab328b74b4cdefe3f5cf80f0adc7dbc905dd926dab328c5b64cef4eb4b308053697d55ab10f0761c416e99fe93ac948516fb8d360da8fdfa51ed2cd48f5f3c656728d29f0702f91a68c0a5feb52a1ff2d4454125c04e50241b4560ec385d79b007c1ce8ccdb9594929938f0c32e804b089b7869453503e9e018b6bcd354f21138d7e8c46b76ee2f96a4acee43e7d2930bcc726c97fca70586476d254edd62343a7bb822fe7006a959ca4ef0dd476f25e423d7358318a28ac6f904b32f8c7622298730a569a8ce1027cd43e71f535c02ac9760f3bbb02f123bddef1eecaedb497f4df2fbfa986177ed83258e2b5a641c533c2fbbc2846a73c622dbd44c4359a1ffaf6622772b4d8305e7926002ad81adf36f2f67866c81a24ee362ce9f095d8f486fafe73cdda96a9138deaf2ef9f2330521572bb6875a9ca6facf38ca403aa44e5faf585b5856f8c3f3547107db95cb428bb54d2c6244f57ab5cf2d42646e4a8669ed3088ec5bf9acaae11d8ca2016ea56ceff9ff8160503d04beac876bd1263cac1aaed5741b63a5b65d850f0447c40f1700af3478eef35a6b1d779818f53ebe5801fe35faa88c98d05d38c5ed145a7c3c5a166aeff3153f8f4b5af375bac7c2086177715f2e3b143807605cfc900fb5f052db117c98ba0ccf5c334bc09b5c45a0d3af458db1eb0f39e5e40d7504942c9d45fc53ebaad95abde100d50e89b5502ad461f1b19c83f0dca9f78a27e165c0430b04b431fdefb8d51d8c9ce2ab9b7c88f9d1e7bd4dd0138bf83bba09b901a8d4b960229e61865d33d4b810e6bce3377166166d0c82eeff8da31a0bb28894a5ec2d2bf3a1de626f3d84d75a5ccbc07e7b32f089fb50845272c4ca09b010fea86f80c7e3a1b202469be9a5c094a738067ac79108f6e3247716a4a7d740b43295e58f8b895553c0827873968b02ca9e368c41012f640a957f64baf8da3a181273126a5df32afcfa40eeef20ce9d8814d6891526f2007485ae68801e8983b0c3533a71b6bc75491e53cae4eac54f0dd8d79ec4be520fac2f6eb9bd902b2e639718b80d6b9bfc9348327c6f34b17fa93f1fd4c0346c6a84f4a3a9aece4844247de92750677a944c638cf58fd984005a1aed00f874bd824215acfccc2cefe8e54822ed7ca59216cf79bdf29ae4da8553384f9bc0b40884164f1982c1f0028503102f572d389ac7705901db51ff6d556488341c0e94473134d449f19d8784ebfabf2fade2b96d1badaf67b54153d3673f696e4846bd959d1c533b254b189fc2d7ac696da68e2863938a1f365f6ee811e4f292353ddae3d04e17b3d6f97b6210ce0d19ebd96d737469855b3e91fd5d38849e7c6042e34a4f14a99531fc7bc2c00c2d81b68314a85260b19a6d15077a6ab9ed6f7dd9573ad7d8eec4a14ff3ef1d130cffe84e09273103068a7c3145b9105d11ef2ab6435644892c289fa52521d5ca257b79fb2b246f7fc483fef4a234030bf6865aaed1b6a8df509b9465ecc62400001b3fdc19f1463c5ee5093017fd7b352af9068cc2335401ceb3a3d6a859ef297fc58598249fa36d60fcfa8396fe9c4a533b03c92efa375b6125bbd2ec175ebb24db4f20c2c64520edb9678e2a6a20777748297fca66bafbc13b6fe0fb6d8c68d83e17b8795bf72369871fdd6bff5cb60f2dcf84139aab429317b2506b2170b69adebf61317cc242bd4538be43d83de14c884cec6368d3f8bc0810089bbd7e372cfdfd2836950c416b458ed7cd007a0812a859578c0b9b76d7d83f04ec582e9d4fd2ef0962ac8e985b574847daf6a9bb499930f96d6d31d6826b45650b8fc122d0344988a96e533eca0b17b063c2b9faa0be8090ed3ba8e51e3d140d8e25f4c65f3108016b46ffc7331b707f3b3bc3fce7aedfee2e19ad65ab1892996b3651125de3066218cec69c344b12d89818031e495485ca048f24a8111aabc8dbdb230a238a9b6b33c3369ae866a58556ec71799825c3b3de45186addea75947e135f78aa54b4cf11d12634a9b3d644cb80b0c4a8740ecbc10d62463cec490fdfe0f26cd5665b082eeb0af4447e79a1bdb085f8eaa6ed43a872a1969caee2c0332fc2fd10ea6b06497f168360714973dbf2ecd7a57544babdc3b15f8c808097678fe81671705ed77fffaf25861e37aded0e4d213f8510c9ed32faa64c3240b3a9fbb4b6d52572ae6cd1d6c721b0fd42c244046faf30773cd2f8830cd3fc07838333ded77c5731a5493f9c5a8f7b421b87e8dfe225dd1a5f4c332fde9bd46b645e584ed0ecdfece9156f2ca3f01749e8428b9372f1789949c85d47f2b4c3e0480a6de23899b35fb0ee63fee93c001f4dfceed729907e296d11eca287367cdc825b7afc7184d801ddb51481674fd71a9d81f9588a61a0d1870265d2f4e84d9a8eaeaaaa308a3e0c236b747ad333377fdffe6c2b4597d92f79f256367c2a004165c91c6bbac429c7b019ed939f5ff43d1d3a53a74a353a6a256cf46ad7bec05244d1685bc515cd2dbe06b4e71ae69c6dec96b445e73430f462621b32324d386e92cf5db4d80feee64236af85b7eb84e0948be7dd013f2211d61730da92cf41c988f0307b216dac58add1df39fe4252c3d483fd4be18fc5becdb0d4a66422ce703e73b6861fc514d67cfbcacb8b35d41c466af803886a1dc94a564735af1f457c456813be63a74af142b82b9c120dcc84441ab45892e71a443cfc97591d26500d9d63f1a5365a988f84b411b3d5a2a6ec17be2f77d42064b62ff7628a2c8fe27085c3e30ba66d7812fa45c90217300b2622a6b1c8f395100800b2901c8bedeef05bbb21764ec03334634d28f12ee2cf8598523a8603d087ed960522587179c588ab2089cc419efa097c069329149b95152dc5922d04491498fecb78fb24072f9c3dcd89211b5d9f39134d7d1f86a0b6ea2c434556af8eed328eb4e8461266de4513c45ed4edeb9a286b552db44b0418b5957bed182096a2571671833ec67ec2fa3b646c13bd61eead2ebd5ffa3c725a6c6d3cb0d7b5a4d5dec3bff66117bd8697c6322faed8bddccc362c2d1e57600c884e896c735d942e87c43b4b28601e05500787e99bd4fa28cf8d7c98e1d888687b858643e3db0374e7cbc7d3f05faa0e1b4a600cf054a40d4ddb9f14067a33c9cac30157660d2f06c1db578dbbb6db1053208098ea52a6e4d0f674a189588bfd2cfd3a824b06ccf9a0565fefa027abcf51e1134ebc1adbe26592ba8699984894530a9489043df270710be1e98811522623b3c87fc2b7425547f463365c3e5b870f9aa9f8deb8e47d093b7983e94986f22ca348bef02ac956ad4c7c5877960693eb7f776b991a2845cf955fc005730b665d970dd7b22dedc4606dcb68ae1562ecbf80ffaa5357fe66411f49ff923764e0ed2bcaf198d7948b28156335ae5c9cae1b23ae1f20edfacfb2d36706cfdda92995887f049dd0f9fccc69a365396ab2d1d9e3f4c3cb1baaa8f6706212fd14970896ef4c0c63a8efe9e1e386835f2633c644763263856a726d57a422c4b315bfb00f32d6bfbb1d5820497a06e3afb9835f646dd4e92bd17cfb11cd8dcdceafa8999a90eeefc8a59f4c8e546803b552de97d710008b22dc8f92125cf534b3198ac92a26fda02f71a6056ab6d4e3f0c81c7858ca65916367c74a65fa948fb24a1d4bd2bacc2047aefc28e046547ab2dc091c8a7eddceb2d0b2a6fca26ec4c9f16b8f3f0c0943bd280421c1d62888d49118108423292aebfb4276b33be6b68ca5350f2a8d1a10b5a0e737799e8c697642fe5f1d3071119127c4c719ecfdb948052ae1b1ef72830d0c78132b17f12b41c3f65ecf11658725248351034decd23bb83dad1d3e5018813d0a47c7a3c05c4f7f7ef365d3a013b2087ecead91d9f79b0cbccb8c8695e14c33473e9383c1312c132247fe989f4a1d5f3bdfe474b52f43bdced356fc4770be25fa3c888e667f965708142f10d4c2bacc1a7708462858635f50f9d2371cf0efc6e9cd6da1710bbef6d3558c2b7e53ad5e7867e0c24490aacbd86fa8e9635fe41a4ca840daac1dd84e473a391d4d173704989c8f303604a25e9b6afdadbd89e98eb31849a729086d1295be99d3850d81afa8853da3bfb0aa36c73bd44ca2fbd22e408a7b266242e4d83c34a9c475e8d9aa2df062f32275a30d351af255ef713c6a7e62139635754f5ea91651394b1b9d254247b88ad7f6ae5d2a53e5ccf917b512f8f3cecea68ae79e94ed2e1cd8a3607f935b6711a36293b4605c2f20c548fb5683a6d400d7885427aac7ff3a95c6df3702fa020a8a811ec54cb7c07dad3d2b175c083997e9ee8a069fa8c75bb0129c58cee0aceaa163943d5f9ef36b2d386baab60c5a9ec9778e9725a57014aaa25b52343171906624216eb6e28852eb3960f57eb1e1e