801}, 0x80) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f00000004c0)={0x20, r4, 0x701, 0x0, 0x0, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x300}]}]}, 0x20}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="060000000000000000000000000000007fbc90005fd3a561954801f072a86822659fc4e703065b12275d072558d7bb1e4e38610e46701b3cfe996a8c55ddf1ed57e3ba21ad1f1f", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 672.014456] binder: 7373:7388 unknown command 64 [ 672.030199] binder: 7368:7376 Acquire 1 refcount change on invalid ref 0 ret -22 [ 672.035235] binder: 7373:7388 ioctl c0306201 20000140 returned -22 09:16:56 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0xff000000, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:16:56 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6c, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 672.064569] binder_thread_write: 9 callbacks suppressed [ 672.064582] binder: 7368:7376 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 672.107580] binder: 7368:7376 unknown command 0 [ 672.127637] binder: 7368:7376 ioctl c0306201 20000140 returned -22 09:16:56 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x3f00000000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:16:56 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:56 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r3, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x10, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}]}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x80) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 672.215401] binder: BINDER_SET_CONTEXT_MGR already set [ 672.226344] binder: 7401:7411 ioctl 40046207 0 returned -16 09:16:57 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x630c, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:16:57 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x2, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 672.290798] binder: 7412:7415 Acquire 1 refcount change on invalid ref 0 ret -22 [ 672.306685] binder: 7412:7415 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:16:57 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x0, 0x2000000}], 0x0, 0x0, 0x0}) [ 672.340122] binder: 7412:7415 unknown command 0 09:16:57 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x4800}, @clear_death], 0x0, 0x0, 0x0}) [ 672.379260] binder: 7412:7415 ioctl c0306201 20000140 returned -22 09:16:57 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:57 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x4000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:16:57 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x10, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:16:57 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl(r0, 0x7fffffff, &(0x7f0000000080)="851eb90fdecfef732edb8479927ad610c95d3d081fe04d46bac38346120fdcdc58b06ff0fcddfdfedb449684f9708672") connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'U-', 0x5}, 0x28, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000100)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000140)={0x1, 0x0, 0x5, {r2, r3/1000+10000}, {}, {0x8000000, 0x0, 0x3}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x20000000) [ 672.441940] binder: BINDER_SET_CONTEXT_MGR already set [ 672.447369] binder: 7431:7433 ioctl 40046207 0 returned -16 09:16:57 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x0, 0x700}], 0x0, 0x0, 0x0}) 09:16:57 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 672.571832] binder: 7438:7443 Acquire 1 refcount change on invalid ref 18432 ret -22 [ 672.603129] binder: 7438:7443 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:16:57 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x600000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 672.624222] binder: 7438:7443 unknown command 0 [ 672.635153] binder: 7438:7443 ioctl c0306201 20000140 returned -22 [ 672.661624] binder: BINDER_SET_CONTEXT_MGR already set 09:16:57 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x200000000000000, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:16:57 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x600}, @clear_death], 0x0, 0x0, 0x0}) [ 672.685173] binder: 7452:7459 ioctl 40046207 0 returned -16 09:16:57 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0xc200, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/loop-control\x00', 0x149100, 0x0) 09:16:57 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc), 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:57 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x0, 0x60}], 0x0, 0x0, 0x0}) [ 672.774771] binder: 7464:7466 Acquire 1 refcount change on invalid ref 1536 ret -22 [ 672.808407] binder: 7464:7466 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:16:57 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x8000000, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 672.837643] binder: 7464:7466 unknown command 0 [ 672.852607] binder: 7464:7466 ioctl c0306201 20000140 returned -22 09:16:57 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xf630c40, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:16:57 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:57 executing program 2: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-control\x00', 0x40000, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000300)={0x6, 0x80, 0x1, 0x200, 0x6d63dcb0}) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmmsg$alg(r0, &(0x7f0000001940)=[{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="1fd8c9c9c0f6f84e93f7d15750c9c0cac7f42dcd602fcc21fab366f712616622", 0x20}, {&(0x7f0000000380)="a4b07a5f56f94cd6341271f099e1aeb0602edf8a618217629a042223fa245dcf1d17e123380e8103491966bef06d3719614ea9e0778b7cdaa4792a97bd3e7870985304abc9752b071421630183b5ec9e7aea3847978e07b26dd042ffd76b9bbb23819b1e9197026ec3158991c0cad39ac5e57e2d1f79a552d82e9673117a95472cb9d5798b02c9cc1759192b8957c9fda357214bff1bbb734679caad4fac2f", 0x9f}], 0x2, 0x0, 0x0, 0x40000}, {0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f00000004c0)="d0619909e25677d8a6444da645c5ab7b7036dc5d44a443f762eb555d8ba87af6c72c63c1de426cefa2338757ae134e5ce569c2b96be28ba442eb041d1c767011296957465ca5ea0f1432ead7d958d89a50df907fed3eced824604da9e23b673296daf0868ff68630ba276ef736f884211e1c4943aa42974458627d114abe0a9477346924ad8b8b0f7fa449371c70fb46782cf2405b3a80769b0e4f7d4b0a459c647c3e4cd7ca8ab3d27b3b22c9276fd139e88107ce3a2e310d6b14b4b2402e69dad49881931ab0c01cf3b4bd1457cc5075c5ae64a53193c0c6a6a715c3cde47f594540cebf3118d7672c9a59e20f2c833cef639411a0b4bbfdb5177f8cebf761bf4e17f107a7d1d39d2a5eb03a9d5ea0517417742e3c800b8e068db834cee1b767508ce4afd57d03350b7082a3bda339fecdcb701126cb3d70cc6dbb0b7c29588665fff661d451de0d2e1e772d779105facb95b846f9894a5f8af291c944ea3f883af4593e6a0e3f57712298e6d0e3b34811fd6e6f3886aada347dd1d7a2e111e7d8abe738ca8b12c2036a275630789937e4a58a43865554d0769c98cb1441539742edbd074f684ed6cada7177fe713dafc6e3603e5c692f644ddb921b16fda4e4aad91ae87cea8f5fecf57537caa3c86efdf793a6f1e9cdd7fd17edcb965b1669db839fd1dc4af40e70861ea03fa789f884ddfd0d38a2b02a6cd764cf0e1740a59ff0e74afd3e2fa536fcae0e939e6431024dee5ca263f5543948ef473d0b22b5db05d83e01d745f10c34ac32da20b9e5fdc49e5e451ca9bd0a85fb846d89bb9317f855c8db246e9491176dd6c6f06fd151134fa291f419d6cfd5f9c389a0616793d4780fbdd1308ead31375774c05b75659838fd8262702baccfae4161c6aadfabd3dbb1db2729de628c2ce425ffc77aaa9116cac46ecdfdc720879ec641a2038e2a02302e966987ba4d75f1a3ae923227c1dafbd5288cae2473bcacdf3107179f4d7256c58d2356d244128aa0371bc02dee845c80c142f1ddfd3f34415f1afdd721a51e310168712135335dc7dcd3435c1bdeda5153e5025eedd228e6dc0c0537d0b4c797ec752c668ea18b3ee0502926a7bf21782f4c9abaeaafee3cfd7938ca84e1080c627fe809f65d47148d81e76440ab09d2c29deb9822f77a175a7afe26cc83d0771c84d55864680bb1f0c5aaf7ac0af57d972223ab11a459cd27b0bee8421af77464924334800f962229f2d57e0703b58fc95f371c666505382c27ab0149480d7a86977c9b2e726be59ac478ab1ce4027c1898f64c1d97a90e7d852d7aa0f3eb1ca37bfc1b3f4dff2fcc3c6e984771fbba79f6f47a4c16badce337cc2680004509157ffdd1bd5a8d8f927a19140dbdabdd6f6758d4a31cb46bb21ff46c15274ee79284455c055370addb96fea362652c7386d2df0eb901489e1a73153019222e429f29b0ddcf64d099238bd3e9970f1131c750c207f8aab789e3c4fa0240903c0c078f388f30217a91056b76305d2ad3f2d93a7d00f6c2f3a22af65c6a04118754c7d00d72b7c23722a153fedc23d9bb722847f0adbd347622f195659adef60834ac3d5820591f38f73259b20bd79ebc5a69b9cb8c23c84ca244dfcddb5646058dd4ba6c6bc9984026f1122570a0a88d292443a20197b3e0f4a02edc7000e5c027ebad2a0eb9f35d997e4fd740ca4285e035794bd11502d79f9134d04211562fcdea08a325b1a38b7a37589c645f7e82a77a402bcd7ffebb533a7226ecf0be99d2064ecae4008842b3332dc98582e0ebbdb5904c66e4a41ab24fde2529a59294c2dd0e8d2c83aaa5f7304d9ad70a15f756cf4e4e239a7c4402a13b2a215beed49e551e230719824befa5a3f2e9869d10fe4ef96d36cf6463d9ac024398d57b5cd45a4a5bb3345389cf766d537749de63da3aca2ffb44e0a9142fa68acf90eb71a7e854ad7e4e497356721bbc0c59006e378047f743cf485b35716a2337ede0ab1fd952c3c1e96bddda232c430d866019c72bc0538e6343b09aa0f038f1f3701fa9aef99b066aa264d1ba4a25887bf66357490f583bb212c185493c381a5ac1b7ea7278adcce1ab24019166b2d846c7e5f92d2224098bb7dbb7a2e25ae6ac6cf9093ef7dc5a3feae35618b21e43d1f23bb26bfc9ae77caa96c03960a769796efc8e38b1ac8bb4e3d4e7eebe776d9ba14d0db9d188d9423e87882efd741bd84f1e0cd6cd1f0b7e270cd77dbb4f38de06cb4406adf2c723ceeefd0e990f0710d584a2829456728940123e70aaa5a5fe02efe3a6395915b47cf2a4438c9e6d9a77210304eaa7fe5f1579cd9f029021dea11c38f8aa5ba62905d2561a6d1dfd9d960c76c6b9d728654ad961a1e89b8061c0d284595752b984dd0e07d08097471f0eb4e09838320a519a6651ed9fcc5bcaafe347f19ea6583be0c5566720e5037e832a1094a22fb15bea0af3defc4810b9171b20a33d05d1942e4e69e05f42091e4c54bab49a8deea2cbddcdc9c753fa8e3a961d4ce0f9740d20df8484f5231f28911a265f960a53dbd943150f10a071acfe4e32078482c18e8b83651bbe0088c3ca6e37155df73a7dceb9bee0cb62d39a5bf6994d029a9e09397b4649a3a73ff777d9d192d092f34f6582222ad71f92e8fb923a33cffb3a17a4f2621c96d34b3892c5ccf23366ddc0597323f2de64a88291cef151530d417aa4181b08ca24eb10b24071561bb2752974f477f90c56a49aad945b7033efa68dc8238564e48071fcbe942dcfb50a860d0dad847524f7e02683e9eeabc73477eafbae95f8776e5c463c57cb9b9f1df5a1ae363771232c3f03edbaab578ce6fff9b7207b5e023335f06437f47366ffef3d71087295246dc86a38147f7b0728f03253667ebd02b8466baee44417e8e7631772f19acea97d9e158be96335b7d2bd659c5f8c51482bfb3263e8c1abb550646db38d15cbce964750a9c49c5a3a6683f258855ba13bb20f40936435902a5cda89ed9093f968e67932322945ce2db80e9de625bb82d1419800e489cbebdf5baf1eeb8be12093036eed859f7e9e7b0da91b47e1a22066fa3cf8a09ea5be715e8b68867b95d7580203f2dbf6461f49e2d543187102100914677a1f5016efc6a678e69f079430098a7e73eba13b6728cbbe03ffb2f011139191584886edd852c6938c64c94e9888994cfe63744f76f74546fa740551a58e20cad5106481642eb44b49d318c163f98395f5c3e8904bc62083cc4b79d9f22c6b8cd61e18acb8ad127a8b98a4541d895d83f64ef5d5e3be412343dcc858bab4adfc223f9c7e0665692da770903d889958e4134e848cffb087e592bc1c6d740dd8b593a4647836e728094ed0264f23f4354049d6b0b016899e6afa697114881d870f0b4c5988dbd88194e8e0fb35cc2343ed964f16914f6ea0e93ba150a69f211cc7395cbdb5db96b68a77d405c26d823a9498ef3aeca7581068c5e3cdc5387e98fa7accad8917b13c323bc53a9bda309bfc620c5983e6ea01bd1cd901232a0355c21138b8936fce058b187723a4ce75bc13232739d840e6934038a480d218bc74a9fe3ed4cb6b286c6fbaeeecff5efc33ba77696bd4b553d442146d597da6e46a80538af1b846564d2d917acfeffdea0d920fbf0dc374ec24fd763a2d9ccb8be6a4bf4d19917400b3e3d17a14397be7f3b1eadcebf30aec6563e5c8ebee40bccf48484a42f7f3fe9fc4569b2eb292e1d642eda724df805fd85a5cb54ee351dc3aa0ee2d1bc899feecb5dceb0340be06bb9c9af4b08e40ad96e730476d4d7df71e76507f10c1469fd20e9cc8b61c7436686c70fef817f04219a8e3fd30a6fd1f927a27fc25ca1604329a565677c62d1ef8cb2da4117bb7d0c0da186181bd6d1bc89ce1ecd84462419a1fa8a8ba21b72e724248b0b6570e7d7721d3fa19430bc9b2b4b4c2ccf74a9f72fcc7b339572a1bbf6685f585f3144efdb0872cf1fd087363add9c7805b9b5bccbbe11b0189863063dd6bf4c658e11115502d446ae0038f7c65da96ade6163a80b1623f88c62565d7e407349d9089ba46ad57d7cbb9c89cb1c9c14f5e4f21bf38ae36fd8a4fe7c351c50c31db8ebe13826c0fd07421defe6eac610654dd8d93d963f301096c6caf5f31efe403fe86da213091a444bdf56b03dddc3672b7f4a9db3e57c185f6e7d5db31c4d50c1072ce8465cab9362a2a4decfc11d5762eff194c6878094d549b3360db51d8ad3b53b56e2d03c76a00e3b42d0317862ded543864a8bb14964de0b1095febf87d27b2032ad5c1f94e5a42d3f5ac9e066692edc408eef6d9bc87c6455d4aa4eeae734f5a0838df957872d6c2153a33327f9da551803975c2c7cc2da36fc6ba334a66459d19e895e33f2c8ddcf3741524883626e69d2dc750e83956bfa29f8c146eeecca97ab956e311a182990fd623dcff08b8f52a019c43d62ab6fb5728322d2313a2f6014d1c907b31335143a44ffde921e50b4114e6dfc0710bec907d6c6ecac8cab2914f9d209ed5f853541f7e097678fe3abef3aaa5debfa4e81deebac72a7da4590cc00642afc5b2b61e247c07cdff0e1292db00f96bc80c018fdaa436b4f78dd773a91dc7ec9e30d6d44f096ca14739406a4b18070829069f50c8f7c8156e9bea1f95f029611345fe2759dffcbac4c78512c79e7716c391ab3f66aa971d56d4066debec2780baa758c08546c9b9c47782f45e8e575ba591ce8d42df45ae376d652c999af67f35e7f53f51b29277ada8dfbdc2914f05f65a001f3c25cc7b97b39e087127e194f30308745761590bb88e3fa6426c903a3bbc420094cca9d01457b6a6b12d8e40de9d1aa930f0b388bf6f6eb1e3691d1a0262962faf991656ca33fa5c6f5851c0c30187516b141954e1024b63f38f26e7c33ad0385c531c99ff3245e716ca765fa65c55b2de3d18164b3ddd0843be91919689037b2a5557968b13917ea2ac741a4ac67aaef0e1f813418a673a67aa2634594e9007c3340c6a27215b70fcf05cc4fd950a7d2dff6a7f091876287756751f48e92130ec2feb0c2c924cebdc80d4a241107da7513b21c61d6f206ee6f5397b1bee0834115ef4040d79e6aff826f9573f59bfd1a5c80d32026fd20ee7ad31445fe6f0552b4930ba2ab1d2b57ebbdfa947c94facbe428b5e685cbb8dfe4ae4685a396052184610cc5b13967886d7e50211fed27d33c74c477566d7ef1b74f55a6e820de063643a19cd5d885746c7a949a8de560b45d4214c7db1d02724bf418b1682a427de808308218b7d04bad7a0c7695c4aa65b38532551f55d46845aa0a016a2b37ee40b612cb9413e2a24d439c2c5e8cda8cb283f797b9754a665816ce6263657f81a5eabc1def41bb7d88748fb2cada3af86ccaa846861e04e1aa2ce1c69e6b2f838f429e7246224372fb9053bd2ff0746acf3fcea1b3e2427ebd6eb9daf42a0574c87f01853f4e3c98caee2d8acf1c2573d7dff3b3e4de432c8ff2e225edfaa88c96ede7bcded8f67fe100f448a5e0e4a342803f482b0c39a53f6d2a33bf309b6575560e2326fc9a77926ca9f10b3f9e599e1ffd444de07f406dd338a94df8c155d787583b4db92718912f32b4164c25e93f6dbe8c1ad1a4be896cc9fa4a8fe9230114fb9001bb9424f0553358e1ff6fb88388b3c966031c0714a11dc84ac5ddf730509677c079b0f74129b7e3e304be46e9894219c27f3229442ee3b245c187d41e27e09ac75f3c3feb7412fe8ad88c30d34b38cc32a570f46fe6f0c36fce5ff03a265a9b7ad49f61991027579bf98", 0x1000}, {&(0x7f00000014c0)="0b7524016b68f5c04b9cc4d67b329b048987fdadbdc6d460f0356429f09038449b32a3bb2e4a74b2e23c263cf8868b49e7265d9abde02225c42bb8685dd78833eee793441606bd7430582eac8ffb792035", 0x51}, {&(0x7f0000001540)="9b9f1b289813b3b89b5af1781b7d5253deaf9cb2a1e68d18e70a448ee50c4e2b8e001a003473e453b132de6aaa78f386e97a1fba57531232b9eda8c4b0069994639907c8401369f455bcd4bc70b815bba8b88c346eae6eef710e429804e74f2cd9b797564d23db572a90a6c04c7ece53f7b7836a6c09004b11ae48a8b1617e257f3ae93d8c961a7a675d51632efbbb7d9d1783404358b18cd46743903cd418412e11e6e7c6d86980a3403856c7b79e14f4cd50b93218172c3d7d9d977ec4b6632c8f3c2f821084927e465ada7d05", 0xce}, {&(0x7f0000001bc0)="23484047166cbc220aefe4067926be7207d2bdae0fe9caec7f5236ce4f883de8d883f1422d126a6195ccb11b124ab87b45c0c2af025736f23bee750a516facf6877507c547555310e7e1e2906f71351d6a5d7e8a4ed8506f248843c9245a335d56ff482392528edb7aa1bce6786583eee88b2effe2b2217dee16acb932b65c2fb68fd96b7b0773aaac11359ea328df6221de57d37e6168d50bf0416d49c65721e094cbe0e102686c87091c43015961c581c97796ae6dc2aaa4a42491730f997067d0b5dd303e180c976fa11c2e1675bfec1dd775d277a8875d9fcfccd33549019f5cf8c44b85c65f174641be43bf392369e0eb3870486210ab1531b81aeca986c0d12b6ba76c9c0fc029d8e4297a121652db8a702fc4f47f2f3fa271c9a37eceb90641c9e50bcec9ef21b8df85fdd234016a8566bbecaafc97e7d7274013b52171050c5f74d9d2688e3f78fd08fe2d73cae7663c297145e4492c7d14342aa080911d40bab18ad1d6fb6e6f6a27be1714807cc474dbfbaf6663ae8fa47abd7b8aab5dbb872e8e411cf70e4bdc400152fc4adf27ec1e34a2ce9c242db2f0f6068effd4803e619648731999d64ebc7454573be0c83ec534b49a4bf1b494378843dbe43b21cba8e127b05269552a2a087232772f10c9472494d4e154df5a32eabe2d4c208b85e4c2e9b7c9f6a3b71cff0e0099f5a91b9fa2af5706d793c08c97b6f0a6d44df539bc59115954c793373f6be46ffe5ec28521d4fa612358d3a0a6172a9a921fe222bb995bc3c07c76890ad290b5a1cc1a3266af0f0245e96f7e99f2a085bb9c9d7ee82927992f659bdda440455ea1881ce4075719c368bd7d1c5b5151bb0b2f7da9e69450d42e32f63bf39da7524ecc4fa37b765029313cbff364a7f09771bef187465c453215c9a2ee3239c14a6e0dbede64807d0b6c199c4cecf7d97251a46f42724489b07eb59d24261470ec7d5fce16b1066dfb5c63faa8efd1ab5784035b9154102e3c07d72dfaba772c67133b037dc95e15c7ff2288e1863829c1519b8cd0bbce40e617f28282114de00ca3f309e74c97f4a70b64ed7d7320ee9564d68a1e080f3660221b951aee5d37ba1e6afb62fb67feb67de53ba2d0afd2b425dc8e019d2e6c69034086ea156604477107f15aca43f6fa928c4fabd30b71ecad6518a0f9c6c65544042d2fb8bd5b8070f30de6e1f8d53dcae77f87872a00178a0c3089801718429b4de6f82e72a42c457b5f419d65c38f769ffc9ab9c157ad9418b15b72456672e111c1bcc599a95a1dd879de3142f42c093c0ab6a354aac757cd8198b1cd0ebd836a229b795fc2c1d88ecee087578eb52d93e9c7c5a6a58e2d381059e78701db6ac78ab9c00451271bf9df5640ba74dccbab52ea76442289239a6a92bee6552413dc628933838208e93db9c073896b6414cae37988a04cb48de255a030bfb18e7d5a2161d2cb5cce5ea39cbfd2a35a2815b7521d5dca4173dce912dd8aacba670ca8104315032702c5ef23b3957210c0495d7371a943b224d3f7ebb343820ded9e4aa84fbad3a46795c905bb4f51cc9de80491c5e5a86330cd662cc940f25229045d1fbef36c9aff754c91515d7b783c9a6fee8d10580c364b289d1adaf828840bed29066c4976f87aae4b170a8147ac5b518f5bae651e64f6bb56610859db2391a51aaef6e8b24c5073b189efcb90777a01867dedca1bcdf05537b474d82bbce824cedc656cf8f35a7ddc8cd038b1321729baee60b19bc3e50d8025b286ed89a66d9a8523378f9196e279ce133bf1c23daf284f800df5d4ad58802c04fc39e91ab1ee098df98dca135bf806a69dbb0ef1780210337e22e0d2b934f0cf01df620042b10d948a3154afe066dc3b9f73b98a948a977c3fc4789d52bfde82d55827b2ccdf85be89505618dddf384b382918528bc81c6fa869093e20e70dca86b2eeb97e1e7f221d63819ac9c828313fa8d00e3f00ef6ec620bfdb044d2f80c9e47c7d215a03f314a07e3d3d82685ed1f3bb105b99fc12de36245d934e44ddd1d78cb0898047180ae68f5804a1375add96a60b112da2d8f7003c5880fd32a0080d2cc560f9b5ef91f761494f97d41a3868a15ce4be889ebc1a8c0c0bd84fd236aa9244d8e67f880a0bb99b5febb267a7b2f7c6b0233dd9ceffe65f187a2a9b22f8752d5f4ba2af42cecd627c39078393b2677c0479b3af3387ba0324b4e08ea77826d57b31c31585a53ddab10f75ab43deaa0d522c2751b71454ef197225c291c48695ec1dbe1afe48aeb657123368ed3a6cf2964567250b3ddd386d7d0ff8fdc6a67373ed9ae7cc77c7acdbdfbab025aec7a50b9b7c4964903f6bada652d5eba7b4781f8316f296c8e6aefeb7e2a191892dd9f0930347a539737629f1c5ea6bbf9105b9aa53d0b746cced624e9e95aa6fc090414e66f07b3ab4f585cde22aad069a042ad0200e72f67589ead25bad1944a89bb3ed0a0efcc74389e66a71cd43bc748f85eb2ad214b5953b5723e3d01ae206e4d33495e5a66f0274f2c1f30b43ca449de15e19268c1a4f5a11a16af52b9a7376b3dd386dca10bf239a30ade0af4f9a8b4be0de20a827e138e0b184183fda90508f6a9274b0488b4a5bd6c2fb98cd8518a7d7505fe149aa3768e78661b4540236bd3c9ecb0fd3f6073684172fa2d6551de09fd361b3d55139307423adb30bb81e7584211809ad4a80e0cbaebc8f87af09571830067bb93f20d18ae2f248a4314903b6ff56b70f66386edd39b8fab93cf9b875518c97fb515055613dfe1384111dcdd51afc39c085ecd56f19244799283eaec0718354fdd57dbeadff21d27d15da051a3fe62f32d179d61952249295c1caf6b7e11eae7a05810b4fc943c0fecdcf2882fd0908391229899b01b5a7a6928f651b4ca0cb35c706162a1cd1a2e9d655ca84371126c973cf57444172035860d37069ccc9642c590fba6f4ae64850ab7f49d37e9b3b3533ed112f83bbc2d21e69360ff29c806ae4eb360d3e6aae9094353ce5b01e5ec8a8c3b19283a85a298162815febe19adc3672403e08aae209535997944f07e86ed975ed1002cb25d9e133503999a6be4787fb905577f29a399501367e6ae81ad0a85993f74d74b7cf391d67c1d0fe9e66c5be4ba14527f266abd33f209b5cc97433bfce65593ac4baf7850b68bde674006d60cb8f203fd30f3e34da2a0ad513946982241183eac887f6345d1b0dd5af16e0d031b9bbe4aebf6eb25df9fe865722f12f72d1393402520486797b52b54fd42675772831ab246736d4decb0bc8da7f2a4dd4f854c9d83ded0025eb92a9079c525da1b3f25ab6abf313c17a77c991a8b5407a2c3d8ea2bcdf316a74a59350d1708a11f4ff9d9dc8b7f29dccf4980b83ded6ac29198134f22d7594560c3d38ad22ba641b88af43cd9f353fbaccb6f25a00d0a2ee1fb7f97d959e3975b5f82ec9a6b926722842a6b62a719de2ad4aef4992e2d253500fc01f523dd986de4c31c5071040195801c8b906f75a058ddfd1946dfc4262d1e8fd47848c7313814e321aad6433f1120d467cd96d092c81c693be814d2b7a4bafc78219964c0a31858e53b43b0c0603cc8ef9d1f9ea5d72c5e4164f4fad6a71b59debb92728ae859682a9734790afcf4db91470d25c93788c76d4c1fbe5914c79444ca5e594504f5fc6affde9fad31a2746ed17f21b65d2c2dbd8152877f4d784f07875e9cba29926449729c18f436ffd8c708b08b4687eaecd63fafa2612aaa74330581c0de96cc0ced38af400c8fbbb6a0a48f7f9cc673306ab7c7afea68d8b07a3a1109e0c8431e24b6aba40edd46708a5fcde71b811f02d61b7b7e8a92eeb15c41f6180907f2eb4d435c8f011bdff9f54558e238aa43c14da88b8a3c4c2b22a4a1b885646e728bc0706ad3b4b0db3f151a01b20c21a6abc0b909b7536bd38e627b02aa6a3d33f0e1bba12a3a36de6e95d844f15b7f34b5537ac4732597bbb9bc71738bbbb5b102baad59af1f392641c48bef848c30b4f0bb56941adeaea9408b0997b3b1979ec8de3358c8b05d0208883807f109f2662f32f3221fa7dbee3ae3d22740e283a81d9bca947e233d886445e2ad3e3c928f04835c69b93c978725091f70584071ecd82f3d8712357bece0e7a0436e818b24740f9205eed5592d3f8580b6ee38c756ed058091d2df0014437fbb6628b16d515da988be5e77d7b7723e7d76753174c62c29eecc8ace847cbb3ccb7bd2d75288ab192abe1f20992f2f1cdcaeae430c7dde93694edd32b730580ca7f5a4223fdd982bcd8a99b5a02073086f0da91d5bb483363c4b60e9d7963ef11984e0c54edc289a0fe8c66f4b22d063b9b5dd6f30324115c47ed608a5b4374a2be723d489a2da598a617fdc2dc90aca1d4310bca123e6ab81a9d33bff73011e21ea3a8bce00daa0e316107d7b597a2a21acd8a4124b4b6a76a3e28fe494cdd80360dd280ee1f98280c57b253e87571fd8652826860aa9abc7d574b63163186c1645398fc9394a244efbe036fd1031bb45f9986377878f63de21b32087cd8c00f4b26d3b54f5147e68181120575f1bcade58204243d19ad035a1b28567b08e7aff08bcfd2c519c5bc9912db568f8bfc0ce9c4a69935f75e3b87acaaedc5fdfd39c5c4b64b64cd8966b1929460b77ba821db1e67c755e025ed77189770c10aac2d656293a2c6e8aaea1aad603c898e280e7218de8c82a297bf69ee9d24f352825bcabee77b2f17fe9914eab1223d858d8f2a15b825705635ac46e2620a76cde14dbdf5f42634cf4afa548fd4f0f8de57c20cc4467bfcef286520d40475bd9ef426f22f857d8d79ec63ef9c98a3b9e514f5b8f1c82d9119c96dc3fd4a44b805be2ff6ce168db86b6003fd2a4136f81ee21f3c9f6d12e92078d7d07ac3d38f5a879c336f38ac9a6ca7295fdc99f0eb2b15e3845a4f0d36280ef02d63b4ea8bb950e680c84c2d14864f739fede4a0c8cb9adeb47492ed9f480d9e2ebc699a249d050142d1dd59e075f07f9a75013cc0bd5608a8a8512cb934259284de8396a4ee765f8366353cdc2f78b1d25e9612e8e5f28394b979e004888796b3c695a8083d5bdfcb9f8e0717333542a05bf73016e4204d46aeefaf58194e9287e8162528bd500dea6d39b5fff3130e56e23c6511a754d1284ecbaf6e68320eb1632d4d53e7efef101919343e868f26f187c8b6a2c3da8f84c82288a19ed633504f27f3e72d88d367f63a635b37b27085c0c027d464a69361029928cc22247aa030ea3866090000c3e55b4d1f942fa938d852786b32fca169beb15d615114116787dae33dc9ab4cf157db3d2dcf501a47dfb79d5ffdb7d6390231acd8af42cccaeb50fbd24f8cfe324d712582428cfc5c312c3b9d4051659bc90856d1d7b3d29acc7d7d1581cda22f7b5da07d011aa71496e4f888619b5be1888a72568933d2ccfab5111bcf95e20f648b3ff9ca4421a88e1d2433054944a47239c4fe756ebcee4b49bc2d141ee511fcfa547ce280ff251b48cda0d0df2b2b51348f9524e08b27ed52fe6fbed4ba33bbf1919819524cbc12a0b6dc7cf66108efa59bd7d545f9148fabbc09251fa44e6c4451a0a038eb1e0272657975bdb3e9201baaba90e3f852e8cb36f4b5b263885528cdf7161d78097420e316becb0dc50960583d48f9507e3c4d0f176059eed0ef3b3ed74db403ae002b93c951bf633eba846c57f73c131892236fa21e2dada54f90e91739b23ff70b214819b46fc99d9f5f5a46fa1a5d772005bc9525dc85d5d376a3c2780012", 0x1000}, {&(0x7f0000001640)="69a82b6552fc7f8994c98cf1470ac88070b1d8481c242db69ff8a5fdd2c0b19b7ddcb5ae4956a1522b87076973de122842c239068c1582cb1a39eef40832f088097a841dc78d6328b488a27504dea8b2edbb162f6291608e11bf0ed5b2e9bd003ae361416973ad9bf61a20af051351baa8f3375cc20197f6bcce0c18e6540cc0c1a1297265523e1b9c6bee33bfd334279a23c982a82022d61a9ece9e3adb8f4ddcde4987dab2530497352925cfdc36c274cb05addc26de3e9fdecd6feb", 0xbd}, {&(0x7f0000001700)="f0d3f1f0ddb7f277ddddad810452d5f312c151242659781de0a40967c1d4d8b9f7d448b18eaf3f785c0c3bb45370e14388521ab532aef9ed7fee75a45335ca9970ee91c746438731d8f4d68a68998917fa32537856a9d7bcb66319a63826c165e06d69af811e55d98e4e3b72c8be10ac6ecc69b3e197c7c7d46e1304c6a40a4dc682139ea1551ed89df1ecc18fd5af6d9d8b48264c42ea03a6b5a349899bc3a03a4f577211eb1cd3e49bf2e1a2ad9ece1b0a784450cdffec95c15e4158943175edae3c7b00353a5bf5313dc907319ec9eed6bf0e84624c92977febee58db1b01c86b02f5aefa55b26b3e7e59c5272d8dbc9ab2", 0xf3}, {&(0x7f0000001800)="a3e59db08876e1e17ced9ef1c166b6cbcb79157523c6837a8203fd16f2963f49fb44187d15989f07c53b6d877f040e477423d8708802baa99f0eaead87ac3ae3d80c6f732ab4bec891c45a461e277a3c0f512bc7e7c6229083dab1d1487f97357fc50826a8d93968c51ce04cf2b7b6102e4414ada02dbeca4a3107ff9a1655d1ae3ff1c8017b69d3df59c6223b335181f6220dcf8871", 0x96}], 0x7, 0x0, 0x0, 0x4004000}], 0x2, 0x40000) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000280)={@remote, 0x7, r2}) sendmsg$can_bcm(r1, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="0100f6ffffffffffffff000000000000f12a7b6ba99f622766c73f9442452561cf3321f5c6354d060199db1370c8ed2be1c19696ae6bd9066d12384b209e421f00e184688429b970d8097ae6175df20011bf5e41ecdca54c089d26595724a37d6266ed92c2124329a4b6da255a2994", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000080010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) r3 = syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x1, 0x0) ioctl$TUNGETFEATURES(r3, 0x800454cf, &(0x7f0000001a40)) setsockopt$ALG_SET_AEAD_AUTHSIZE(r3, 0x117, 0x5, 0x0, 0x4) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000fffffffffff900", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000708d900000000000400000000005a34a50132ac2797"], 0x48}}, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x40, 0x20) 09:16:57 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x1063084000000000}, @clear_death], 0x0, 0x0, 0x0}) [ 672.981621] binder: BINDER_SET_CONTEXT_MGR already set [ 672.987058] binder: 7479:7491 ioctl 40046207 0 returned -16 09:16:57 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x600, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:16:57 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x0, 0x68}], 0x0, 0x0, 0x0}) 09:16:57 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x200000c8}}, 0x0) [ 673.053053] binder: 7497:7499 Acquire 1 refcount change on invalid ref 0 ret -22 09:16:57 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:57 executing program 2: r0 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000100), 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000140)=0x9, 0x4) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 673.134324] binder: 7497:7499 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 673.167696] binder: 7497:7499 unknown command 0 [ 673.175602] binder: BINDER_SET_CONTEXT_MGR already set 09:16:57 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x7ffff000}}, 0x0) 09:16:57 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x400c630f, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 673.189874] binder: 7497:7499 ioctl c0306201 20000140 returned -22 [ 673.210209] binder: 7509:7512 ioctl 40046207 0 returned -16 09:16:58 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x0, 0x7a00000000000000}], 0x0, 0x0, 0x0}) 09:16:58 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x6000000000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:16:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x400000, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e21, @multicast1}}}, &(0x7f0000000280)=0x84) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000300)={r2, 0x2}, 0x8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:16:58 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x37}}, 0x0) 09:16:58 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:58 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x7400000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 673.404733] binder: BINDER_SET_CONTEXT_MGR already set [ 673.416229] binder: 7536:7540 ioctl 40046207 0 returned -16 [ 673.444269] binder: 7537:7542 unknown command 0 [ 673.462654] binder: 7537:7542 ioctl c0306201 20000140 returned -22 09:16:58 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x0, 0x48000000}], 0x0, 0x0, 0x0}) 09:16:58 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0xfffffdef}}, 0x0) 09:16:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000000100)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000801b6000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:16:58 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x1000000}, @clear_death], 0x0, 0x0, 0x0}) [ 673.634751] binder: BINDER_SET_CONTEXT_MGR already set [ 673.651359] binder: 7559:7566 ioctl 40046207 0 returned -16 09:16:58 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:58 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x4800, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:16:58 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x0, 0x6800}], 0x0, 0x0, 0x0}) 09:16:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000300)=ANY=[@ANYBLOB="a05a98f8da8e4b6a414644fa8983e3e6d9de1216b6fca0bbc21892ed182f0a07fc6183b100b7e915859a5962b9f49987a1f0762ab883f54bc5561faf5b9e4681a5b51bab6557338b9840c987eb31b6be837d8b90a1c7581551ac50a3e26d02635bb7dee1514373e9622dea7755c75a5efeb722bba889d31d514db9a2a9b7b985eb94", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000000000000000ffffffffc2b6410650b028c6944a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x800, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e23, 0x8, @mcast2, 0xffffffff7fffffff}}, [0x2, 0x1, 0x3, 0x8, 0x200, 0x5, 0x1149, 0x6, 0x0, 0x5, 0x5, 0x5a, 0x3, 0xfffffffffffffffe, 0xfffffffffffff9d7]}, &(0x7f0000000240)=0x100) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000280)={r3}, 0x8) 09:16:58 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x38}}, 0x0) [ 673.707882] binder: 7569:7571 Acquire 1 refcount change on invalid ref 16777216 ret -22 [ 673.721956] binder: 7569:7571 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 673.728747] binder: 7569:7571 unknown command 0 09:16:58 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 673.814789] binder: 7569:7571 ioctl c0306201 20000140 returned -22 [ 673.832339] binder_thread_write: 22 callbacks suppressed [ 673.832351] binder: 7581:7586 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:16:58 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x8}, 0x0) 09:16:58 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 673.869045] binder: 7569:7592 Acquire 1 refcount change on invalid ref 16777216 ret -22 09:16:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000400)=@ethernet={0x306, @dev={[], 0x11}}, 0x19055e60a88a9c74) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000200)="e70128200e047d8d08af5809b904dbe4931cb0c8cb5bf1a6a735bea75f256bcdc48ea5079f1bd05519c3d7896d82da160cf8717ba5c374c1d94d7ebf30d796e238946d9ea1666018136685646a", 0x4d, 0xfffffffffffffffa) r3 = add_key$user(&(0x7f00000009c0)='user\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000b80)="1d4f5697e7526c3c08bc14be1f54ecf4fa5f1b86be380842dab4e4b3ca7edbe3172281561039b0e4e8f2eae322aa0d9aaec8b2c0fbe074e0a172a808f1f4e6512665d277301883a908a773863bcc93c06a865b8de8a56a763d8b55974bf472a9cd2f5bf2fcd65fb7caa74385da7245615de47353af13756b5d3d5291cb3c50f2286fdda35093220883c9c4b40a2c2b858c6143f1db3fdeb33f9460d2886eeab45a27e4999c23aeb8eff0696ab821031bd431d7aaeb2c5d3ee1d3c36f437d0f", 0xbf, 0xfffffffffffffff9) r4 = add_key$user(&(0x7f0000000700)='user\x00', &(0x7f0000000740)={'syz', 0x2}, &(0x7f0000000780)="7e3d6ee1ac901f70d415bec8b1b57de071deeb702f", 0x15, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00000007c0)={r2, r3, r4}, &(0x7f0000000800)=""/77, 0x4d, &(0x7f00000008c0)={&(0x7f0000000880)={'sha256-avx2\x00'}}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000000000000000120081cf043dd21ef6225c87b42f5677230d174d0759c2ddf5334a6db4d6e41836449f9f82b4f35c030e1975385a310eb9d1b90c5b70e357e5a1c35d4a234cc73977d17810afaaf104220f7640560e96566c6bb750f05a4b609adc49949357bf18a1dfda321efd06b7581080e15aa47821a76a13de3342b08c79567bff5f595c8333af8dc732624bc8dfda3a6d86d28c", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="01000000002c0af80b826534620bc6d92548d61b5084c7c421f81dd720f19b6f54e539cbeb71f7b438801578202326bb0c9606b8645caad8cea7c3f4daf089142cacfd200aa2c96485301e22df2edfaf87e6e2d0bbf73e9be0cbe78bf4619d9b0debd2f545362b370b8cc30a3d9194d566c5b3c7abe25402e2714258117447d2f4bc725a299b71427f5999ab7632c3fe44d52ef887a11bb3b15cd94b896411a913f9217fd4c980cc8b8cbb1ce352a8006a865cb07c1514ad8e33fd1a021e922924ef5a78f50ee352166f712fa7829fd1a1c556ac25a0cc9274cbe700f09fcdd4ae232bd586b86366730c78e91f35f4ec4c563227868128bb46e5172f2d9e4e0eac6398ac334c783774606db04ccab7a7b1932b218bc6954b63573ba71022f8c235729028685593190e523c0fe6616a6ab69519e99f3d3bbcee85a464b09c091bd6032169b6f4fcacae0adfe7129ac70660daff3b510575a648db62232b75de05922c5a3ebf4095e792f14b9429344db55ae177edeabb881854ac04eaa927121557aa18e5b85e995023aa55e7313522a6eab0f1f6cf41377c5453ff05e04f918fd1a13f5aa19f469793a5b27f75df21b3578fd1e11cc2953c42f2d91e082d22a8d79305e355ac641d09f1b736322515e65beb7a2eaf6200000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) ioctl$KVM_SET_BOOT_CPU_ID(r5, 0xae78, &(0x7f00000000c0)) [ 673.918101] binder: BINDER_SET_CONTEXT_MGR already set [ 673.931907] binder: 7569:7592 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 673.972708] binder: 7595:7601 unknown command 1661206528 [ 673.980774] binder: 7581:7586 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 673.990311] binder: 7569:7592 unknown command 0 [ 673.990713] binder: 7581:7596 ioctl 40046207 0 returned -16 [ 674.002012] binder: 7569:7592 ioctl c0306201 20000140 returned -22 [ 674.014444] binder: 7595:7601 ioctl c0306201 20000140 returned -22 09:16:58 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x5, 0x400000) openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:16:58 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x500}, @clear_death], 0x0, 0x0, 0x0}) 09:16:58 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0xffffff1f}, 0x0) [ 674.029887] binder: 7595:7607 unknown command 1661206528 [ 674.045841] binder: 7595:7607 ioctl c0306201 20000140 returned -22 09:16:58 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x0, 0x2}], 0x0, 0x0, 0x0}) 09:16:58 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:58 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xb63000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 674.137476] binder: 7610:7615 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 674.172472] binder: 7614:7617 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:16:58 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x3, 0x2) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000140)) connect(r1, &(0x7f0000000000)=@rc={0x1f, {0x1, 0xfffffffffffffffe, 0x4, 0x0, 0x5, 0x80000000}, 0xa000000000000000}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000180)=0x200, 0x4) mknodat(r1, &(0x7f00000001c0)='./file0\x00', 0xc02, 0x0) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 674.190331] binder: 7610:7615 unknown command 0 [ 674.203220] binder: 7610:7615 ioctl c0306201 20000140 returned -22 [ 674.224253] binder: BINDER_SET_CONTEXT_MGR already set 09:16:59 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x300}, 0x0) 09:16:59 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x300}, @clear_death], 0x0, 0x0, 0x0}) 09:16:59 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000), 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 674.263616] binder: 7614:7627 ioctl 40046207 0 returned -16 [ 674.290491] binder: 7614:7617 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:16:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x363084000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:16:59 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6c00, 0x0, 0x0}) 09:16:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = syz_open_dev$vcsa(&(0x7f0000000580)='/dev/vcsa#\x00', 0x5, 0x20200) ioctl$VIDIOC_G_SLICED_VBI_CAP(r2, 0xc0745645, &(0x7f00000005c0)={0xaf, [0xb34, 0x3, 0x4000000000, 0x1, 0x3, 0x9, 0xf1b6, 0x7f, 0x0, 0x6, 0xffffffffffffff00, 0x1000, 0x0, 0xff, 0x9, 0x1, 0x7, 0x6, 0xfffffffffffff001, 0x8, 0x80000001, 0x400, 0xe8, 0x8, 0x81, 0x723, 0x0, 0x9, 0x2c, 0x2, 0x40, 0x81, 0xc7bf, 0x5, 0x40000, 0xffffffff, 0x0, 0x5, 0x10001, 0x5, 0x81, 0x50b9, 0x1ff, 0x0, 0x2, 0x100000000, 0x3], 0x6}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) r3 = accept4(r0, &(0x7f0000000100)=@ipx, &(0x7f0000000180)=0x80, 0x800) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000280)={&(0x7f00000001c0), 0xc, &(0x7f0000000240)={&(0x7f0000000300)={0xe4, r4, 0x32ab8bfec4ad4485, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xb17a}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xa60}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}]}, @TIPC_NLA_MEDIA={0x98, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0xd4e216920951a607}, 0x40) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000), 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="fae06f86fbe26bdcabbfde84efb90ec1", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="010000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) accept4(r3, &(0x7f00000004c0), &(0x7f0000000440)=0x80, 0x80000) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000540)=0x5, 0x4) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000400)='/dev/video36\x00', 0x2, 0x0) [ 674.409336] binder: 7641:7643 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:16:59 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x6}, 0x0) 09:16:59 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 674.475802] binder: 7646:7649 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 674.495014] binder: 7641:7643 unknown command 0 09:16:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x1634040, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 674.534918] binder: 7641:7643 ioctl c0306201 20000140 returned -22 [ 674.542716] binder: 7646:7649 ioctl c0306201 20000140 returned -14 [ 674.572215] binder: BINDER_SET_CONTEXT_MGR already set 09:16:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000000180)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f00000001c0)={0x1, 0x40, 0x0, {0x77359400}, {}, {0x0, 0x0, 0x2}, 0x1, @canfd={{0x2, 0x5, 0x2, 0xfff}, 0x14, 0x1, 0x0, 0x0, "770a78703fc4f016d87d7a3879b3a954b729d822f84ad22e176d828f94a9f004cce107b2ad93e0ce3ba0e635de109bd1155f94bd208f328a436b2c33903e5ded"}}, 0x80}}, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x2) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="010000000044727d5a00000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:16:59 