7a5f45a2e2b4ccd8dc28f2151056e75ce986abd70d7e1db27fd05bcc65126e0f743eb5780e6628afe38e0666910d5654eebec21f7dbbfe58773b48f27a5033c0287b078c6bf1ff649de06539978a6750fa6249cf2241eff65f4cd97c5c30e36c77dd541bc19cf99d0149251ef016b04825b0f76aaede8125a7cf843a147141dd113ac97b67dae871ee7d512f789bc2fb58533301c9dbf6a483d9e5447b71ce9e37b19a582137d9ca0426660b02dad83d1ca2f9d8f096ca771cd92c3475a2e020335dc5515240bd93604d251be685f46266a15a6b7a3bce71764314f96a096947d46f0e30330c562a38eef40ea69539e349664843b62b23c1605e6d59290d7c542c1924743a6b58b27ad08989cd56336a706f9a21901823914fe70b51b9d8decdc4e2eb1c59506f2afeab7d1d74d6"}) 19:30:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:42 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 766.447285] binder: 24409:24413 unknown command 536871488 [ 766.453433] binder: 24409:24413 ioctl c0306201 20000440 returned -22 [ 766.544607] binder: 24414:24421 ioctl c0306201 20008fd0 returned -14 19:30:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:42 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) 19:30:42 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSMRRU(r0, 0x40107447, &(0x7f0000000000)) 19:30:42 executing program 1: r0 = gettid() r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./bus\x00', 0x200, 0x120) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x2007fff) sendfile(r2, r3, 0x0, 0x8000fffffffe) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) close(r0) recvfrom$unix(r2, &(0x7f0000000000)=""/11, 0xb, 0x40000000, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2ae, 0x0, 0x0}) 19:30:42 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 767.134767] binder: 24438:24444 ioctl c0306201 20008fd0 returned -14 19:30:43 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r3, 0x0, 0x0, 0x1) pread64(r3, &(0x7f0000000040)=""/122, 0x200000ba, 0x0) 19:30:43 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$packet(0x11, 0x3, 0x300) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r1, &(0x7f0000000100)={&(0x7f0000000040)=@nfc={0x27, 0x3}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)="c109000000002c01a0001fe4ac141417e0", 0x11}], 0x1}, 0x0) 19:30:43 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)=ANY=[@ANYBLOB]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:30:43 executing program 1: r0 = gettid() r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffb) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 19:30:43 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local}, 0xc) listen(r1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r2, r0, 0x0) [ 767.429027] ================================================================== [ 767.436527] BUG: KMSAN: uninit-value in ip_check_mc_rcu+0x2a5/0x670 [ 767.442968] CPU: 1 PID: 24451 Comm: syz-executor.2 Not tainted 5.1.0-rc2+ #24 [ 767.450254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 767.459883] Call Trace: [ 767.462507] dump_stack+0x173/0x1d0 [ 767.466264] kmsan_report+0x131/0x2a0 [ 767.472407] __msan_warning+0x7a/0xf0 [ 767.476343] ip_check_mc_rcu+0x2a5/0x670 [ 767.480643] ip_route_output_key_hash_rcu+0x1f91/0x3ba0 [ 