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xe630c4000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:16:59 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:59 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x5}, 0x0) [ 674.627345] binder: 7646:7660 ioctl 40046207 0 returned -16 09:16:59 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x7a, 0x0, 0x0}) 09:16:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x3000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:16:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYPTR64=&(0x7f0000000680)=ANY=[@ANYRES16=r0, @ANYRES64, @ANYRES16=r0, @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="5a34b8a54f81878d2740c51ab2317641088eec56f64f099b759afa867862e33699cab71c1c7e6d106b3b4bdf6777f6aa2ed0b080e4e9e351639eb7c80040ec4611c22d488850f1149efd0db66b697ba9c6558fee42527de105291968f507518b", @ANYRESHEX=r0, @ANYBLOB="e721b5f078c4e2d8cd24b8d9bec639b2caeba5a7692ac7abd20402c7e6da23d6ba94274f20", @ANYRES16=r1], @ANYRESOCT=r0, @ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYRESOCT=r1, @ANYPTR64, @ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRES32=r0, @ANYBLOB="9d806b1b9936dbcbb6eb2bf03ceb924284f17fed7c6b41ba9bcc4e3c211447668fc1d67ed9c01f4963b2444458dde59ea6692993892fff47b31de83bdeab1a9b139dbee1b6eeee107eab5387154c555f7a1c8deb63eb340bcde974067b5d297a08645fe7be1f33342104cb1b64adc2b7b3ed40f6a5244677765557bd9fdd41b78ea7d9b5584f542d06dc39a593a62901cd98944457052de21a1942a3717258fa0c584b", @ANYPTR, @ANYRESHEX=r0, @ANYBLOB="2a6d0b81a6386c9223151ced57496354e69d24d950bacd02df81f496e72fceeebf099f9bbd04ebff6f32fc7cf5b0bd435ce56b5a41a0294c3d7c7a902eda0092b7209af2056c9e89f7fe45cb1bdd41087de2d351e5ecbe4ed52d25fc95906f7755355dde2ee0eb984f297439b8387e685cfc49419a565c05ed365d7ee1c72f957f086d93263dd588406f1501bd965eb6", @ANYPTR], @ANYBLOB="e98311c7bc6e2f465ea738c6f288cceac55a9f9d5c169b2d89d4d84265b3382c6e53a76b1bee4d5eda65786988884f9e6ef8446164758d73d6b651ca16167ba54ce50d0c6e32d1a258c069d486e7f8599dcc3fbc13b75c1a9cfae3beaaca15e42782a4ce8da58ec1421aae9cd09fdeaf6db27f318876803cad16c75645203df7e740fa7e790b6bf7f2befd4e6d1686bd865497b9fc9e7204f89a09399e7116926732bcafef17e55f46145bfb"], @ANYRES64=0x77359400, @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRESOCT=r1, @ANYRESOCT=r0, @ANYRESDEC=r1, @ANYPTR, @ANYRESDEC, @ANYRESHEX=r1, @ANYPTR=&(0x7f0000000180)=ANY=[@ANYRES32=r0], @ANYRES64=0x0], @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="edffffff00ba5067e2cdf336197f0000000000001000000000f2cdc2b64a289968"], 0x6}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000ffff00005a34a59932ac27b7"], 0x48}}, 0x0) r2 = accept$inet(r0, &(0x7f0000000240)={0x2, 0x0, @multicast2}, &(0x7f0000000280)=0x10) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f00000003c0), 0x4) [ 674.765926] binder: 7675:7682 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:16:59 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x7}, 0x0) [ 674.818668] binder: 7685:7686 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 674.838978] binder: 7675:7682 unknown command 0 09:16:59 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x12000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 674.860583] binder: 7675:7682 ioctl c0306201 20000140 returned -22 [ 674.871485] binder: 7685:7686 ioctl c0306201 20000140 returned -14 [ 674.917407] binder: BINDER_SET_CONTEXT_MGR already set 09:16:59 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x700000000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:16:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000100)=0x2) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:16:59 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x2}, 0x0) [ 674.959767] binder: 7685:7700 ioctl 40046207 0 returned -16 09:16:59 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x0, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:59 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x60, 0x0, 0x0}) [ 675.033283] binder: 7706:7708 unknown command 0 09:16:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x40406300, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 675.077428] binder: 7706:7708 ioctl c0306201 20000140 returned -22 09:16:59 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x3}, 0x0) 09:16:59 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x0, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:16:59 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video36\x00', 0x2, 0x0) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:16:59 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x2630440}, @clear_death], 0x0, 0x0, 0x0}) [ 675.161335] binder: 7722:7725 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 675.183965] binder: 7722:7725 ioctl c0306201 20000140 returned -14 09:16:59 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x863104000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 675.241812] binder: BINDER_SET_CONTEXT_MGR already set [ 675.270051] binder: 7722:7733 ioctl 40046207 0 returned -16 [ 675.305644] binder: 7722:7725 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 675.305865] binder: 7736:7741 unknown command 0 09:17:00 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x2000000, 0x0, 0x0}) 09:17:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) geteuid() sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:00 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x4}, 0x0) [ 675.323917] binder: 7722:7725 ioctl c0306201 20000140 returned -14 [ 675.347638] binder: 7736:7741 ioctl c0306201 20000140 returned -22 09:17:00 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x40046304}, @clear_death], 0x0, 0x0, 0x0}) 09:17:00 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x0, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:00 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6000000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 675.468051] binder: 7750:7753 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:00 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0xff000000}, 0x0) [ 675.508791] binder: 7750:7753 ioctl c0306201 20000140 returned -14 [ 675.525622] binder: 7759:7761 unknown command 0 [ 675.547974] binder: BINDER_SET_CONTEXT_MGR already set 09:17:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) dup(r0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000005a34242310c62710"], 0x48}}, 0x0) [ 675.564251] binder: 7759:7761 ioctl c0306201 20000140 returned -22 [ 675.570813] binder: 7750:7767 ioctl 40046207 0 returned -16 09:17:00 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:00 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x8631040, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:00 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x4000000, 0x0, 0x0}) 09:17:00 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x7a00000000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:00 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x8000000}, 0x0) 09:17:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:00 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:00 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6800000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 675.795387] binder: 7789:7792 unknown command 0 [ 675.802498] binder: 7787:7793 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:00 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x2}, 0x0) [ 675.868932] binder: 7789:7792 ioctl c0306201 20000140 returned -22 [ 675.882024] binder: 7787:7793 ioctl c0306201 20000140 returned -14 09:17:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000180)=@llc={0x1a, 0x30d, 0xa7b, 0x7, 0x2, 0x865, @dev={[], 0x1b}}, 0x12f) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 675.914861] binder: BINDER_SET_CONTEXT_MGR already set 09:17:00 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, 0x0, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:00 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x400000000000000}, @clear_death], 0x0, 0x0, 0x0}) [ 675.953446] binder: 7787:7808 ioctl 40046207 0 returned -16 [ 675.979877] binder: 7787:7793 ioctl c0306201 20000140 returned -14 09:17:00 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0xffffff7f00000000}, 0x0) 09:17:00 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x4c00, 0x0, 0x0}) 09:17:00 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x1000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) accept(r0, &(0x7f0000000100)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000180)=0x80) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x1, 0x0) ioctl$KDMKTONE(r2, 0x4b30, 0x7fc) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="000000000100000000000000000094b5f2cdb5e34a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 676.112436] binder: 7818:7824 unknown command 0 09:17:00 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040), 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 676.151127] binder: 7818:7824 ioctl c0306201 20000140 returned -22 09:17:00 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x9631040}, @clear_death], 0x0, 0x0, 0x0}) 09:17:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000140)=@vsock={0x28, 0x0, 0x542f3080f67c91fb, @my=0x1}, 0x9a) r1 = dup2(r0, r0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000000)={0x1000}, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000100)=@generic={0x0, 0x1ff, 0x800}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000a1921dcacd42b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 676.313350] binder: 7833:7834 unknown command 0 [ 676.323151] binder: 7832:7836 ioctl c0306201 20000140 returned -14 [ 676.325252] binder: 7833:7834 ioctl c0306201 20000140 returned -22 09:17:01 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x1000000}, 0x0) [ 676.373722] binder: BINDER_SET_CONTEXT_MGR already set 09:17:01 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040), 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:01 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x40406301}, @clear_death], 0x0, 0x0, 0x0}) 09:17:01 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x963104000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 676.415137] binder: 7832:7845 ioctl 40046207 0 returned -16 09:17:01 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x300, 0x0, 0x0}) 09:17:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000140)) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:01 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0xffffff7f}, 0x0) 09:17:01 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040), 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 676.564750] binder_thread_write: 9 callbacks suppressed [ 676.564765] binder: 7859:7864 Acquire 1 refcount change on invalid ref 1077961473 ret -22 [ 676.591623] binder: 7859:7864 unknown command 0 [ 676.596339] binder: 7859:7864 ioctl c0306201 20000140 returned -22 09:17:01 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x500, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2, 0x0) bind$unix(r2, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 09:17:01 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0xff00}, 0x0) 09:17:01 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x68}, @clear_death], 0x0, 0x0, 0x0}) [ 676.695925] binder: 7866:7876 ioctl c0306201 20000140 returned -14 [ 676.733469] binder: BINDER_SET_CONTEXT_MGR already set 09:17:01 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 676.782758] binder: 7866:7883 ioctl 40046207 0 returned -16 09:17:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x0, 0x0) sendmsg$kcm(r1, &(0x7f00000014c0)={&(0x7f0000000140)=@ethernet={0x6}, 0x80, &(0x7f0000000400)=[{&(0x7f00000001c0)="ddadb31d9414e9163b53b6d615f2316f3a5893918a94a21f0f45ea54519693da81b884e4c2897e42fad6f8c09f6a434149215cd87a78836531cb7b17676a9375195085556d32ce60b711311d89", 0x4d}, {&(0x7f0000000300)="d0d12ae98be9e61a7cd4c0cf14a1ca8a9fa9a0371fcd7daee9072c5b319237b6e8faa60f9f1dfc1f765eaa64ee54ea2b7204c0a5ee2768f06302341ede12e682d552ce81038300956255d0827f012fa0e50ee9c64da4f5dcda9b8efbd66b47922cd4081aeaa209c00bdb613e0df89d632a29d29d341e03afeae47e1d15f08053ada127366fbc0841fa262148c940e429d13065aa02582775303a07d0ab947a253a52c9ce28c40763a3e58d950712ceaa3aed0b3b1e1c76e10f542b2bd9076ba563643a640cac255f030d593783ee32e98a4a", 0xd2}, {&(0x7f0000000240)="477a71ff7e82f50a37861e6e20ce7306be1f96c17d04a4e4d573b165595271e2c0aaf578185b7eb0dbe2c8beae5c4ba01575ddb529b096da227d7d9b4b4643e55e131ef862f3", 0x46}, {&(0x7f00000004c0)="62183bfe84315cc4fb14ea96ee3b84d6e1745416aa09aeddcc23cb0020863620538c15f8d114c4e12cfaf1f715ad5903cbef5678be7b7035bfdbd7b85e065517e3daf2af173087753a654f392fae2e94b837ff9d031083a1e6acbc80b1d0c8f2564629ab324dbe9ccf196983bfc581544cd582c019a6c955eb6af996658c2e6c4288f1b1a52ffc6db3b1d98e3a54f5c10f2ac586432d20edcb3e52d402d747e818d46c11fa195161abfc92585a9b579158b6e8faf333a920010c5c314f73baef5ed05834c7739fa7eee252a6aa2d2f067b1ce1c9b26c2e137f114ede5d49eb35954ff8cbcf36be18742f0ef71ad9cfa828bf7672ccf1608a2cb1316cffc5880b91b7d62fddd1d8887e2363e2b7441b5370e4d1c0e246badb06f6ebe3568ea6c8182a96b0ef25813243feee461788f1ca966ddd9b4d3e479342e40c22149fa6cfd59bc181614964564f3caf988872a71fa2828493e637fe0523236c7c956040654aa132a5ada32d7fc05c0b66e49f25b21ec84bea512175268d321b9ea29dd768d7212851411c2acaeb4dc0c919e48e5d0d2897da78f2d3f1498d4d678910bf3c543cffcea02ed029add71ab4120fd0e54c42fe3eae2e37551195e11075708bd7e405570f3062efb162fb337e7919b49e193000bedecaccc71d1e1d5a7656c2aa2bb66faa98db30357723f6db73655bbae0cf3d0307ee5334f983833923f4e13a4e8b23b0d7d99d85e930bf8ba483b4baf51c025f73231852f97da2e5d7c17ca271de049f33e904da72c873ef873a63197a7d84e922d1e62b27bb1649c4c763d392541c3ae6ee54bd71f70ebdb9efc1234d70e707c447a77874479ea31d48080a38de8108c442fbf9190eba5bb71a3721da9eb8ddae5c81faa28c5c2bed1bc0783f33c01cff1603a1217e2a304bfba0a3582d9ae6ccb152e9a5c2061fd06efc713800d7af0b00680d5698c67c16b8a5787453d902de24d0b6d66a57cb84db02262c76ee318c6dca076e7b18a0d6f6c4d8ac67c670b6fab8db1c5b92980aa885f6260ae1a6edda377f79f6ad58ae6b17d2d4f13cb2d7b8c8fb74c9f7f8b3ba4e738f4ce0371d584ffe318cdbddd57a853af0368617e480fa9e9246610fff5e72128b4e50c9d212cb07354c234c1307c8f7bf52a8b70b61fd84ebc0a6d1397370f9697349541fe0e95a5b36b3312293708c9209c7e92b4679806fa2640d8341fa53db23a0c4d89dd0259bd82955e8399b79ee099e634e7e1e02ef05f111e95de24f4c714fa702308ec4f991d274b4dfe556e51cce0e5b47a945862da13fd0f1ca753f19aefc2f3008a125555b8e92778e9ef3bd93bde609058c31c3155cdd561df01aa7f887a60ca49113e1d03b6ba98d20ee77604053019358398a19bb3ead5e9cfad5b8078de0c5a329dd25ab7c9805931fbde55a98c0cc810dc65e37696ea86b0ed3c0dde1a7e275d38e7d0a08839f9ab68d8b8f6555ae6194139d504e6051693f4846b67ad4325c9ac5c4da28b3fc8b428b0c2f939fdae92652a699a2d6b1f3ad2efd40923c9774a8e19c1a36942d50c8a67650427215e3ddde70d62504cebe18b6b99ec2c8cc62b02f2d089137fcf06fdd8313e8f1efcaa23dbe011764db0c58f3a9d24d535990ca63f4794b4d765dcdd05a7178e85cb68010db973c18b278ab0256b5fdaf051a3d94ea5a2e911417e626207344d7a87de9c4f878d69b81c67d75c55700e1021f9aec1fcc761578f78ed284a7e32707471d700cbe572c22cc53af94605656a3b5d764bb65b6de51b7c994bc84b9dfca6a662ffcf51a79093e93f66df05a01ce231ad44374ef0ee71dbee7d69f01b15eb8e02a5902e50aaacb10a5be18fc305c1cdcadb373471238fed106b9fcb132af4fb82c5dce83aeaa23962432f90acb1f54dfd3ab5505b9a886e5eae1d5f95a380b3ea0da50d48408bc9da8dd94a99271466fb8bc4551ab3ebff49ecd9d1ebc675ea8123e2c66044a873ebfa65626b3f82416c68ad109df5b9a5e00aab5334ad8455071342decbc46e0d0172479526242b7ec3342fe2baca4458173eb82fb763074bda1a26d9c28e4ef3b87ebf81014fd4455121ae0b1711470d01bd814d61ee3f2248bfd09295965c468de7a86d771eb01d8f0e4c19d3c8308e922bdefa7ff9c2ae278a38b56815490d07891ecb5c281f0bfc1bd8e6da818fdfb27b453f95f8d00e62f3021cb0cfe01c4b76e7caca6427199b066c5ac732a994271e5111a908896a7f668f221a6af32d4890e46dd76d5d82cded8da678942c9e17b7ecbbad64d2d1a3e0a14c3ad25b65aa5c7c27ddbd00b99bcaae2d4731fbe4a283742e957f4055a0c090aa5a2157e083a544771511901236ded67df638f8c134aee3af5019c1e77bc5f2ca7bad309c85c413df2cbbf8027ec8b6bc2190c0f86476767ec674520965c0a6802f96bbcfb3b11ad4ac7d8e1a3eaa933a5991853cdbe9ad3ea00dea081131431458d7e6c637aed266730aeae5619054957a0b63295c250f36f34286b11b38720d950b42e0a40d7bb9fac19d9becdd3d11c6b993bb7f0ecd6c35e406ab5b83a942aef6e9572c17fb535fc7e27ec06fca63644048dd3485f52a3b3ed5fe2a66fbdf1ce407e48d7d13b68be455ffa625b1ed1725d78c7900ec826a8e13c0829d3f25370c7d5c04e6bd9cc89f967015eb3fa23abcbe49d3045c974db93b036f3be90ed7e3f2f64094134724574d0b20d80501ddea1e684c137067921a0d12e813b70158a8626b14544f80615557cf2231264e64f41b8f3aa313a982ad6fd20013d5fefcad6a9b764db11fa5daeb5d952a25b1340b95f5ac8d93069b22681f3e2171037ef2057137414c187e225f5660be51d11a027dd6c0e2f21714075ff1f8b46f1059d80874aba3ca255b2eb149f53b1b2cd7e9535a2f5c2d231d021d67b603a6ffa015bd4c2a3e9fdebc1a2967dcf99ec063e5f3fb04bd556d418efa3b3e90f25009c096c6b4dcf37c38fb5c64fc6680df974d729a006c6793a04e828d89deeb19f25032df1597cc38aa798a0fdc5b8409b6b6ec3fd75a164385989e09731807e0622ac909b0cadf16fb64d2d619cb86a03171782a1491b5bc4fbdb1bc61b00a2f6cc11756f9208157d4ff9cdaf075ca3f9575367a13010fecf534270bbfc37d6120b059b5ebb6dae15683670b9cbe411d30e8920d2efa7c468ee6308c1e25d48fe28bec19aaf0f4a8182b44aefe149f773c77c34a101ae0ac224019db1c6388cd8e4aaf039ae4b21ec30c19cecabf6090b11ac07ceb122280a9ad38271a9bbb4ac383b9171b3a30d9a0ab1c5c12493e008135528935d76d3fdca6223a99101de7984aac2b99e713d8682c745bcb83367c6b6cf9e2fbb403f6bebfac679d7e7425daea3e16977c1662654dea6f5ab6f0b1c3861ba1edd2f4021cb124e59385ae2300a00e0847c2ad661b78076e793d8b7c20aaf80d9fa5e50a55c162fd4d159a93943965f5973848319095ad67e2139d1145445d9067d5b2fbd5e8b01f683faaf13c12d14b50c09dc88c9ba43ce6ef75a81deefa3cca484e18aa9196c63775bd18f133eed2913231a0addbf151642327b26a00e4383d2b6896c2254e2cb2a515f81f9ed2d7ae6fab41f17a1f3c0c42b1edc199d9d9a6ae8e44cc32de29e290ae6d3e2bb646baac31c86b84facd41305cff4659895594ae40dbfc18ca5a7d935cbcf296a689ca81efeb623bfc92f8faf127fa16117d1e9bfe27dfc82e6d003aa3805463e19596b5e96f257009a192b89b5c0f3e445d72c4af236482b5907301b690c770d245d08db1b02c4618f1df22460208f49b12c5ad2feef505b3460f7b9d853cc771bcda83222df5a2266f63cde531e106d366620edbf88023233746dd3d9f6188136338241e5d756ff89c7aec4951b82842a895671413612a952754fecfd7c2d6e8bb07995f397d7d77a081be25ee9a695df36446fe815e6f9853116e4294738167dd68be733d866ef03ea28ce4bb7d5608e5d8ae4ca0862875cf0f79a3d29e1b5fc580819fe4d8233e6ad833adef55d028d54126f2b0be9c0118e325b03f7b32732456995658f730b7b86f1d0a8924b5e0c6a4bb3e022b8c0718f671b87f729919ac51d0aac133f996e91c60cb64ab24d0ccb7b946831c5d97243d5df36edfb8455f87a39e5fde80ded7e9b10247d61a0a181d4dbd9e564e80b211fd09de5cb52034f9e975981b69517ec935e7f8f226aa6d70ee89d0eda219c3dde7e3c01c1f1d7ae2786131466a927dee378ef1258d39f1462c363b1e9a458c12290f49f1c6209a7b42dd2f9b68991e54e06af082cad47860fca3b50ae07ab4c62c51ba27f06ee53bbc889f270bc78a76ae7f97d8d121cfb31bba5916368e587e4d8e20ce4e9159b66676d93c3a656cae8521b1b198581a0dce9a3a766ee965e0954caf1334a2ca1782c7908caffd754c1ad82a305f6aa05fbf20188e456d7a6d85052a27f79d8f265ffd2f8c4ac8035ba86f8a194c62c05ae01566f402137989cade0980516b9b68e971a208171ae8548a4d49b8591de9fdc87f8a7898eb5c6b366df4de7ca3c49a0d392fca42d179ad0314f3e46e323ec0f811555039d661b97cb63c5cd3bc31235a4daf50e743bc8c7933e30e506c903f91abd5c40c0b058fa4d8567207c30a8f07dc5271278c24ae583b083e8ce8f637ab21c2354eae9889e27597b80477bf0b831aa967314fee72ab6e32b0fb66c0e407b508b24a330e57a44de11ffc4459f3c1792fb90ed30934b79f364910f726c0ca89d7f3d151ba5b7e5cf488aa435fb36d0817b7fe1f7b240683e708613817110604260025030ee38ebf4bbb983cc36ec2eca6777e840ff74230827030ed762d72f08357f209d78cff8b0d956911f341eac4ed9a227cfbad27ba23d9b936bcc26b9a204e19300e0e14c9c87c2b8d6473442176bb20415a6975cf82babf33487fc81f64bbc15bd7fb5572979d0e1a940f6bc9454ee722f2d274d161513da063ea69dd6a0ce81b810a8fd813ab53bff443cdf17a6692d3f4b681ecae707c1fe0584c9632a0f1d99e11b83687cd6ec1d2dfbd334d3b96cd77ce61eb77be6261e89d8564085b70f52dd6667b7a51de6649495548fb7344c82145d6a5637e49fd9a862a0c87ba0e8ae52233f1810c79ab72699dfa25408cefb6aab67eefbf6d12b44c572212f832a2d5a785c0abd7775673d399953b21c7af79bd5316982cdd67ffdf191bf2ed05d6f24d75630ed1018a93eca44c2cbdbd6ea85caea14c95ed732fc1ec254b4c83985d80f9c6dd688c834e3f89fc26d03b9e7c28e64f0a17e6dbdd13935cbfcc28aaaedf7e9fe78a584e59987cf79baf83d4a7805aef8bd40fde657424d2bd476260accda08e51b2ccd9194d6c1be57127d0701b57c9906cb93dadccc3586a1341ff4f3b2486bb1b1440b9fd916c6075727b76a136bc2ae5ff9d82dae102937711f876e484ae484b7aa39542eb34b4ff9f2d81a70a4979dabe7e95eaf53b0d078e5a47c61e2d276b31547c92628c7daf4623394d5d4c301de56fe31d9b603f63ef2569a9105e36e4371c1e37670089444811258105c871973e384a7b88a2577564d5f72dfb44368461275bb14848d4f1c00f0ba9ecbbac1fc8385b6e667c400e0f77ba16b9a339e6e94d368cd9f3dd396c0ebc6404d0df4e90a3945443b00c5bd33a71fae8320a9254aa3aa00049d43e4028a1e11001101877ce7bdc88f05f9da95b51a70b5874f4f5f3105039027cefb45e1dd487c4580ae9799b74e79c5a0ea125de84d51035cbfa2da", 0x1000}], 0x4, &(0x7f0000000440)}, 0x40010) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00', @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) accept4$unix(r1, &(0x7f0000001500), &(0x7f0000000440)=0x6e, 0x80800) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:01 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xffffff7f00000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:01 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x8}, 0x0) [ 676.851236] binder: 7892:7894 Acquire 1 refcount change on invalid ref 104 ret -22 09:17:01 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x2, 0x0, 0x0}) [ 676.907937] binder: 7892:7894 unknown command 0 [ 676.931818] binder: 7892:7894 ioctl c0306201 20000140 returned -22 09:17:01 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:01 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x11634840, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x81, 0x100, 0x0, {0x77359400}, {}, {0x0, 0x0, 0x0, 0x5}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000300)={{{@in=@local, @in6=@ipv4={[], [], @empty}}}, {{@in6=@loopback}, 0x0, @in6=@ipv4}}, &(0x7f0000000080)=0xe8) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000140)=ANY=[@ANYBLOB="0100000000000040000000c9da38b21bfc83fa040d8abc63166f3db84981c99561fb9a39b6f5bfa4975f78bfc801a500d87819fb48425ac4d961bddc36eb27081fbbd85cddff2d38ca5214f9b7db815cb4a91f9689bbcdcedc6227095a952a7099d898dbeecfc0fdc31a63224b0b8469504773de", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:01 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x48}, @clear_death], 0x0, 0x0, 0x0}) [ 677.059200] binder: 7911:7914 ioctl c0306201 20000140 returned -14 09:17:01 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0xff00000000000000}, 0x0) [ 677.133797] binder: BINDER_SET_CONTEXT_MGR already set [ 677.150387] binder: 7911:7925 ioctl 40046207 0 returned -16 09:17:01 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:01 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xe630c40, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) socket$inet6(0xa, 0x80805, 0x101) 09:17:02 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x3, 0x0, 0x0}) [ 677.229077] binder: 7926:7932 Acquire 1 refcount change on invalid ref 72 ret -22 09:17:02 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x2000000}, 0x0) [ 677.292837] binder_thread_write: 8 callbacks suppressed [ 677.292850] binder: 7926:7932 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:02 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 677.341907] binder: 7926:7932 unknown command 0 [ 677.348056] binder: 7926:7932 ioctl c0306201 20000140 returned -22 [ 677.358944] binder: 7942:7947 ioctl c0306201 20000140 returned -14 09:17:02 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x7400000000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:02 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = dup2(r0, r0) setsockopt$RDS_RECVERR(r2, 0x114, 0x5, &(0x7f0000000100), 0x4) [ 677.402981] binder: BINDER_SET_CONTEXT_MGR already set [ 677.434099] binder: 7942:7952 ioctl 40046207 0 returned -16 09:17:02 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x10000000}, 0x0) 09:17:02 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6, 0x0, 0x0}) 09:17:02 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xf630c4000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:02 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 677.534465] binder: 7962:7965 Acquire 1 refcount change on invalid ref 0 ret -22 [ 677.562000] binder: 7962:7965 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000abac000000000000f26d00b64a289968"], 0x48}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00', 0x0}) bind$packet(r3, &(0x7f0000000040)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @broadcast}, 0x14) getsockname$unix(r3, &(0x7f0000004ac0)=@abs, &(0x7f0000002d00)=0x6e) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000500)={0x0, 0x9b, 0x4, [0x9, 0x3, 0x7b, 0x401]}, &(0x7f0000000540)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000580)={r5, @in={{0x2, 0x4e24, @multicast1}}, 0x7f, 0x1}, &(0x7f0000000640)=0x90) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000088100000000000000000000015a34a59932ac27b7"], 0x48}}, 0x0) getsockname(r0, &(0x7f0000000300)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000380)=0x80) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f00000003c0)={0x0, 0xb6b, 0x8, [0x80000000, 0x2, 0x1000, 0x9, 0x0, 0x0, 0x5, 0x0]}, &(0x7f0000000400)=0x18) getsockopt$inet_sctp_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f0000000440)={r7, 0x5, 0x6689, 0x3}, &(0x7f00000004c0)=0x10) r8 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x0, 0x2) ioctl$BLKROSET(r8, 0x125d, &(0x7f0000000140)=0xfffffffffffffff9) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r8, 0x810c5701, &(0x7f0000000180)) [ 677.613713] binder: 7962:7965 unknown command 0 [ 677.633487] binder: 7962:7965 ioctl c0306201 20000140 returned -22 09:17:02 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x10}, 0x0) [ 677.658140] binder: 7962:7981 Acquire 1 refcount change on invalid ref 0 ret -22 [ 677.688773] binder: 7975:7983 ioctl c0306201 20000140 returned -14 [ 677.693756] binder: 7962:7981 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:02 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:02 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x5, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 677.734788] binder: 7962:7981 unknown command 0 [ 677.748679] binder: BINDER_SET_CONTEXT_MGR already set [ 677.752823] binder: 7962:7981 ioctl c0306201 20000140 returned -22 09:17:02 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x100000000000000}, 0x0) [ 677.781849] binder: 7975:7991 ioctl 40046207 0 returned -16 09:17:02 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xa}, @clear_death], 0x0, 0x0, 0x0}) 09:17:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00800000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7fd2229235ea8a03866514678f5c0010a000eb84dbac1a7dbfdfd0e79ff7dfa8ec91e8260ea4b71c344dbadbea61db9949e6c7cb9ce9413747045ef9b27994117e7942df55caea72ea19ed5a1b5fdc9c2fca23f59b71074ee67c616727075f0ee6a88e551581b7b6a52fbaf81d5b976663a56a6b65c55ea905f56e3112e632e46aeb65e3a"], 0x48}}, 0x0) time(&(0x7f00000000c0)) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer\x00', 0x80402, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000000340)={0x0, 0x80000, 0xffffffffffffff9c}) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380)='/dev/audio\x00', 0x400802, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f00000003c0)={r3, 0x80000, r4}) ioctl$TIOCLINUX5(r2, 0x541c, &(0x7f0000000400)={0x5, 0x9, 0x3f, 0x7, 0x4}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)) r5 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x401, 0x400) getsockname$packet(r5, &(0x7f0000000140), &(0x7f0000000180)=0x14) 09:17:02 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x2000000000000000, 0x0, 0x0}) [ 677.863796] binder: 7996:7999 unknown command 67108864 09:17:02 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0), 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 677.925551] binder: 7996:7999 ioctl c0306201 20000140 returned -22 [ 677.937015] binder: 8001:8007 Acquire 1 refcount change on invalid ref 10 ret -22 09:17:02 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x200000000000000}, 0x0) [ 677.978171] binder: 8001:8007 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 677.986073] binder: 7996:8012 unknown command 67108864 [ 677.995381] binder: 8001:8007 unknown command 0 [ 678.001314] binder: 7996:8012 ioctl c0306201 20000140 returned -22 [ 678.008103] binder: 8008:8013 ioctl c0306201 20000140 returned -14 09:17:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) prctl$PR_GET_SECUREBITS(0x1b) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="010000000000000000b6fc12ba000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:02 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0), 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:02 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x4, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 678.023081] binder: 8001:8007 ioctl c0306201 20000140 returned -22 [ 678.047028] binder: BINDER_SET_CONTEXT_MGR already set [ 678.059411] binder: 8008:8017 ioctl 40046207 0 returned -16 09:17:02 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x3}, @clear_death], 0x0, 0x0, 0x0}) 09:17:02 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x1000000000000000}, 0x0) 09:17:02 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x300000000000000, 0x0, 0x0}) [ 678.178091] binder: 8025:8031 unknown command 0 09:17:02 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x200, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 678.202098] binder: 8025:8031 ioctl c0306201 20000140 returned -22 [ 678.230838] binder: 8030:8035 Acquire 1 refcount change on invalid ref 3 ret -22 [ 678.239914] binder: 8025:8036 unknown command 0 09:17:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0), 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:03 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x800000000000000}, 0x0) [ 678.257593] binder: 8030:8035 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 678.266865] binder: 8025:8036 ioctl c0306201 20000140 returned -22 [ 678.282233] binder: 8030:8035 unknown command 0 [ 678.288444] binder: 8030:8035 ioctl c0306201 20000140 returned -22 [ 678.291781] binder: 8037:8042 ioctl c0306201 20000140 returned -14 09:17:03 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xb630000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:03 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xa63084000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:03 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x400000, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000000c0)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000240)=r1) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) sendmsg$can_bcm(r2, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0xfffffffffffffee7, &(0x7f0000008d00)={&(0x7f0000000140)={0x1, 0x0, 0x0, {r4, r5/1000+10000}, {}, {}, 0x1, @canfd={{0x1, 0x7ff, 0x0, 0x9}, 0x1e, 0x2, 0x0, 0x0, "ff081c53caf7cbe5a729a24cfdd4fafcfa5f7a2d735053ebe96ce08e6018d65a31cd96e7eacb0ae62a2cf0c1193b0aed56a45c72a531596fdb4e8f0775a061fb"}}, 0x17}}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000008010000000000000000000000b45a34a59932ac27b7e0f20d87b379e990c435c289537f8e2ea05ca989ffc603a39ca99bd30838bcf417150fc800000000000000"], 0x48}}, 0x0) [ 678.365472] binder: BINDER_SET_CONTEXT_MGR already set [ 678.403878] binder: 8051:8052 Acquire 1 refcount change on invalid ref 191037440 ret -22 [ 678.427490] binder: 8037:8049 ioctl 40046207 0 returned -16 [ 678.445415] binder: 8051:8052 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:03 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6800000000000000, 0x0, 0x0}) [ 678.470582] binder: 8051:8052 unknown command 0 [ 678.485955] binder: 8051:8052 ioctl c0306201 20000140 returned -22 09:17:03 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x1000000000000000}, 0x0) 09:17:03 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x48, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:03 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pptp={0x18, 0x2, {0x1, @multicast1}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000100)=ANY=[@ANYBLOB="010000000000000000000000000000008f9211c0a7ce052cb50b0147e630e2dddca04d921432a4ee355fbe5688c32cad09d1507b27164f465d34e8e7bf80", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x400, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r2, 0xc05c5340, &(0x7f0000000180)={0x7fffffff, 0x8, 0x8fda, {0x77359400}, 0x1000, 0x5}) 09:17:03 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x630d}, @clear_death], 0x0, 0x0, 0x0}) 09:17:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, 0x0, 0x0) [ 678.643350] binder: 8070:8076 ioctl c0306201 20000140 returned -14 09:17:03 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x1000000}, 0x0) 09:17:03 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x200000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 678.696460] binder: BINDER_SET_CONTEXT_MGR already set [ 678.710509] binder: 8070:8086 ioctl 40046207 0 returned -16 [ 678.719410] binder: 8081:8087 Acquire 1 refcount change on invalid ref 25357 ret -22 09:17:03 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@loopback, @in=@local}}, {{@in6=@mcast2}, 0x0, @in6}}, &(0x7f0000000400)=0xe8) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000440)={0x0, @broadcast}, &(0x7f00000005c0)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000600)={{{@in=@multicast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000700)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000740)={'vcan0\x00', r1}) tee(r0, r0, 0x4, 0x4) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x20000, 0x0) write$P9_ROPEN(r3, &(0x7f0000000280)={0x18, 0x71, 0x2, {{0x60, 0x1, 0x1}, 0x2}}, 0x18) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r4 = dup3(r0, r0, 0x80000) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000100)={0x0, 0xdaca, 0x4, [0x1, 0x8, 0x5, 0x1]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000180)={r5, 0x80, 0x30}, &(0x7f00000001c0)=0xc) r6 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) ioctl$DRM_IOCTL_INFO_BUFS(r4, 0xc0106418, &(0x7f0000000800)={0x7, 0x0, 0x7ff, 0x3b, 0x8, 0x7}) r7 = add_key(&(0x7f0000000380)='.request_key_auth\x00', &(0x7f00000003c0)={'syz', 0x1}, &(0x7f0000000780)="b5f8baa044ab3e306595f305a84da9b76f605dc7f3f73721fdc05b1c4c230259fc5b24bf9316478da24b5c5b5f122946e4d848217baa529c73dd25878334ebf0d767eeabd2f2edc0a699c215bc6f10ffbac0b156db53ae692c1bde74636bdc5934d1f91ede0bd40f4f00d43d1abc60fe95681c22381303f29e5cf6bd8ccc", 0x7e, 0x0) keyctl$reject(0x13, r6, 0xf2e, 0x3, r7) getitimer(0x0, &(0x7f00000002c0)) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x3}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r4, 0x84, 0x78, &(0x7f0000000200)=r5, 0x4) [ 678.743044] binder: 8070:8076 ioctl c0306201 20000140 returned -14 [ 678.752559] binder: 8081:8087 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:03 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x400000000000000, 0x0, 0x0}) 09:17:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) [ 678.801153] binder: 8081:8087 unknown command 0 [ 678.820328] binder: 8081:8087 ioctl c0306201 20000140 returned -22 09:17:03 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x10}, 0x0) 09:17:03 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x163404000000000}, @clear_death], 0x0, 0x0, 0x0}) [ 678.935297] binder_thread_write: 10 callbacks suppressed [ 678.935307] binder: 8103:8106 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:03 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x10630840, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) 09:17:03 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x800000000000000}, 0x0) [ 678.979055] binder: 8103:8106 ioctl c0306201 20000140 returned -14 09:17:03 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) pipe(&(0x7f0000000100)={0xffffffffffffffff}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x101040, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000180)={0x4, r2, 0x1}) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000016af090051089dd810d422b3525a804300000000105a34e4ff46fbc251"], 0x48}}, 0x0) [ 679.057097] binder: 8111:8115 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 679.061105] binder: BINDER_SET_CONTEXT_MGR already set [ 679.100202] binder: 8111:8115 unknown command 0 [ 679.105216] binder: 8111:8115 ioctl c0306201 20000140 returned -22 [ 679.115452] binder: 8103:8120 ioctl 40046207 0 returned -16 09:17:03 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x9}, 0x1c) 09:17:03 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x700000000000000, 0x0, 0x0}) 09:17:03 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000100)={0x0, 0x80000, 0xffffffffffffff9c}) ioctl$DRM_IOCTL_ADD_BUFS(r2, 0xc0206416, &(0x7f0000000140)={0x9, 0x40, 0x200, 0x8, 0x19}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:03 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xb630000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:03 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x74}, @clear_death], 0x0, 0x0, 0x0}) 09:17:03 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x2000000}, 0x0) 09:17:04 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) 09:17:04 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x3f00, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 679.285002] binder: 8137:8138 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 679.322480] binder: 8137:8138 ioctl c0306201 20000140 returned -14 09:17:04 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x8}, 0x0) [ 679.366112] binder: 8144:8148 Acquire 1 refcount change on invalid ref 116 ret -22 [ 679.384828] binder: 8144:8148 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 679.390541] binder: BINDER_SET_CONTEXT_MGR already set [ 679.404057] binder: 8137:8152 ioctl 40046207 0 returned -16 09:17:04 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x5, 0x101800) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000000180)={0x0, 0x0, {0x2, 0x3, 0x0, 0x3, 0x200}}) [ 679.423934] binder: 8144:8148 unknown command 0 [ 679.429604] binder: 8137:8138 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 