767.486177] ip_route_output_flow+0x1ee/0x3e0 [ 767.490742] ip_tunnel_xmit+0x11e6/0x3310 [ 767.495022] ipgre_xmit+0x1098/0x11c0 [ 767.498873] ? ipgre_close+0x240/0x240 [ 767.502791] dev_hard_start_xmit+0x604/0xc40 [ 767.507262] __dev_queue_xmit+0x2e9f/0x3ce0 [ 767.511652] dev_queue_xmit+0x4b/0x60 [ 767.515501] ? __netdev_pick_tx+0x1260/0x1260 [ 767.520090] packet_sendmsg+0x80f5/0x8ff0 [ 767.524280] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 767.529515] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 767.533409] protocol 88fb is buggy, dev hsr_slave_0 [ 767.535038] ? rw_copy_check_uvector+0x149/0x650 [ 767.540757] protocol 88fb is buggy, dev hsr_slave_1 [ 767.544825] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 767.544856] ? aa_sk_perm+0x741/0xb00 [ 767.544937] ___sys_sendmsg+0xdb3/0x1220 [ 767.544973] ? compat_packet_setsockopt+0x360/0x360 [ 767.545021] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 767.573464] ? __fget_light+0x6e1/0x750 [ 767.577504] __se_sys_sendmsg+0x305/0x460 [ 767.581715] __x64_sys_sendmsg+0x4a/0x70 [ 767.585809] do_syscall_64+0xbc/0xf0 [ 767.589561] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 767.594863] RIP: 0033:0x4582b9 [ 767.598067] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 767.613228] protocol 88fb is buggy, dev hsr_slave_0 [ 767.617067] RSP: 002b:00007f8f4ab0cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 767.622915] protocol 88fb is buggy, dev hsr_slave_1 [ 767.629819] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 767.629851] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000005 [ 767.636103] protocol 88fb is buggy, dev hsr_slave_0 [ 767.642161] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 767.642174] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8f4ab0d6d4 [ 767.642185] R13: 00000000004c58ba R14: 00000000004d9b78 R15: 00000000ffffffff [ 767.642217] [ 767.642224] Uninit was stored to memory at: [ 767.642267] kmsan_internal_chain_origin+0x134/0x230 [ 767.650354] protocol 88fb is buggy, dev hsr_slave_1 [ 767.654935] __msan_chain_origin+0x70/0xe0 [ 767.654960] ip_tunnel_xmit+0xba0/0x3310 [ 767.654975] ipgre_xmit+0x1098/0x11c0 [ 767.654991] dev_hard_start_xmit+0x604/0xc40 [ 767.655006] __dev_queue_xmit+0x2e9f/0x3ce0 [ 767.655020] dev_queue_xmit+0x4b/0x60 [ 767.655037] packet_sendmsg+0x80f5/0x8ff0 [ 767.655052] ___sys_sendmsg+0xdb3/0x1220 [ 767.655067] __se_sys_sendmsg+0x305/0x460 [ 767.655083] __x64_sys_sendmsg+0x4a/0x70 [ 767.655116] do_syscall_64+0xbc/0xf0 [ 767.740354] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 767.745541] [ 767.747170] Uninit was stored to memory at: [ 767.751512] kmsan_internal_chain_origin+0x134/0x230 [ 767.756725] kmsan_memcpy_memmove_metadata+0x989/0xd60 [ 767.762029] kmsan_memcpy_metadata+0xb/0x10 [ 767.766452] __msan_memcpy+0x58/0x70 [ 767.770183] pskb_expand_head+0x3aa/0x1a30 [ 767.774425] ipgre_xmit+0x724/0x11c0 [ 767.778147] dev_hard_start_xmit+0x604/0xc40 [ 767.782560] __dev_queue_xmit+0x2e9f/0x3ce0 [ 767.786889] dev_queue_xmit+0x4b/0x60 [ 767.790698] packet_sendmsg+0x80f5/0x8ff0 [ 767.794853] ___sys_sendmsg+0xdb3/0x1220 [ 