679.456889] binder: 8144:8148 ioctl c0306201 20000140 returned -22 09:17:04 executing program 3: [ 679.472203] binder: 8137:8138 ioctl c0306201 20000140 returned -14 09:17:04 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x3000000, 0x0, 0x0}) 09:17:04 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x100000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:04 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x763044000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:04 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x100000000000000}, 0x0) 09:17:04 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) getpeername$netlink(r2, &(0x7f0000000100), &(0x7f0000000140)=0xc) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000240)) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000180)=ANY=[@ANYBLOB="0169128f0c1ce0a56dc7f0000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) r3 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r3, 0xc0845658, &(0x7f0000000300)={0x0, @reserved}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:04 executing program 3: [ 679.654905] binder: 8174:8179 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:04 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x263044000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:04 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0xffffff7f}, 0x0) 09:17:04 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x482, 0x0) write$UHID_SET_REPORT_REPLY(r2, &(0x7f0000000140)={0xe, 0x4, 0x100, 0x46, 0xbf, "356d44dd918c605816142b7aa92aac0ba56fb24ee3e866df43a958c4143f09587e15ebecde6eedca6c02932ec1b1db183fb9d62d8f6e55c4354ba62c030e8325e2be75bad588e27b26d4aca67c3ca19ed64d468f2090c4bc2a26b213c1f7f918251d743c5a54b4f6f6858f21651d846f5d9112f27e0d6593a4023850085cb8fdfdcb55208b5b00571a850e2a724003992ea86e5238855191a061b4267918db92eadcf3718c38b6249dd99514a684fdc7a6daf428aca36a8ff6de3913df939b"}, 0xcb) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000240), &(0x7f0000000300)=0x68) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 679.719669] binder: 8182:8188 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 679.722492] binder: 8174:8179 ioctl c0306201 20000140 returned -14 [ 679.740481] binder: 8182:8188 unknown command 0 [ 679.745209] binder: 8182:8188 ioctl c0306201 20000140 returned -22 [ 679.799431] binder: BINDER_SET_CONTEXT_MGR already set [ 679.818726] binder: 8174:8191 ioctl 40046207 0 returned -16 09:17:04 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x3630840}, @clear_death], 0x0, 0x0, 0x0}) 09:17:04 executing program 3: [ 679.842780] binder: 8174:8179 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 679.866686] binder: 8174:8179 ioctl c0306201 20000140 returned -14 09:17:04 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x10000000}, 0x0) 09:17:04 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6000000000000000, 0x0, 0x0}) 09:17:04 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x63404000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:04 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) socket$rds(0x15, 0x5, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000300)=ANY=[@ANYBLOB="0100020000d9eb95c4cd156f938aa37d66cc4e926ff4abc7616d8a9f31df3ae1462766ee6a9b37df7c61e47876c675ebc3e2b22b36ccf8e7741251b821be524f4e198dfacb33873a470f01da875b0a9281d2eade58a79ccb3ebbd86354415a2651fad2abe2bf9a95fbc827", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) r3 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x101, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000400)='/dev/vcs#\x00', 0x0}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r2, r3, 0x0, 0x1, &(0x7f00000003c0)='\x00', r4}, 0x30) r5 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x0, 0xc0000) getsockname$packet(r5, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r5, 0x84, 0x4, &(0x7f00000001c0), &(0x7f0000000200)=0x4) getpeername$packet(r5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$BLKREPORTZONE(r5, 0xc0101282, &(0x7f00000004c0)={0xb2d, 0x4, 0x0, [{0xffffffffffff8001, 0x2, 0x0, 0xe5ec530, 0x7fffffff, 0xd7, 0x401}, {0x7, 0x19f, 0x4000000000000000, 0x5, 0x3, 0x3, 0x1f}, {0x5af4, 0x20, 0x336, 0x0, 0x1, 0x110, 0x1}, {0x7, 0xffff, 0x1, 0x100000000, 0x1d0, 0x6, 0xffffffff}]}) 09:17:04 executing program 3: 09:17:04 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0xff00}, 0x0) [ 680.016662] binder: 8211:8212 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 680.043842] binder: 8211:8212 unknown command 0 [ 680.059774] binder: 8211:8212 ioctl c0306201 20000140 returned -22 [ 680.089709] binder: 8221:8223 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 680.101674] binder: 8211:8212 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:04 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x7a00000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:04 executing program 3: [ 680.133461] binder: 8221:8223 ioctl c0306201 20000140 returned -14 [ 680.133628] binder: 8211:8212 unknown command 0 [ 680.153334] binder: BINDER_SET_CONTEXT_MGR already set [ 680.166023] binder: 8221:8231 ioctl 40046207 0 returned -16 [ 680.175594] binder: 8211:8212 ioctl c0306201 20000140 returned -22 09:17:04 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000100)=ANY=[@ANYBLOB="01004d8cc05f9ac0e58ed00034d7f04f000000000000000063c5769aef64", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:04 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x2}, 0x0) [ 680.198171] binder: 8221:8223 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:05 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x6}, @clear_death], 0x0, 0x0, 0x0}) [ 680.251867] binder: 8221:8223 ioctl c0306201 20000140 returned -14 09:17:05 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x7400, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:05 executing program 3: syz_genetlink_get_family_id$ipvs(0x0) clone(0xc02102000fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) setxattr(0x0, 0x0, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000040)) seccomp(0x1, 0x0, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{0x74, 0x0, 0x0, 0xdae6}]}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=@newtclass={0x2c, 0x28, 0xc00, 0x70bd2c, 0x25dfdbfb, {0x0, r1, {0x0, 0xfff3}, {0xffed}}, [@TCA_RATE={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20004804}, 0x20044000) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) keyctl$set_timeout(0xf, 0x0, 0x7) 09:17:05 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0xfdfdffff, 0x0, 0x0}) [ 680.347532] binder: 8249:8253 unknown command 0 09:17:05 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0xffffff7f00000000}, 0x0) [ 680.369619] binder: 8249:8253 ioctl c0306201 20000140 returned -22 09:17:05 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140)={0x0, 0xffffffff}, &(0x7f0000000180)=0x8) ioctl$VHOST_SET_LOG_BASE(r2, 0x4008af04, &(0x7f0000000300)=&(0x7f0000000280)) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={r3, @in6={{0xa, 0x4e23, 0x0, @mcast1, 0xffffffffffff8001}}, 0x40, 0x100, 0x7, 0x2, 0x1}, 0x98) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB='!\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00', @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34b0b132ac27b7"], 0x48}}, 0x0) 09:17:05 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x1063084000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 680.443400] binder: 8259:8261 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 680.488686] binder: 8259:8261 ioctl c0306201 20000140 returned -14 [ 680.511376] binder: BINDER_SET_CONTEXT_MGR already set 09:17:05 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x8000000}, 0x0) 09:17:05 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xa000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:05 executing program 3 (fault-call:6 fault-nth:0): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:05 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) getresuid(&(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)=0x0) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='overlay\x00', 0x20013, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@index_off='index=off'}, {@nfs_export_on='nfs_export=on'}, {@metacopy_off='metacopy=off'}, {@xino_on='xino=on'}, {@workdir={'workdir', 0x3d, './file0'}}, {@nfs_export_off='nfs_export=off'}], [{@permit_directio='permit_directio'}, {@fowner_gt={'fowner>', r2}}, {@euid_gt={'euid>', r3}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}]}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) rmdir(&(0x7f0000000280)='./file0\x00') [ 680.540215] binder: 8259:8276 ioctl 40046207 0 returned -16 [ 680.558332] binder: 8259:8261 ioctl c0306201 20000140 returned -14 09:17:05 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x48000000, 0x0, 0x0}) 09:17:05 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6c00, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 680.696831] binder: 8290:8295 unknown command 0 [ 680.714954] FAULT_INJECTION: forcing a failure. [ 680.714954] name failslab, interval 1, probability 0, space 0, times 0 [ 680.726263] binder: 8290:8295 ioctl c0306201 20000140 returned -22 [ 680.726576] CPU: 1 PID: 8294 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #160 [ 680.740116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 680.749050] binder: 8296:8301 ioctl c0306201 20000140 returned -14 [ 680.749483] Call Trace: [ 680.758387] dump_stack+0x244/0x39d [ 680.762039] ? dump_stack_print_info.cold.1+0x20/0x20 [ 680.767260] should_fail.cold.4+0xa/0x17 [ 680.771334] ? mark_held_locks+0x130/0x130 [ 680.775587] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 680.778759] binder: BINDER_SET_CONTEXT_MGR already set [ 680.780696] ? print_usage_bug+0xc0/0xc0 [ 680.780719] ? __lock_acquire+0x62f/0x4c20 09:17:05 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0xff000000}, 0x0) [ 680.780742] ? __lock_acquire+0x62f/0x4c20 [ 680.780760] ? print_usage_bug+0xc0/0xc0 [ 680.780792] ? print_usage_bug+0xc0/0xc0 [ 680.806669] ? zap_class+0x640/0x640 [ 680.809232] binder: 8296:8304 ioctl 40046207 0 returned -16 [ 680.810454] ? reuseport_alloc+0x92/0x4e0 [ 680.810481] __should_failslab+0x124/0x180 [ 680.824559] should_failslab+0x9/0x14 [ 680.828486] kmem_cache_alloc_trace+0x4b/0x750 [ 680.833082] ? __local_bh_enable_ip+0x160/0x260 [ 680.837772] reuseport_alloc+0x252/0x4e0 [ 680.841840] ? __sanitizer_cov_trace_cmp4+0x16/0x20 09:17:05 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x48, 0x0, 0x0}) [ 680.846870] ? reuseport_select_sock+0xda0/0xda0 [ 680.851639] ? sock_i_uid+0x8d/0xb0 [ 680.851657] ? __local_bh_enable_ip+0x160/0x260 [ 680.851677] ? _raw_read_unlock_bh+0x30/0x40 [ 680.864403] udp_lib_get_port+0x1297/0x1b80 [ 680.868749] ? debug_object_active_state+0x100/0x4d0 [ 680.873883] ? udp_seq_next+0x80/0x80 [ 680.877713] ? zap_class+0x640/0x640 [ 680.881442] ? print_usage_bug+0xc0/0xc0 [ 680.885514] ? __fget+0x4d1/0x740 [ 680.888995] ? zap_class+0x640/0x640 [ 680.892724] ? zap_class+0x640/0x640 [ 680.896458] ? find_held_lock+0x36/0x1c0 [ 680.900546] ? find_held_lock+0x36/0x1c0 [ 680.904709] ? __inet6_bind+0xb4c/0x1680 [ 680.908789] ? lock_downgrade+0x900/0x900 [ 680.912960] ? check_preemption_disabled+0x48/0x280 [ 680.917997] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 680.922948] ? kasan_check_read+0x11/0x20 [ 680.924677] binder: 8307:8309 ioctl c0306201 20000140 returned -14 [ 680.927104] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 680.927119] ? lock_sock_nested+0x9a/0x120 [ 680.927138] ? rcu_softirq_qs+0x20/0x20 09:17:05 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x200000000000000}, 0x0) [ 680.946977] udp_v6_get_port+0x273/0x660 [ 680.947647] binder: BINDER_SET_CONTEXT_MGR already set [ 680.951063] __inet6_bind+0x5c2/0x1680 [ 680.951094] inet6_bind+0xf8/0x153 [ 680.951114] __sys_bind+0x331/0x440 [ 680.957432] binder: 8307:8311 ioctl 40046207 0 returned -16 [ 680.960724] ? __ia32_sys_socketpair+0xf0/0xf0 [ 680.960751] ? __sb_end_write+0xd9/0x110 [ 680.960776] ? do_syscall_64+0x9a/0x820 [ 680.960795] ? do_syscall_64+0x9a/0x820 [ 680.973647] ? lockdep_hardirqs_on+0x3bb/0x5b0 09:17:05 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x4800000000000000, 0x0, 0x0}) [ 680.973666] ? trace_hardirqs_on+0xbd/0x310 [ 680.973686] ? __ia32_sys_read+0xb0/0xb0 [ 680.985915] binder: 8307:8309 ioctl c0306201 20000140 returned -14 [ 680.986278] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 680.994818] ? trace_hardirqs_off_caller+0x310/0x310 [ 681.019946] __x64_sys_bind+0x73/0xb0 [ 681.023768] do_syscall_64+0x1b9/0x820 [ 681.027666] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 681.033050] ? syscall_return_slowpath+0x5e0/0x5e0 [ 681.037987] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 681.038008] ? trace_hardirqs_on_caller+0x310/0x310 09:17:05 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0xff00000000000000}, 0x0) [ 681.047860] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 681.052893] ? prepare_exit_to_usermode+0x291/0x3b0 [ 681.057934] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 681.062798] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 681.068002] RIP: 0033:0x457669 [ 681.071205] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 681.090108] RSP: 002b:00007f84a8ed1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 09:17:05 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x3f000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:05 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) select(0x40, &(0x7f0000000100)={0xfffffffffffffffe, 0x646, 0x0, 0xec, 0x1, 0x6, 0x1f, 0x4}, &(0x7f0000000140)={0x80, 0xfffffffffffffffb, 0x5, 0x7fff, 0x1, 0xffff, 0x4, 0x8}, &(0x7f0000000180)={0xa5, 0x7, 0x8001, 0x4, 0x120000000000000, 0x3f, 0x5, 0x4}, &(0x7f0000000200)={r1, r2/1000+10000}) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:05 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xa00000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 681.090123] RAX: ffffffffffffffda RBX: 00007f84a8ed1c90 RCX: 0000000000457669 [ 681.090131] RDX: 000000000000001c RSI: 0000000020000080 RDI: 0000000000000003 [ 681.090141] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 681.090154] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f84a8ed26d4 [ 681.121296] binder: 8316:8318 ioctl c0306201 20000140 returned -14 [ 681.126915] R13: 00000000004bd8bd R14: 00000000004cd0f0 R15: 0000000000000005 [ 681.230340] binder: 8320:8331 unknown command 0 [ 681.235175] binder: 8320:8331 ioctl c0306201 20000140 returned -22 [ 681.250541] binder: BINDER_SET_CONTEXT_MGR already set 09:17:06 executing program 3 (fault-call:6 fault-nth:1): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0xff00}, 0x0) 09:17:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x4c, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:06 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xd630000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:06 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = syz_open_dev$usbmon(&(0x7f0000000280)='/dev/usbmon#\x00', 0x380, 0x84c00) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f00000004c0)=""/68) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000240)={&(0x7f0000000100), 0x10, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="00000000440400000000000000000000", @ANYRES64=r3, @ANYRES64=r4/1000+10000, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="040000600100000002000040040100000a463a19b1d463c11a6e4e45a8adab4f4d783e1289bf1b405d79f7c2b5913217a05d2b575a9b3db15977ffc0afb75b5d4952004bc70560427dd44cee6692e03fc628a877"], 0x80}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f00000001c0)={0x1d, r1}, 0x1be, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100a7b64a299968000d000000000000000000006f39dcc05d5762e90b8589fc607e6928fd8cb11a9ad52df67181f8e09334e34e14b92a34a65d0a0a4e88daef4efb517bb56f8f6b91d0e058ce5f0710a8232f69877b514f35c733e8d27125fc5e6e4d5ecf5d8e38151f82ebd1bb8047384ba78e9086ee45da04f5e91afe9ee30c32687b1a4f75e9af58735ba7f3c838a764104e538649e47bbca39641a94fbf0271d95aa28ded2537b582d28745bee996ec1cdd1e8e815b8b04578ea276c2c26b173b864efc81b12a95d8583dedfd71875c03c01176908285eb3928fbab08e24a1dd6fb31f3197c4bad34d7dca3ef2f28c35f97e7fefe1d15a69f390e6b90d788d64bd9a7edcfb7a5228a3d8b"], 0x6}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 681.295624] binder: 8316:8332 ioctl 40046207 0 returned -16 [ 681.330075] binder: 8316:8318 ioctl c0306201 20000140 returned -14 [ 681.387775] binder: 8341:8344 unknown command 0 09:17:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0xff00000000000000}, 0x0) 09:17:06 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x4c, 0x0, 0x0}) 09:17:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x700000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 681.409479] binder: 8341:8344 ioctl c0306201 20000140 returned -22 09:17:06 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:06 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000100)="7c38617ee41fa6d4b9d07c6ed8cd3e4a8e0ce104918de4fe87cda000d6d7e4881826e15c24abb6bbb0c2233a50371c45caab31efe2b4e58bddffe4db8cb3b7e3a3d087fd22f751722cc1b0ae7d43a3694bed324e9a6d32d2ca8925cf10b9346986481dde5c945942e677cd834c52463602fc17569cb636a56d978689139ae1262ed254e3cc5ff66cfda97f49aaa36047f18b3721e5926c3754a1dde927b730adf9fdc1822fb2af2ab9c1f79615d78c6744d899822455391fe24cf9a46c2fbabea06affc6c47735747b5b884ea0d35576", 0xd0}, {&(0x7f0000000200)="850fe3f03f889a473366ae1c6d5ee627401e97", 0x13}, {&(0x7f0000000300)="d0c98ad1f39c22cfab994e367e34fceafb40a6cd5561b6b2dd81529a5c1459f0c26255805b80acfab1debf89ee6e2eafa91e77c05483addaf99eb1e5e95c43069875c42f3f5e60da675ba8900c7e28e1ac219188af067ad403c15072ce85a00b253830831a433dd1e8ab8bf20c1150110fcde217f85ef3de349c8bc1f515259a03318adf5e0cbab36a", 0x89}], 0x3) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="01fcffffffffffffff0000000000000034cdd86f3d7b1d93b24572a987fd034d60d63e57644dfaa01f420b16ba9bce4087b8d21027458f928edb5aaf13346d0a74510452b46c00795ff4636275cbb3fe70026ef6bfefe8d395f219558869fee3d91ed4ad8ac6192529a9a050a6fee23cb5057a7d1496a70a776968d469ba7da6f6504ab21b855e", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:06 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xa00}, @clear_death], 0x0, 0x0, 0x0}) 09:17:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x0) [ 681.529436] binder: 8355:8358 ioctl c0306201 20000140 returned -14 09:17:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xe630c4000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 681.600253] binder: BINDER_SET_CONTEXT_MGR already set 09:17:06 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x4, 0x400180) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000000180)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000003, 0x0, 0x0, 0xffffffff}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 681.626248] binder_thread_write: 6 callbacks suppressed [ 681.626263] binder: 8370:8373 Acquire 1 refcount change on invalid ref 2560 ret -22 [ 681.629236] binder: 8355:8369 ioctl 40046207 0 returned -16 [ 681.647780] binder: 8370:8373 