767.798933] __se_sys_sendmsg+0x305/0x460 [ 767.803091] __x64_sys_sendmsg+0x4a/0x70 [ 767.807158] do_syscall_64+0xbc/0xf0 [ 767.810885] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 767.816074] [ 767.817701] Uninit was created at: [ 767.821264] kmsan_internal_poison_shadow+0x92/0x150 [ 767.826394] kmsan_kmalloc+0xa9/0x130 [ 767.830200] kmsan_slab_alloc+0xe/0x10 [ 767.834112] __kmalloc_node_track_caller+0xead/0x1000 [ 767.839416] __alloc_skb+0x309/0xa20 [ 767.843141] alloc_skb_with_frags+0x186/0xa60 [ 767.847835] sock_alloc_send_pskb+0xafd/0x10a0 [ 767.852526] packet_sendmsg+0x6349/0x8ff0 [ 767.856787] ___sys_sendmsg+0xdb3/0x1220 [ 767.860873] __se_sys_sendmsg+0x305/0x460 [ 767.865123] __x64_sys_sendmsg+0x4a/0x70 [ 767.869195] do_syscall_64+0xbc/0xf0 [ 767.872921] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 767.878105] ================================================================== [ 767.885515] Disabling lock debugging due to kernel taint [ 767.890964] Kernel panic - not syncing: panic_on_warn set ... [ 767.896865] CPU: 1 PID: 24451 Comm: syz-executor.2 Tainted: G B 5.1.0-rc2+ #24 [ 767.905529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 767.915431] Call Trace: [ 767.918047] dump_stack+0x173/0x1d0 [ 767.921706] panic+0x3d1/0xb01 [ 767.924984] kmsan_report+0x29a/0x2a0 [ 767.928821] __msan_warning+0x7a/0xf0 [ 767.932665] ip_check_mc_rcu+0x2a5/0x670 [ 767.936852] ip_route_output_key_hash_rcu+0x1f91/0x3ba0 [ 767.942465] ip_route_output_flow+0x1ee/0x3e0 [ 767.947001] ip_tunnel_xmit+0x11e6/0x3310 [ 767.951327] ipgre_xmit+0x1098/0x11c0 [ 767.955175] ? ipgre_close+0x240/0x240 [ 767.959083] dev_hard_start_xmit+0x604/0xc40 [ 767.963578] __dev_queue_xmit+0x2e9f/0x3ce0 [ 767.967958] dev_queue_xmit+0x4b/0x60 [ 767.971774] ? __netdev_pick_tx+0x1260/0x1260 [ 767.976314] packet_sendmsg+0x80f5/0x8ff0 [ 767.980509] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 767.985819] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 767.991283] ? rw_copy_check_uvector+0x149/0x650 [ 767.996157] ? kmsan_get_shadow_origin_ptr+0x73/0x480 [ 768.001379] ? aa_sk_perm+0x741/0xb00 [ 768.005271] ___sys_sendmsg+0xdb3/0x1220 [ 768.009370] ? compat_packet_setsockopt+0x360/0x360 [ 768.014440] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 768.019923] ? __fget_light+0x6e1/0x750 [ 768.023942] __se_sys_sendmsg+0x305/0x460 [ 768.028133] __x64_sys_sendmsg+0x4a/0x70 [ 768.032239] do_syscall_64+0xbc/0xf0 [ 768.035981] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 768.041179] RIP: 0033:0x4582b9 [ 768.044387] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 768.063922] RSP: 002b:00007f8f4ab0cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 768.071684] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 768.079094] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000005 [ 768.086437] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 768.093898] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8f4ab0d6d4 [ 768.101175] R13: 00000000004c58ba R14: 00000000004d9b78 R15: 00000000ffffffff [ 768.109815] Kernel Offset: disabled [ 768.113594] Rebooting in 86400 seconds..