unknown command 0 [ 681.658315] binder: 8370:8373 ioctl c0306201 20000140 returned -22 09:17:06 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x1200}, @clear_death], 0x0, 0x0, 0x0}) 09:17:06 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x500000000000000, 0x0, 0x0}) 09:17:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x800000000000000}, 0x0) 09:17:06 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000100000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) mount$9p_xen(&(0x7f0000000100)='self[\xb1vboxnet1vmnet1\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x100000, &(0x7f00000001c0)={'trans=xen,', {[{@fscache='fscache'}, {@version_9p2000='version=9p2000'}], [{@smackfsroot={'smackfsroot', 0x3d, 'vcan0\x00'}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'vcan0\x00'}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@subj_type={'subj_type', 0x3d, 'vcan0\x00'}}, {@dont_appraise='dont_appraise'}]}}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x400000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 681.757215] binder: 8388:8391 Acquire 1 refcount change on invalid ref 4608 ret -22 [ 681.795866] binder: 8393:8395 ioctl c0306201 20000140 returned -14 [ 681.800493] binder: 8388:8391 unknown command 0 09:17:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) [ 681.834025] binder: BINDER_SET_CONTEXT_MGR already set [ 681.839385] binder: 8393:8397 ioctl 40046207 0 returned -16 [ 681.860494] binder: 8388:8391 ioctl c0306201 20000140 returned -22 09:17:06 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x0, @empty, 0x3f}}}, &(0x7f0000000000)=0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000001c0)={r1, @in6={{0xa, 0x4e21, 0x3, @mcast2, 0x6}}, 0x5, 0x8000, 0x8, 0x5, 0x9}, &(0x7f0000000280)=0x98) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000380)='/proc/self/net/pfkey\x00', 0x4000, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffff9c, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f00000003c0)="b9800000c00f3235000400000f303e6766430f5fa3bcda3055b9800000c00f3235004000000f30420f01cf400f9e30410f3566baf80cb8a4ffe284ef66bafc0cedc4e2f996acc003cdc21a8fe9f89583b5000000f046800c2b00", 0x5a}], 0x1, 0x40, &(0x7f0000000480), 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r4 = syz_open_dev$sndpcmc(&(0x7f00000002c0)='/dev/snd/pcmC#D#c\x00', 0x3480800000000000, 0x2) ioctl$VIDIOC_S_EDID(r4, 0xc0285629, &(0x7f0000000340)={0x0, 0x7e4, 0x0, [], &(0x7f0000000300)=0x20}) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x100}, 0x14a) 09:17:06 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x7000000, 0x0, 0x0}) 09:17:06 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x1163484000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:06 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getuid() arch_prctl$ARCH_SET_GS(0x1001, 0xb2) setreuid(r2, r3) 09:17:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x2630440, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) [ 682.052415] binder: 8416:8420 ioctl c0306201 20000140 returned -14 [ 682.064688] binder: 8419:8423 unknown command 0 [ 682.088811] binder: 8419:8423 ioctl c0306201 20000140 returned -22 09:17:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xa000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 682.117456] binder: BINDER_SET_CONTEXT_MGR already set 09:17:06 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x6480, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f00000000c0)={0x0, 0x8000, 0x4, [0x1, 0x0, 0x80000001, 0xfffffffffffffff7]}, &(0x7f0000000400)=0x10) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000000440)={0x0, 0x5, 0x5, [0xcb888cb, 0x93e3, 0x81, 0x3, 0x59746d18]}, &(0x7f0000000600)=0x12) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000640)={r3, 0x3, 0xffffffffffff0001, 0x1f, 0x76ef, 0x100000001, 0x9, 0x2, {r4, @in6={{0xa, 0x4e22, 0x5, @mcast2, 0x3}}, 0x0, 0x200, 0x0, 0x74, 0xffffffffffff8000}}, &(0x7f0000000700)=0xb0) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000010000c0300100002ba23f840768435a457f87b1a7d3930aa0be6a4f310d90c5f817d2db23f4f5ace0ef36e2cc0e59749ede9c3f78dc8f33b83fc39f23d0b8438fcde8caec1591c11a2a455413346999d3aa6dce3304f7cf6845fcdd907a09c2d56faa00691e813ebcd9d0a21e7454a5f50bd91eb8f907a006e5c62b60cc27eba37241263f09a5d50d4d07140f34aac863d1c22a3473f7bbe43935804abacf4d3a575236eb0c3af48f077eaa4069d6669fd68ebc314f4acbe8870ceb1e56accc4d96519f95f632fdeb9021eaaa70940b"], 0x80}}, 0x0) r5 = socket$inet6(0xa, 0x6, 0x80000000) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r5, 0x84, 0x65, &(0x7f00000001c0)=[@in6={0xa, 0x4e22, 0x0, @empty, 0x400}, @in6={0xa, 0x4e21, 0x2, @mcast1, 0x82}, @in6={0xa, 0x4e21, 0x4, @mcast1}, @in6={0xa, 0x4e23, 0x4, @remote}, @in={0x2, 0x4e21, @empty}], 0x80) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000300)=ANY=[@ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="23577ea77a43de18163b798172a8ed1b5a8e37948d5687b6eed69f5c8b654b9dfb6fd923a3b7af8e"], @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7b17a060000000000000093dc60073692c70e73bac9fec21da8d38606280a6e4e64018e3b02f43520726f0702597848afdea3566862a6e2a30b8408a3b72ad18243a01d22e67054f1f07e19c68f743e053efa34031ee69e711f1875e9f93569ff3347c024c28c3c3d57f403618f32e647687a7cf3c1c341a589e4065f0641b232f25a3c675e1379173d8fdee0dba0dc8d6695e4a25e3a258c4f173c2a7cf5ff3f42fda149cc053f656ac4bb618929da5f94604794b91d9447"], 0x6}}, 0x0) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x2, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r6, 0x119, 0x1, &(0x7f0000000280), 0x4) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r6, 0x84, 0x1c, &(0x7f0000000140), &(0x7f0000000180)=0x4) 09:17:06 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)=""/105, 0x69}], 0x1}, 0x100) setsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000240)=0x31, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 682.145285] binder: 8419:8432 unknown command 0 [ 682.152308] binder: 8416:8430 ioctl 40046207 0 returned -16 [ 682.160755] binder: 8419:8432 ioctl c0306201 20000140 returned -22 09:17:06 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x8000000}, 0x0) 09:17:06 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6000, 0x0, 0x0}) 09:17:06 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x300, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:07 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xf630c40}, @clear_death], 0x0, 0x0, 0x0}) 09:17:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x401, 0x2) ioctl$VIDIOC_S_FBUF(r2, 0x4030560b, &(0x7f0000000200)={0x60, 0x20, &(0x7f0000000140)="486c3153122b84c07188af207a7af58b93457f4a3f7ef1156cb224cb7c26835df50def2c370bbd2063de6bd60b282b78f24d7a8c9ad4bc0db800cd4b14d6ebcbcbb046f7491d0c0e423c5935ea560c21242e9ac7c1a023427cf143311eadb7a5f7293c3012fba6141cc3eeed44082c96c817c90c5ab018899dca36c22c2ecb1ddc26acd46202a0dcb7d07a612348c9f5f7", {0x1f, 0x7ff, 0x3231575b, 0x0, 0x13f, 0xff, 0x7, 0x37b}}) 09:17:07 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x630d, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 682.356512] binder: 8450:8451 ioctl c0306201 20000140 returned -14 [ 682.387079] binder: BINDER_SET_CONTEXT_MGR already set 09:17:07 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x2}, 0x0) 09:17:07 executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000180)) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f0000000140)=0x4, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='team_slave_1\x00', 0x10) exit(0xe8f2) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000100)={'syzkaller1\x00', {0x2, 0x4e21, @multicast1}}) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) alarm(0x8) [ 682.415477] binder: 8450:8459 ioctl 40046207 0 returned -16 [ 682.434457] binder: 8456:8461 Acquire 1 refcount change on invalid ref 258149440 ret -22 [ 682.441368] binder: 8450:8451 ioctl c0306201 20000140 returned -14 09:17:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x400) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e21, 0x8001, @loopback, 0x4c}}, 0x8, 0x0, 0x1, 0x1, 0x6}, &(0x7f0000000300)=0x98) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f00000004c0)={r3, 0x1000, "1669b1f2c1f6bbe265f1fb6d89d1c258b21179a9dd7301ef15d6e989cd747b696cf161779e8b09f44002eefa80a50ff678fd57c31973cd058f800c9b41dbc46fc7898f39426902601b6311935a11463e17b090a53cc10d0dd1eeaacfd9b6673f6295f33f6e928c9a2e1007bd0b3ec75cdf038369d005762b034669e1f05432c4e23c6920e2d817570fd7838dd93faeef099bd431c14f6d2458c2615aaa2f8b0069cdf55a0a6e102aefa15f1513c0908e8eff8b6fc3ab1272c3d585c552016e5e68e53de1e5f63e1d9af017ea0e31b7883b16792d68566e378dc68b6ad8e9393775ee23b43b8c32f93a6085f59abd99c676e21346edf56923e5a6cf5d9a603a610bf80873c06c1c4f8c008e026347a0e1dce2e6d7761febc8d19129072ba934a0c3881da1d556654e6aa270be46da2d7c36b70538626a57ba3b384b0b068ee74b50aee7aed03a98fba05741acbe8358b5b3f8a83cf1e8602b9c4b760c3a6e2d0a2d04f599d1d28a25d6de485ae76254317625c1210b8b6eb34603730a5de8f598d64027cc33c6fddac21e854cbc842ef8ece4618da0da57740dba87c74238f9e06e9913a84af909adfefe485cc4c2286964bcbbe939d556f2e74c948630c6f6b458fbc3636d6d25dcddae119f5aff83eeced680f522a98288b5ef1317aa5cc3f1c5cc2181029f24052bb6ee4e6efcb6070d908b3449f3bbdba20ee4b31a0e6c93425fee910afe8d9756425aaeb00ac41e2be0578c928b05fd9c1f59022b1dc0de572be2d6f5b5601a0b42081be23604f0d1654a3603f65f5f1a906f74696987bd0bc0346959191daa776e4eebd5e0eac0d94979c937db474d4a24c973e1ed3a6f1e64ea6932accac51d98b9ffdefdc6e01ca6aed30cd2c2a0fcc06716cf63cbc023d89d60ad147fafb535fdf3af6ddf6e952e04413f01cc8d5bceb9c62880f4f5817c1ea4f6a33a73d81e4de2d989771091ff3f4f6a5806db9ca9cd21132b018afe57fb297cc6708503ef0aa0c4f822d6b8dc659468e3982922469001f38dc4662a38f763cd3a009160387ced56584bcd8c9afde2d170c37cc88d11997df9fc20d502eb96a25a1dab7d0224f874aa9cfb93ceceb13c1d71516cdc07acaf1e682d0469c23d82d1a99fedb3096834e2a6fbf4d1594b2c63edeee197ade0041b6e7adef41a85c235f099c0a0860a310230fea01e07215fc33d035047cbe84c1041f6b8e2bc3935542ad34dd9272dba82cf1651053b61881e759c57479fe5a9139d8a683947832971202d426d7eadf0fddf02782910ffca04cebbe80140038296b92f1c7ddcd57bd8fc6ce49d7b78498136a7ee2ab80f8c57ced7be4e2b88500694a41486981022f57ddcb9e403b584675d78b0bf7906b4eb7ab68876f96889ba90f917dfa8995b66be5b47a8934c862285b14a8cc5983d25ae0e4ce700bf254f39ba67a04347dbdb1ec27b10ead55ba56261dc90ec256bf94d05f7128854bf6b5ff5f757313c1f61f94e007d7b62ac330d3604855ee5e704595e8f01cbb4c4f7d36bc716525cea506919a4cfe51bdcbb237b0b6a2964787e1193a8a554a0189e96725d8eaf1120ed5a9346aaf57bf2112f6dd6106e4ec53a51c6f3a7db524b7b61264234db3016e93981de5f62811cae036ff0b2704b7a88d13bbdb2e1e81778baeac3ac926a19e8ae462936ed16e36d569278954614b0c2254690ae105d6684f0550cd893ebbc571dec6f784e098517e7b04ac259a4e3e595799d20fbd318502780504d1f261b349b30ec856aa8d5682826271b20e89a27f31929016ebbcd7b17072d6831bb3b7899862d9ac9d9499c5fcab9a6f0ad9fe2b6ba6b4932fd005d3061b9d7b968ecdc7e50f402b24d4ce14117d15ceb9a1fb88a1c95907f6ff07099386efce82c1fe796ba960bee210c10c56006c4f924ccaecd31a6b5696315d9dbf87ef600ccbe95298f95cc9dc84ab49929402c40eb2e913ec76f4d56a59a5b3e33d6994ef01f6eda3f7afc0f0f35f27656f89c7f079404d71a188c3f679d8a28e2640b3832816a2292dc43bc13ea47775b09cbcdf22e56ebfe8df51f392725630f7434cf7b68db967320b8dccbe0359b415a48391c0931f374330f5df81c23a24fea924683160412d8e61cceebd0f753a0a9604cea2be9f083312d88ed3f8e9745a304f19cc09793d8b7a57ab83c03220531e678be120a5058d558221ae0dd40735151b613a21dbf709f6ffeb7645ed5e02032de6e53669306c7ee6a3c07dcdb58f67af64600dd13d2c428dc05927522e3c534942652cef6e3a197cb137045ca2c01490cd5ffea704842918bc508783ab7886b1c6cc60b9a20a11e205c34aaaa908072685f4d28e03f45ebb003d8a89242b8347e35f579cc694045b1d407095e3d6c4af86958fe1d7ce9fea81c22c006334c8d6fb0b093fdca3730e3d5b181bad4e9b8dceedf88e932a98371124b56923a20e38394b6baa1891bfb0a2846415cdd753579500643b3d2d4969179a6209292025adec00ce73fd08ac704e6648be2164c3ccb66d2d92f1aba1f436c5a962110dbe919a15fe6de2486c802e03c2c582fdec5d134152ff6c0d02362a732c78d8b36abf599f838965c919a4216078cde252d4058f9a3ee967f8c31963fa4300203741763916df3f73dd332e3a980a97d4f4cf6efd09feb55237d6b7014b0d01084d3f1f6acb7b6a5dc91748e8c2239d9f38f42d40848445c8f22546b6d3e76c17bed6c0c8717d84476cfc45ba07472e0003fa1609d1d8c3363742f67bde4cd696402656fc418252fc4325361bef5feb8852a4d592e46d9229396d5f92e8a4aaafb0029a40b7f1e50598000280b6e898969d36ed3a30390f91c862b0b401abd985479f43d0d54de5dcc5e13fd2e04cf02f69e3a8d5f2b2e7a1b1347dbef2ddbe6ebe11a2ef9bcbed8bd0fda596a92bea69645aa65827cf55afedc6393e215d76eb37718e2db6609a42acf2e1b7fcad417771e7c2e0c9e0b107c785f86120e5b2d88867a2a83e39372c8ac151fd6ce3c75a60765b4242801cbafe24dea20ada3afae35c4b501daef432a7b9f8651f1f14461d58a0599c97626444b902bf3eaf819fa256db0286edb4b237d8d90734919ceb8f6e3b20c652baa099eacc9ed169656a634d3c8b26c136fd5fa4043d803affa6bad0f3b6eaf896e7155bd186a362fb541f046b91f3ae1fac4b2b7322dd834da2b6d6989f234605d9645300301b400cc429e51a4c91dd0fa3a6237ff134978fa059f725e960b725a46ca073020ee0b034e840deb3ef329f8b14cf71c8c70e7b0cfa4be080e82a6f0824080eda4c125f8c679c93f1c3c1e7e75f9e78bda2472b5e3e9f069e81e1adc78c060a8c29f5d6719d2fc3d3bf3dddb9a447d46eb9df17179c451e0fd5d13ad2ce7f081796def4d50902107130b06255277e52e274d06d28e7407f8cb31d1b0144ede47b8197f7d7a0dcb23fdd160d2b7df8da73380c91d463b7e675316055ad85514cd35a34c1c43cf597520005d687e3b8256499793e6a29c24a3679ec137ec416b54f3a81433cd5da4bbf225546500e6e44a3aa410224583c44f026496701d181e2471a39ab0c8977af1a1ca78d72d5aa1d1777394010be4feefc25550336f69c9f4e4e0b3dcfd6b0e3677bc3b378d9a2cc5251fa7902e9bde3c311816bc8f874626a6d71ae2b1f949ca882dd2007082698c5b2d4b8ecb354d6c43ad363b04a10527a597bdc72fd827febdc67be63a8cbe8eac92a15305545f5c68696df9eee1206c73c683dc5394f34a9cbb36d0bd06415b1438138593fbf5a38408650402b50bc844ffbbb949a656e25fd4d5fb7f426a5d128c30f69bf73cd7c208e2dd4b17669fb58ead51a4c165024be789ce07ed74ea9b7219f224a9847e9d21cc0c4bcc26a303ed47421b6652267e57e1ecb38cc7bd45e5ed760957623e85684c99b09011d83432bd0b48b334ecbdddb0baedaba9916e8a7252a6ab4a8756cc748176d9248fe70ec93a36dfacb15bd6c4262eafaca2f894da1e8a0ca67de5002aad8c4bb297fb54d4e8817455fe761213da6f47b973ffdab246501a823bfee98b6845a1866a405bfa8d2c1cd9168913a7719e3ca118701e92c266a137bd0a3021c2b142bcdf7db796efd8133f9d4f91621f46e6fdaddc5b775381129c02cc42abb8113df4e51c3930d9ff5c3a12e0a287dbfee941e5ecb6b59ea2390f3f0179b04dbce0ea2dfc6ff34ac9983477cb9fe37c22c85d513da7002716f5a1625f5e94b6b5f76eee588abf698245b19789a4471e8430fa4ef00abfd5b6235f1d574f07f53a91d37fd6c5626783d57b5f0fe63b03783e374559fd500446c61a8803c33888100278de35bba7b62200216a87b435f2bdf82f6e277bf46cd75a8214501c0db1689a03a04a0cc7a77b2ec798a33a652a937195ec3b0c771a6c45c357620d8330f28d6c2a17998a7addca0b240577c0b8c3e772fdded55d06722b0c9b6cda4616da673086f823fb8f2d75d8ae794567af5cde07e1fe2448c48bb64f71b6654ef2a68c0da484f73e284dcbdd252f9f421c3a7aca4f1367c8fc0e4cc87dc016de8c7c0411e77da97de477ca38cd057c5febda7a6f97bf9ec3f99e28f49de13999d25e4234d118c18454bc09403e1e952f52bcf65283266b10526478e935a0eea949d48ff83e4dabc3087c0d05bef22d4b8737a4eee60c06bbfd5fbfad3d68f1c3871bdedeedd4064ff5c5acc8666f8d913f7684ed13514eadcc5fa67ebe8c53c180bfe49c325b6ebd10d22a80016b3108c03d2f5749853882d1fedd6c4d01efd316bba549ca1ff917bfcda132813413c871db9c1fdbb58aec3026285162f07af93691e776590ca71093e51edd6771310175c5870a291ad341859bd3f2beaea4f2f4fa0e750236d30dc939e0b4c684c940bd3a5f000c7e363d8f43cf06dc0eba0888bdc0e40bab0df5f519e863529067887cc81e1c82050f6ce486ae8742fe273f102d9659ed4e558d9b0cddc6442e4459dfb95cef112d8f140566580c0d81ca4e408fb0dc6fbc57450fae9f8bc9d827caa8331574e5f5024a66428c4c0738a37b076822d1eb5500518496933778dc4c6ee65079301b94d42e65ea670e28c404434737e573459e10b83012103d0763d37145b1b9328c3c1a4474333247d8507327435111af2e0ee79f06a6793d7c333df34b54f2eaa3c770fd5d86e82936456d9cd873537a55965d400e314792d917266db72fc0559ed40013e8ee68332d847fe2690fc9275436e17abdb4636c96f814ce866590fbb10faded7a0ffd3717d407f9324ba78a17a609b11b594ef40c53ce73cb702fbec2e0081467212584cf2dd77e63e4f9a415a5009f99595f5c018865d69cee34785811971919515c4e7caa7d37ff6cc70074086bb761d1437e3bacc4e689ba5a00efd68554535c771c4be0b6b447ac44fcf28f73e7c1307b595284978e5581d7b9918919f9efad8a3118b2761fcc28854a48dc1828ea6f2aa62dbef356ff3e89689ab0ae631da9fb46def60c1d46d5aaf880370023c18139f139059bfb5fe840f7bc35cae5ffc553b7a56ef7c40e2a32e0bea91765c3094f4e99c3d7ac125c6067cca44429a0b4af061e2cd9a62c9bcbf3b00d9210e6126f699f5f8d3f20996712ad8cb9b3799a20b16e85cb2a8a2baf5a1baa266dba1b417e6c2b9c78d5ce6b823fa2923ad743abb1e5864d0504b3e789ca6af19cf986fe8cf5002e4c44eaee22bee8e7863a6d4c1d0ba57b59d1aa6437ae2b1f6053fa0623d245ea3b715f6cd47eab46fafa31"}, &(0x7f0000000340)=0x1008) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000800000000f2cdc2b646ad814d91393c910b08d537ce96f4"], 0x48}}, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {r4, r5/1000+30000}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:07 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6c, 0x0, 0x0}) [ 682.486012] binder_thread_write: 6 callbacks suppressed [ 682.486025] binder: 8456:8461 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 682.547960] binder: 8456:8461 unknown command 0 09:17:07 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x68, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 682.570680] binder: 8456:8461 ioctl c0306201 20000140 returned -22 09:17:07 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) [ 682.614380] binder: 8456:8484 Acquire 1 refcount change on invalid ref 258149440 ret -22 [ 682.624343] binder: 8476:8483 ioctl c0306201 20000140 returned -14 [ 682.638184] binder: BINDER_SET_CONTEXT_MGR already set [ 682.642294] binder: 8456:8484 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 682.658304] binder: 8456:8484 unknown command 0 09:17:07 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x60000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:07 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x4c000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@nl=@kern={0x10, 0x0, 0x0, 0x8020008}, 0x80) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}, &(0x7f00000001c0)=0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 682.663651] binder: 8456:8484 ioctl c0306201 20000140 returned -22 [ 682.665670] binder: 8476:8486 ioctl 40046207 0 returned -16 [ 682.684137] binder: 8476:8483 ioctl c0306201 20000140 returned -14 09:17:07 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6800, 0x0, 0x0}) 09:17:07 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x8}, 0x0) 09:17:07 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x60, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:07 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x7, 0x800) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000140)=[@in6={0xa, 0x4e21, 0x5, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x5, @local, 0xfffffffffffffffb}], 0x38) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) connect(r0, &(0x7f0000000000)=@ll={0x11, 0x18, r2, 0x1, 0xc71, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x1607b6171ef985d6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="fdffffff000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000000000000000000074e3985b0e124359a615465c19996f50311df8da3f1d8618e9847a885c62544925e4735b6980bdd3086246b411339b92c08ff78432cb177609dd6c"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 682.853238] binder: 8503:8504 ioctl c0306201 20000140 returned -14 [ 682.862827] binder: 8502:8508 Acquire 1 refcount change on invalid ref 1275068416 ret -22 [ 682.872155] binder: BINDER_SET_CONTEXT_MGR already set [ 682.876400] binder: 8502:8508 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 682.896468] binder: 8503:8510 ioctl 40046207 0 returned -16 [ 682.907344] binder: 8503:8504 ioctl c0306201 20000140 returned -14 [ 682.932030] binder: 8502:8508 unknown command 0 [ 682.950245] binder: 8502:8508 ioctl c0306201 20000140 returned -22 09:17:08 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x600, 0x0, 0x0}) 09:17:08 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x1000000000000000}, 0x0) 09:17:08 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8, 0x101000) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000100)=@req3={0x8, 0x80000001, 0x8001, 0x1f, 0x31f9, 0x3, 0x2}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:08 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xf630c4000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:08 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xd63000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:08 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000300)=ANY=[@ANYBLOB="01000040000000000000000000000000b0a1b21fa000b9b992f0db65ecf9ca598b9eb40331c320c0d01253dc3f5a4f4867e049fe2d6fbcc1c06dcad3b5b1cf9e48955214ecf19a29260dc234a5fffb0a6bc1616e33a45cd3cc37500aba9a1fb59026d176b60599c8c55489dc03feead760c017220afc29135ff600532a0c86ee366418056a37e6de8a84c7f24eae993881e08da65d089b25b385da5486330f08376c295c5a3e1ab8d8b4509eff99876928c1ffff4331cc1bbc4270d624728a60ead21f304a7a1cac4b0668b3f83c4339dcb67866855c4b72533652fe16", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x40000, 0x0) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000200)={0x11, 0x93, &(0x7f0000000140)="0bc29f298c9fe38f52efd2c1b7e4ebdd96ee41b10acfaa46491a8ad980a6d5ba076195583c1f606a4497e1a71fc4c16bd5243a3b4bb566b675fc06c4157f0a11a90699d2a32a8ebcc2ec7bd1453605f5065d6d606a56b440791e38f7d0ac7610e4f302de4e8f31ee12877c0a944d550de6b8d12904cbeb7b2c85adaa7d0bdc708641b25dd5fc39f16b8d43f0de3a9b86dad24b"}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="0101000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:08 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) [ 683.498980] binder: 8527:8528 ioctl c0306201 20000140 returned -14 [ 683.508170] binder: 8533:8534 unknown command 0 [ 683.515560] binder: 8533:8534 ioctl c0306201 20000140 returned -22 [ 683.523932] binder: BINDER_SET_CONTEXT_MGR already set [ 683.535287] binder: 8527:8540 ioctl 40046207 0 returned -16 09:17:08 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) accept4(r0, &(0x7f00000001c0)=@can={0x1d, 0x0}, &(0x7f0000000240)=0x80, 0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000280)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:08 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x12634840, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:08 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x363084000000000}, @clear_death], 0x0, 0x0, 0x0}) [ 683.572338] binder: 8527:8528 ioctl c0306201 20000140 returned -14 09:17:08 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x4e20, 0x8, @loopback, 0x671}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) accept4$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000200)=0x1c, 0x80800) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x101083, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000280)={0xe000000000000000, 0x8, 0x9, 'queue1\x00'}) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x0, 0x100) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r3, 0xc08c5334, &(0x7f0000000100)={0x1, 0x9b71, 0x100, 'queue1\x00', 0x1ff}) 09:17:08 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) 09:17:08 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x4, 0x0, 0x0}) 09:17:08 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'\x00', 0x1f}, 0x28, 0x2) [ 683.726919] binder: 8551:8559 Acquire 1 refcount change on invalid ref 0 ret -22 [ 683.756390] binder: 8551:8559 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 683.798755] binder: 8551:8559 unknown command 0 09:17:08 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x9631040, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 683.824288] binder: 8551:8559 ioctl c0306201 20000140 returned -22 [ 683.860858] binder: 8551:8559 Acquire 1 refcount change on invalid ref 0 ret -22 [ 683.867468] binder: 8569:8571 ioctl c0306201 20000140 returned -14 09:17:08 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) 09:17:08 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) finit_module(r1, &(0x7f0000000b40)='&/&..securityselinuxtrusted\x00', 0x1) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) rt_sigaction(0x24, &(0x7f0000000140)={&(0x7f0000000000)="8fa818cef4ebc421fd76a43d3a0000002e0f1609c481edf6c50f1bbdf3ffffff440f381c964f000000c4e11160fc660fd2c0c441565edec443c16bc423", {0x1}, 0x1, &(0x7f0000000100)="420f43f066400f38de349d02000000f30f7e69c73e0fd25b066766400f3824d0f30f1bea46fdc4c17de7096c66f345a5"}, &(0x7f0000000200)={&(0x7f0000000180)="d0e4c4a231dd92025409ae65660f66b7f01fc6f38f6968024cffff410f0fe20cc4e3b96d7200c466460f6916c4e1116c09da3f660fd803", {}, 0x0, &(0x7f00000001c0)="654c0fae01c4c1c77d6697d9ed650f115608c4a2d103a5dded000066450f3a22e909c0b100f8000000650f55a0348c76e52a4abc8f2978c2e4"}, 0x8, &(0x7f0000000240)) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ppp\x00', 0x200000, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000ac0)=@nat={'nat\x00', 0x19, 0x3, 0x558, [0x20000540, 0x0, 0x0, 0x20000740, 0x20000898], 0x0, &(0x7f0000000500), &(0x7f0000000540)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x9, 0x40, 0x892f, 'bridge0\x00', 'sit0\x00', 'ip_vti0\x00', 'bond_slave_0\x00', @broadcast, [0x0, 0x31886ecda3a44bf4, 0x0, 0xff, 0x0, 0xff], @local, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], 0x198, 0x198, 0x1d0, [@comment={'comment\x00', 0x100}]}}, @arpreply={'arpreply\x00', 0x10, {{@local, 0xfffffffffffffffc}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x0, 0x40, 0x8, 'team0\x00', 'dummy0\x00', '\x00', 'ip6gretap0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, [0xff, 0xff, 0xce99e59ecd385ac9, 0x0, 0xff, 0xff], @broadcast, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0xf0, 0xf0, 0x128, [@cgroup0={'cgroup\x00', 0x8, {{0x6}}}, @ipvs={'ipvs\x00', 0x28, {{@ipv4=@broadcast, [0xffffff00, 0xffffff00, 0xffffff00, 0xff000000], 0x4e23, 0x3f, 0x4, 0x4e22, 0xa}}}]}}, @snat={'snat\x00', 0x10, {{@random="7809eaad661b", 0xfffffffffffffffd}}}}]}, {0x0, '\x00', 0x2}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x41, 0x6000, 'bcsh0\x00', 'ipddp0\x00', 'syzkaller1\x00', 'veth1\x00', @empty, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @dev={[], 0xc}, [0xff, 0x0, 0x35f8b3929df02ecd, 0x0, 0xff], 0x118, 0x150, 0x1a0, [@ip={'ip\x00', 0x20, {{@broadcast, @empty, 0xffffff00, 0x0, 0xffffffffffffff7f, 0x2f, 0x6, 0xa, 0x4e23, 0x4e24, 0x4e24, 0x4e20}}}, @arp={'arp\x00', 0x38, {{0x118, 0xa01, 0x1, @multicast2, 0xff, @multicast1, 0xff000000, @random="a9b1f8e260a9", [0x0, 0x0, 0xff, 0xff, 0xff, 0xff], @broadcast, [0x0, 0xff, 0xff, 0xff, 0xff, 0xff], 0x20, 0x1}}}]}, [@arpreply={'arpreply\x00', 0x10, {{@remote, 0xffffffffffffffff}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x5, 'syz0\x00', 0x8}}}}]}]}, 0x5d0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x400, 0x0) accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) sendmsg$can_bcm(r3, &(0x7f0000000480)={&(0x7f0000000340)={0x1d, r4}, 0x10, &(0x7f0000000440)={&(0x7f00000003c0)={0x6, 0x40, 0x8, {0x0, 0x2710}, {r5, r6/1000+10000}, {0x3, 0x4, 0x20, 0x1}, 0x1, @can={{0x1, 0xff, 0x6, 0x1}, 0x6, 0x2, 0x0, 0x0, "a6bbcbe3ae8aec6c"}}, 0x48}, 0x1, 0x0, 0x0, 0x4000091}, 0x1) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 683.894495] binder: 8551:8559 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 683.902440] binder: BINDER_SET_CONTEXT_MGR already set 09:17:08 executing program 2: connect(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r0}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000801000000000000000054b2ee3094485bd4aaac66aa1819f50000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:08 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xb63, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 683.939211] binder: 8551:8559 unknown command 0 [ 683.944511] binder: 8569:8579 ioctl 40046207 0 returned -16 [ 683.965293] binder_thread_write: 21 callbacks suppressed [ 683.965306] binder: 8569:8571 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 683.966369] binder: 8551:8559 ioctl c0306201 20000140 returned -22 [ 683.991876] binder: 8569:8571 ioctl c0306201 20000140 returned -14 09:17:08 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) 09:17:08 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x40086303, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:08 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x4}, @clear_death], 0x0, 0x0, 0x0}) 09:17:08 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x5000000, 0x0, 0x0}) 09:17:08 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) fcntl$notify(r1, 0x402, 0x8) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:08 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000100)) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 684.206545] binder: 8603:8608 Acquire 1 refcount change on invalid ref 4 ret -22 [ 684.238037] binder: 8603:8608 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:08 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0xff000000}, 0x0) [ 684.249260] binder: 8607:8611 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 684.273111] binder: 8603:8608 unknown command 0 [ 684.283761] binder: 8607:8611 ioctl c0306201 20000140 returned -14 09:17:09 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6c00000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 684.301134] binder: 8603:8608 ioctl c0306201 20000140 returned -22 [ 684.314616] binder: BINDER_SET_CONTEXT_MGR already set [ 684.333595] binder: 8607:8619 ioctl 40046207 0 returned -16 09:17:09 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2, 0x800}, 0xfffffe17) 09:17:09 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:09 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x400c630e}, @clear_death], 0x0, 0x0, 0x0}) [ 684.354511] binder: 8607:8611 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 684.401268] binder: 8607:8611 ioctl c0306201 20000140 returned -14 09:17:09 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x163404000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:09 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x80000001, 0x80) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00'}, &(0x7f0000000140)=0x54) 09:17:09 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x4c000000, 0x0, 0x0}) 09:17:09 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x301080, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="01f2090038d3ffff03000000000056af44e4bb10ccf60000000000000000421500500065b0c20a494db1e9c148fc04e102ff009078ac1414aa000000008313ffe0000001ac1414bb00000002e000000186098d92148355648c83030244080300000007ff890b00000000007f00000100000f00907800051f07167748c89d010e407034e8e5dbdf2999903cfd52dda3e9402564dcd74b60fba06438d6f0a3877622b96ef180c727dd9c0277cf63c100c52a54fa2fa9bbe7b69a65334b7e25647317f246de21848469d852327d96e9d68621194823117caf557fe420b0054a0cdabbb095e02812787a2295e1390d2f84a66951e3f585fcf8bd0ce14ad537716a2a54e4af11e7dda6937ed8eafdecaa98149d492daf40ab1e1195b55c46b2fae7fa"], 0x6e) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2400, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 684.530351] binder: 8633:8640 Acquire 1 refcount change on invalid ref 1074553614 ret -22 [ 684.538737] binder: 8633:8640 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 684.570341] binder: 8633:8640 unknown command 0 09:17:09 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 684.575689] binder: 8633:8640 ioctl c0306201 20000140 returned -22 09:17:09 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xd63, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:09 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x32) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:09 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x300000000000000}, @clear_death], 0x0, 0x0, 0x0}) [ 684.636627] binder: 8646:8652 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 684.671357] binder: 8646:8652 ioctl c0306201 20000140 returned -14 09:17:09 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:09 executing program 3: r0 = socket$inet6(0xa, 0x80004, 0x5) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 684.730450] binder: BINDER_SET_CONTEXT_MGR already set [ 684.758787] binder: 8646:8662 ioctl 40046207 0 returned -16 09:17:09 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x40406301, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 684.799035] binder: 8665:8669 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:09 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x500, 0x0, 0x0}) 09:17:09 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000020000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) [ 684.845474] binder: 8665:8669 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 684.864117] binder: 8665:8669 unknown command 0 [ 684.878296] binder: 8665:8669 ioctl c0306201 20000140 returned -22 09:17:09 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:09 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x74000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:09 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xa, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 684.974438] binder: 8684:8688 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 685.002916] binder: 8684:8688 ioctl c0306201 20000140 returned -14 09:17:09 executing program 3: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000100)=0x3) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000011, &(0x7f0000d1c000)=0x3, 0xfffffffffffffdd8) setsockopt$inet6_int(r1, 0x29, 0x18, &(0x7f0000000000)=0xdf8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:09 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x20, 0x90080) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f0000000140)) [ 685.058902] binder: BINDER_SET_CONTEXT_MGR already set 09:17:09 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 685.104503] binder: 8697:8700 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 685.112853] binder: 8684:8699 ioctl 40046207 0 returned -16 [ 685.112874] binder: 8684:8706 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 685.138248] binder: 8702:8703 unknown command 16388 [ 685.172202] binder: 8697:8700 unknown command 0 [ 685.180160] binder: 8702:8703 ioctl c0306201 20000140 returned -22 [ 685.194518] binder: 8697:8700 ioctl c0306201 20000140 returned -22 [ 685.202809] binder: 8684:8706 ioctl c0306201 20000140 returned -14 [ 685.210296] binder: 8702:8715 unknown command 16388 09:17:09 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0xffffffffffffffe3) 09:17:09 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x5, 0x0) readv(r1, &(0x7f00000002c0)=[{&(0x7f0000cd8000)=""/1, 0x168fc9d8}], 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x58080, 0x0) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x0, 0x0) r3 = openat(r2, &(0x7f0000000240)='./file0\x00', 0x0, 0x2) write$P9_RREAD(r3, &(0x7f0000000540)=ANY=[], 0x0) socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r5 = accept4(r4, 0x0, &(0x7f0000000000), 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000100)="c7da5f1a", 0x4) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') sendfile(r5, r6, &(0x7f0000000040)=0x7300, 0x10000000000443) writev(r5, &(0x7f00000006c0)=[{&(0x7f0000000600), 0x60020}], 0x1) read(r5, &(0x7f00000003c0)=""/72, 0x100000104) sendmsg$xdp(r5, &(0x7f0000000300)={&(0x7f0000000140), 0x10, &(0x7f0000000280)=[{&(0x7f0000000180)="9d", 0x1}], 0x1}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000340)='/dev/null\x00', 0x4042, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400204) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r7}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r8 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x6, 0x42001) getsockopt$inet_sctp_SCTP_NODELAY(r8, 0x84, 0x3, &(0x7f0000000140), &(0x7f0000000180)=0x4) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r7}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) ioctl$BINDER_SET_MAX_THREADS(r8, 0x40046205, 0x6f6) [ 685.219737] binder: 8702:8715 ioctl c0306201 20000140 returned -22 09:17:10 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x12000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:10 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:10 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x7a00, 0x0, 0x0}) 09:17:10 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x500000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 685.364068] binder: 8727:8731 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 685.381593] binder: 8729:8730 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:10 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup3(r0, r0, 0x80000) fcntl$setpipe(r1, 0x407, 0x3) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000640)={0x3, 0x40800000000000, 0x401, 0x8}, 0x8) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x101200, 0x0) ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000100)=""/208) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) getsockname$tipc(r3, &(0x7f0000000200)=@name, &(0x7f0000000240)=0x10) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) lremovexattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@random={'osx.', '^wlan0]\x00'}) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000340)="ab4080ac6504e29cf1f08b02ef66e6e420025c60696d85f648b7ce72b68a45675bf9e7d7b5c89ad3cfb6ac0b46ce00bc2d64d4d78e007883c53a17c5d3bfa1ad38993aa1575ded188f1c89b605e471635c35f89cb75f2718140d9f7e026ab46e5940617de76a9b781c8c759a316417b83648abf58a06ae27cdeb0bec66b59fb418a99ab3aec8c3620590a12c8c87acf0e7484d318130eb6e33dd7edfc991fb3aee87a8e19945e3aaa699504b1d2f41e99b337a44aef361e19187abf6575b2c373f43c2cebba4ba952b17c20ef33cfaa6746d92a70e", 0xd5) r4 = fcntl$getown(r0, 0x9) r5 = add_key$user(&(0x7f0000000440)='user\x00', &(0x7f0000000480)={'syz', 0x2}, &(0x7f00000004c0)="f4357d918bb1777f152c33fe668e7484f315556c80114efa96b59b756b711421fc2de11ed5e1e94889ae5ca6af00ae87a5e748a260cedeff90a957c847f2bd94d948178663aa83409c3857e601c302b70f1a0051130f3213abbaa3821087425407b6ff558c7b761a3881575c1a2c913d4fd01842257e97d64004ad9140855a49fb660c66e0ca9287013043d2ec3661fe74a42e1640f82b32a6f0fbc8a7d2c84af62d8c05adc7bad11c1bc19ebd4faebd43a9f906a3bc84a62761f99ea493d5dcef450cc1c9822c3aa77f", 0xca, 0x0) keyctl$read(0xb, r5, &(0x7f00000005c0)=""/94, 0x5e) sched_setscheduler(r4, 0x1, &(0x7f0000000300)=0xfffffffffffffffc) 09:17:10 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:10 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x68000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 685.421434] binder: 8729:8730 unknown command 0 [ 685.427516] binder: 8727:8731 ioctl c0306201 20000140 returned -14 [ 685.444169] binder: 8729:8730 ioctl c0306201 20000140 returned -22 [ 685.451621] binder: BINDER_SET_CONTEXT_MGR already set [ 685.501122] binder: 8727:8731 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:10 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x60}, @clear_death], 0x0, 0x0, 0x0}) [ 685.548761] binder: 8727:8740 ioctl 40046207 0 returned -16 [ 685.559640] binder: 8727:8731 ioctl c0306201 20000140 returned -14 09:17:10 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0xfffffdfd, 0x0, 0x0}) 09:17:10 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0xffffffe9) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20, 0x4}, 0x3d) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f00000001c0)={{0xa, 0x4e23, 0x4, @remote, 0x100000000000}, {0xa, 0x4e24, 0x0, @empty, 0x7ff}, 0x92, [0x80000000, 0x2, 0xffff, 0x0, 0x2, 0x5, 0x7f, 0x8]}, 0x5c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f0000000100)="c5b75fd22ed954d43790d01c2838ace1d6d619ebac38a9e0f098a23eb10c205b48335aad22c709d56f5ace0e9efc072787918b710f97ef5211d85ea44357796ecc7e14a3ec9d79d6cd374329a775b9c0389d39486e03b3ab853839e0482a38bcf6c79e8539f80b1c1c403e37ff264580f336a9713387893d29bcb2f052ce3bc3795fb7f8dea5bcec0d09ba732ed36d5d000934f1734b6c0cdf0fcaed2eb3e561", 0xa0, 0x8810, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @empty, 0x1}, 0x1c) 09:17:10 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x4c00, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 685.668258] binder: 8755:8756 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 685.703096] binder: 8755:8756 ioctl c0306201 20000140 returned -14 [ 685.712253] binder: 8761:8762 unknown command 0 09:17:10 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) recvfrom(r0, &(0x7f0000000100)=""/9, 0x9, 0x10022, &(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @broadcast}, 0x1, 0x4, 0x0, 0x3}}, 0x80) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) clock_gettime(0x803, &(0x7f0000000280)) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f00000001c0)={0x1, 0x0, 0x0, {}, {r2, r3/1000+10000}, {0x8010000}, 0x1, @can={{0x1, 0x200000, 0x400, 0x181}, 0x3, 0x0, 0x0, 0x0, "b3a80c5d532a8558"}}, 0x48}}, 0x0) 09:17:10 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:10 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x7, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 685.732348] binder: BINDER_SET_CONTEXT_MGR already set [ 685.738844] binder: 8761:8762 ioctl c0306201 20000140 returned -22 [ 685.745038] binder: 8755:8770 ioctl 40046207 0 returned -16 09:17:10 executing program 3: setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000100)={'syz1', "fdcae38cb0a9b9c4b457ee38aeb3df18d5a8b31a58b62a148045a42444353aa692c20489e197cd0545119d8e72b826441d1672d33854fc517c60b2b69efaa2a773fb28090b873d058108baadb602fb8ec014960f207aa92a009975cad093db488abb088d8bb3ea00d63281f17001a611039cdb6758918bc3abc4befb60d6b1308bef72e235bd7042fe156f814b051dcbb15dbe958042c726ac1168041160ae8d0d3b98383c837cbe4361cde2d6da663b4c5c0311feacc60f0c44634a735a435b7eb19d8f7928962755ee71a741ecaf9587f0608e9fee941106b47e400d080e8f7669fb11d5932b773844f3d83878b9d56557df9a86e1943bbbecd6365d6e7773c3b8aa75c118f29595b0e2cbe0ec5d4f488e9affb4e8559b9a8b70dae4e75dc0096d4bf2cb64d6855db49f52460c3e0f16ed911227de9ff58dd69c0e9d09a87856f674161690cd6b1dfa7555a33b737875aa3f52b18041fe3e1e41031bbab5a714f84d77574bb26521c738fb04c99ef865cbfa3f8cb2f96bf40cdbf225f88ae33bbf4fccba26cc4f3d0a7cb7d906929e3e94aae610082bcd43084960f597712aabc128abc33428281a2085e1b3c8ad1ac5818426a4a5836d3b86418e028d9407afa74db3d22ecf889dc3d24ec643e7bf2932d01a0690f505a5db71cff245541625916bf68d0bca8a5e4828219fec57067eb69fdad10f2f65e3217c29ab9ee826936a93c2de68b3311f2608c08b60d33cf8f1d33ce515dde8b09e1636fff05639d07676c6481460453f3f1d2e80254b1d6207f92a2b23e464734df5dc7bdc4b229e67cb8e912710092753da4b5bdde961bf9c4c64460b60c6ee16ad885f1e4d71425936effb6a44f5562c57f0b7fbd28a50c712a62d825f33abc5ec7c303e6f31ba6954dbd75ab73e7c929b4dab4b3da8faad928720b67749b0efc11ab17bae0599679eb56d4d0eadd6fdb5ff62f025323e41d048256d5e28c290eb56748f1038d6ce0e10da8ea6599fbc77b28fa99e97a48a0fa6455ef17b4d5cbe3324787473ae9b1405d877d3f41a145cbcd510100673e327ec395531779cc64c39814e79644217eedb5e4ecd72c7b104520312d93483967c916fa477bf7583707c1bcebc52ed95804d657c3c33d722455722af85de2a310515b5dd2666fabe802b378fb5c2875e19cebd569b1ca967262e5435b2b07a7e0251702663ccf6fd8a38bad250ac1969120d7d38a1f576d1e18d74bd6d96ffdd59ebd75105df80c6063bd814bbdbf79cb9de0a0307bce74a1832896f4d851f4c7b7cb97750451519a1395753c4939e6ec4a918ed2294442544645624f424b0d9b94f36af4c4ccb1801d1ba1898392b8cb82893d7d37ff0fa8bef1f13877503d00d9bc2d3f99b667bae9caa1a8cd957f356c9cc11ad2e86c9139839b616b2075881240e034516fc64755153473abcc79b8feb20617d4c9722a700012f693ee6c73e9381e1bc09f8083f07df981a88dbd14a4fc03f2c148348d137bf038de585bdb087de5b82e20e48f1389c77c5ab70962793217f6784ae22df20178e9533782639ebddedbc7e3e2590d1cc3c5c451b0d41e0ba235782f2ffbe15988d0f489eeda6f7235b2151948c07e17ecbf73e0c75a4a1003796441f9ef5876123321ee3f0c6e502ef687b0add26940fd592ecedeadb0da4ca817798ef65fc1640b5832fead30ab579b410aaf1aea482a395367de7c8b5ba7aa4a2792309b9cc8ca3e9013e32e5aaf20a7e45dc77bb2d8e4542de58abe5f67911762d01c95ae8e7c28686ea7b7780435b5e1e47e4c514e8bcb01aa60eef721cb01b14b264d842797979fe98e3b4597f8a40dc83781b8f12673f0cf4d71822283b5bc570bbcfb07d2fbe13eb778faeb2ba7a70427bf5af33763c8199c388feb24f9df76b04c648ad7d388f978360e852f6044afb5b616e90f3d74a67029739ab5f8330427794e3a671dfdb989fb08431e3cd05637bd9e355e0fcde1f3b0c745f8ef973d9e42a9004a9226f128a597e269e9103a0c92d1616e5b97cfdbf833c9d0c12e3300b7bcac1850c6aef3c4b330796777522271fcf66edcfed42f85142566e2be28c7e2361f03a9513d6d2a006bf5a2569805ee1cd88689b85bb1d3de9b2aff1c95e0f012b7b14648e5ad5655c46bf268fce3a20aeac7a60f54a939465a2d89f8363ab3aea080c6d89d3f6449ebf697c3316831ef1dbb3a505b7c0778c2cff7b3a6772982e16886b0f1a9099ec1cc3a1d7740d65e93d5787b26ab443a15be0404384dab5acc6e67e9502bed18c43c94b016cbd580d836a45d41f83a4c1669f8e26f1fb5d90d8cfd99f88fa8478f5b4588c7049572dfd2f4cb125e75ff0b1466615d79a3bdc713a65ba8fa71a67f7419c41651281a255af19b896a5abd9e6aa4cb3e3c0e0bbac4a5de0b5e99c71f81c4a377402d8b82607a119abd0f66e8a8988773338c0addeaf8bbd94391bac64a702b8ea6dfcee592e470ab777d3d89d047ac35f07c00500a64c8c4ba01f2d522eb9cff0f21ed6bd68024e6a67792fdebe5816f4cb51616430aa4ac955490d19b3839031072ede803f89545289b0bf4362e2a03dcf50ab94c4b4e3389d6b6a97ab4457b223a027735966c4bb008613fe92f1a2a0cff54dabc4de712ee13587fcbaff882749ef9d69760125a4f231ee3c5fdefe654500d187fd68ddb8d3dc234ca67b119f0d8a70f817dcce76a11dacb35179c9473ffad55dbc433728b59511aa2bb7a890cc4a6f53aebbff7e17a5ccb7943808462c5b2e208e3fb13cf78efed0eaf5480f442f71af8495c4e24d2347d07b4d8daf09e57e2906e239b95c542852578fecf30d1c158ddb8eabf9a0ae7b3a5d1bdc9c15fe00977b9e599511f5f9762e071a8d8c1ed7eab9234a4bcfddbd396411eada6bbce05bc9d2f28bb59a80c555347a3e139ab74e341eec431a97a07b44960f0f55691e1815525f27f3906f1a68cb63fe1e9dd8132f49700076871d198874a267b34e1c3cd8e8c199205dcdd22521bfddc17da2c80bba2904c247d75f9b3d62336233f8a9d600d41be891f058b993f5818436db842c021f9e2f600822c7e0e384373ca1f86427f65e108d396f5529eed6ad29372ce46fadec6b56f1f2eb6f3c8346791156d144bebd4fa3e9960396a5c59e3adf9865635e34e0b8f49e5e11e7436dd4074188231ebf66c619fb2907bdd60636e3ae76b70821184c056fb86c66872ee98d50f2951d521308a5bcd79e80ee1db753b0b13335fe41ebdca4c3e2eadb6e48ca21489ad933e840d5d9849c86ecb324e3e7fde37ec28224250a4ecd67b3fec07967daf1b2265ec7fc477efc807d0c43c24d5f1f0ad7facb2d73942c2b6abf249e7f60bc941120a3d94cd358659585890c843e26522813503b8c2a3b168a2e22e1d27356837e4ed0608be22c6f6a6241b337332a535ecba8d4533b59d0c4d12fcb9f390f3bbd0999f7b4671f9307245eb0fa5f28e3f7e5248bcc60f8cabdccfad4fb0b559d8f21f252abf173978573e3e38857f6e8b1ef3ee0497401fbeac570c1dc01431b321004059a1970b0f4ceddcc1f1d579abfdc127a6b75f24ffdd1db93a0f1aee0beb729f7312661fd33d19e3d3c0cf11335f8dfbf39f5dfe5ad4a4cd7e2ef62702c8c40bbc6990bf22e0adff74eb60d7c26572f105026114b8fd2324ee9ca379cdb17aa767d9a3bc074cf144d54f585eb53d5da0259635b99967b0ddb3debb9b41ccdf3425c7bafb9b789970e57a3ab0764eedddd3e5dbd32d05166e5d55731b208c3931691c0a57a2a25e67016f15f9a9e16ee4ca421f23bc4d3805ac88a925146ee3bc23c1e9e58ef62aa43fbe9a910b24427b380280a864655419a88e320c20354b3f7b1ee20d58b3a6fc3e0b5345a60d6f952eee954a7f9b96b8db9882c12d142e0969adc69828021a0f5eedf21e24b921927cc7bfdf4e83170d5304614b6aa4d1682cf9463c9fc260808770f9e9b4c14a91ce3a062e443ade3f40f81cbaf63d9e276c2d09ba483e729e53d454e9750e580de1ad7804f5f0311208072d4cde3ec702b3958e4e852c5b6e0c4a1d358b5281d192fea00c2ee5e5d6540ea13d8fe5b7a96d9f8e44ab64ecfbd8c7120b8f507a998063f668a27ff53b857f27cdef0a4c3b762dae3aae6f5344ee2b9d6f4342ce99e645e285979ea9e4e4a08a386f8651236caa1a270480895cdbae8956a4c121caf57694a0818130029a3b77eba30551e7386d88d9f0ccf61c6d9af3549d5548f3f22ec04ab04ae1c42363739b2a8303784341b59be093b6ca3c0e4db8ade791633d1f4ad2e54afec402ffe1adeece589cd8eeb0e041846e16b3459290b9ccfd9e2e3c75f2196f7fb0413cdad2ebc3f67550d5737e85827906b4b066a7c9fa2ba2beac3cc866af4a905e6816180a754ea1bf88a88751d3cd0303dd70c94a9f666dba12ca7e1b92e5956d173819110df1f4e4090e734948d9c997132fe49d0de1bb48cb9de91940326b2adefe14c4535c36f321231959407f7a26f646ea3351fb514dd7326737d18431e181a56b20cdea366389f1e9d288d38f243d0f3f75bd2686c99263a38eb55e3d3b8739cb1374055782b06220192af2258cd4ebfe2a90d335dd1440b5ef072b5371d0b613d0d686a2000c7672ed0eb1f323396d1d7c8967cdca527571d918a96352d53362278193c53526f4d9c90fef2e729d90ecd2213980af6987154595ae1694e551b2d5f4fc68ad0039deb5b05badbb947270e05b591563e61fe31a1c3b449f478183bbf7f38540854464ca70ae997e40763ad13c17cb796f57e70a68d120077528db7e1c078367005f5a307c236d166700ecda5b9fb03efa3752be17781ab1b3de26122b354dd84285e6178bde864f8fc863231c513dd46b2619098a627771544325290a64bef6cc25c783933f808c0eb730bda29f8d25038620dfc85f379dc57a8f153d66941647d70f187bb136f44d92b92b9e0d85bb891914a01e668794a492daf866cc49537b5eff15425c098f1f4ff956af607cf7e2921e0196e396a3ad71cca3ddacc477d47979f262757501dc2bd823494c993bc9c7865b09128969ea7933f2241871fe283387e24bb20bb19839ef081ee8fe877d4aea1997847f012f3facf3e3c3ac6719820086d0e66752ed002f6b5d6b20a49b5829afb934b1896ffe64f929c8e0aa2a4f997b788f8465aa15d2a86bba25cfdcf268b9b02c64a9e139fcb0c0d0f095a278bcd5271e2cdb185ba8104dcde3fa150aec85621c3cfe5597c2e871ce10b67ce287fcd68d7654e22d8db48f781ed1b14a316a69289ca7b417d83eafa783863386df69a981f65abdba079cf6e8af6fb430e05f5ad6ec05f262670c77c4f0a6de9262551f888d7deb9ed63cf3c81a2095e286c099744d9b247a70b740e5c3f6e9dc6496e51617d3a2ece789da646666db88083f409fa10c4ba74f4c28a0df49adf9e0a14d3e9f5e55d8a3d4c569e5964ede229f0d9f33ec67ac1ab59eb0f8fb0de037f8db8ab7b87e4cbc265bb18dfedc9b5b192034394c864f27b10f229057a96521399ee7b74f1a4cc09632ba685a314f953f198f2479c75cebd794c45725f9bba829055dd8092c522a4819e634e6b59582d9107bbd745cac179003d31e693e79c55d33fb9a8d749078fef03d37700e53fcf0ddf694eb7dcd9ba9cc12df1f211b8aad9dd63ef3b8a0f233de5fd68dcd8634e6d1b433aa28d3dc22c244c0e1e59a486c3dd1166bde5585736db5996bdcf79bfcc796f9e1b100c7d091b2bee6466d6619f029f04c52552"}, 0x1004) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:10 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6000000, 0x0, 0x0}) [ 685.835594] binder: 8778:8780 unknown command 73597952 09:17:10 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x630c}, @clear_death], 0x0, 0x0, 0x0}) [ 685.864905] binder: 8778:8780 ioctl c0306201 20000140 returned -22 [ 685.899871] binder: 8778:8789 unknown command 73597952 09:17:10 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:10 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) recvmmsg(r1, &(0x7f00000045c0)=[{{&(0x7f0000000100)=@nfc, 0x80, &(0x7f0000001400)=[{}, {&(0x7f0000000180)=""/121, 0x79}, {&(0x7f0000000200)=""/240, 0xf0}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/197, 0xc5}], 0x5, &(0x7f0000001480)=""/159, 0x9f}}, {{&(0x7f0000001540)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f0000001880)=[{&(0x7f00000015c0)=""/83, 0x53}, {&(0x7f0000001640)=""/78, 0x4e}, {&(0x7f00000016c0)=""/228, 0xe4}, {&(0x7f00000017c0)=""/15, 0xf}, {&(0x7f0000001800)=""/96, 0x60}], 0x5, &(0x7f0000001900)=""/209, 0xd1}, 0x2e}, {{&(0x7f0000001a00)=@hci, 0x80, &(0x7f0000002d80)=[{&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000002a80)=""/104, 0x68}, {&(0x7f0000002b00)=""/234, 0xea}, {&(0x7f0000002c00)=""/87, 0x57}, {&(0x7f0000002c80)=""/39, 0x27}, {&(0x7f0000002cc0)=""/134, 0x86}], 0x6, &(0x7f0000002e00)=""/251, 0xfb}, 0x7}, {{&(0x7f0000002f00), 0x80, &(0x7f0000003040)=[{&(0x7f0000002f80)=""/137, 0x89}], 0x1}, 0x4}, {{&(0x7f0000003080)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f0000003280)=[{&(0x7f0000003100)=""/52, 0x34}, {&(0x7f0000003140)=""/14, 0xe}, {&(0x7f0000003180)=""/251, 0xfb}], 0x3, &(0x7f00000032c0)=""/116, 0x74}, 0x100000001}, {{0x0, 0x0, &(0x7f0000003580)=[{&(0x7f0000003340)=""/59, 0x3b}, {&(0x7f0000003380)=""/233, 0xe9}, {&(0x7f0000003480)=""/193, 0xc1}], 0x3, &(0x7f00000035c0)=""/4096, 0x1000}, 0xffffffffffff8000}], 0x6, 0x10060, &(0x7f0000004740)={0x77359400}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000004780)=0x10) r4 = syz_open_dev$sndpcmc(&(0x7f0000004840)='/dev/snd/pcmC#D#c\x00', 0x7fff, 0x410040) mq_notify(r4, &(0x7f00000049c0)={0x0, 0xd, 0x0, @thr={&(0x7f0000004880)="e3eef2e49fb4acc9d865106114aa24a653aead517b9779542bee2c76dc4d2ab4f53437bfe8ce938b242bd9d2843afea0292a7f1a2c6e4f435d14201c4bafe498714ea8075de5d3fb171bcb7aa9b11dce21c53ffd10d58eb76977a7c23046e844ae76eb0483f7024f1a868ce6c03cba98e49b4a8dca0ca654ced43f4ffa1cf99b519e9c3cf4c97e8c454d9ac3d16979b8c211ee291b85649349f474c7fcc4d303b18a154d6e8f4a4dc239bed280adbbb07dc67b9b2da98a20b9c7257ed7bb949b59b1e89437bd7b272ebf82d70f7ed1f2f7d4fb22f53a612e8440c7c903e2478fe8a6a4b55b2591f2969b99af8816a27cfb58bab2565a581907a55666e6", &(0x7f0000004980)="821c493334609e29690456388813dbe71c3c9379a7"}}) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f00000047c0)={0x10001, 0x200, 0x3, 0x7, r3}, 0x10) syz_open_dev$dmmidi(&(0x7f0000004800)='/dev/dmmidi#\x00', 0x80, 0x400801) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 685.907632] binder: 8787:8788 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 685.914228] binder: 8778:8789 ioctl c0306201 20000140 returned -22 [ 685.932370] binder: 8790:8791 unknown command 0 [ 685.938654] binder: 8790:8791 ioctl c0306201 20000140 returned -22 [ 685.958042] binder: 8787:8788 ioctl c0306201 20000140 returned -14 09:17:10 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xa630840, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 685.985248] binder: BINDER_SET_CONTEXT_MGR already set 09:17:10 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x12634840}, @clear_death], 0x0, 0x0, 0x0}) 09:17:10 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 686.012138] binder: 8787:8797 ioctl 40046207 0 returned -16 [ 686.033573] binder: 8787:8788 ioctl c0306201 20000140 returned -14 09:17:10 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6800, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 686.080632] binder: 8807:8808 unknown command 0 [ 686.085831] binder: 8807:8808 ioctl c0306201 20000140 returned -22 09:17:11 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000300)=0x8, 0x4) accept$packet(0xffffffffffffffff, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000680)=0x14) accept$packet(0xffffffffffffffff, &(0x7f0000000700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000740)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000006c0)={'vcan0\x00', r1}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x0, 0x0) ioctl$KDGKBDIACR(r3, 0x4b4a, &(0x7f0000000180)=""/254) fremovexattr(r0, &(0x7f0000000280)=@known='user.syz\x00') ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', r2}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:11 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x60000000, 0x0, 0x0}) 09:17:11 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x400c630f}, @clear_death], 0x0, 0x0, 0x0}) 09:17:11 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:11 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) io_setup(0xb1a, &(0x7f0000000180)) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:11 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x5000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 686.636049] binder_thread_write: 5 callbacks suppressed [ 686.636065] binder: 8828:8829 Acquire 1 refcount change on invalid ref 1074553615 ret -22 [ 686.650201] binder: 8824:8831 ioctl c0306201 20000140 returned -14 [ 686.669902] binder: 8828:8829 unknown command 0 09:17:11 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:17:11 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x630b, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 686.683809] binder: 8828:8829 ioctl c0306201 20000140 returned -22 [ 686.690719] binder: BINDER_SET_CONTEXT_MGR already set [ 686.700118] binder: 8824:8839 ioctl 40046207 0 returned -16 09:17:11 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x40000, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) ioctl$RTC_IRQP_SET(r2, 0x4008700c, 0xd97) 09:17:11 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xd63000000000000}, @clear_death], 0x0, 0x0, 0x0}) 09:17:11 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x600000000000000, 0x0, 0x0}) 09:17:11 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) syncfs(r0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:11 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 686.849446] binder: 8852:8855 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:11 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x74000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 686.897160] binder: 8851:8858 ioctl c0306201 20000140 returned -14 [ 686.900326] binder: 8852:8855 unknown command 0 [ 686.921984] binder: 8852:8855 ioctl c0306201 20000140 returned -22 [ 686.924569] binder: BINDER_SET_CONTEXT_MGR already set [ 686.935901] Unknown ioctl 1074294796 [ 686.943289] Unknown ioctl 1074294796 09:17:11 executing program 2: r0 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r1 = geteuid() r2 = getgid() keyctl$chown(0x4, r0, r1, r2) connect(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="f20000000138c80000000000fd0000000000f2cdc2b64a28"], 0x48}}, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x400, 0x0) timerfd_gettime(r4, &(0x7f0000000140)) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r4, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, r5, 0x100, 0x3, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4000801) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:11 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 686.947219] binder: 8851:8865 ioctl 40046207 0 returned -16 [ 686.967080] binder: 8851:8858 ioctl c0306201 20000140 returned -14 09:17:11 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) socket$inet6_sctp(0xa, 0x0, 0x84) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r2 = semget$private(0x0, 0x2, 0x40) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000100)=0xc) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getuid() getresgid(&(0x7f0000000200)=0x0, &(0x7f0000000240), &(0x7f0000000280)) semctl$IPC_SET(r2, 0x0, 0x1, &(0x7f00000002c0)={{0x9, r3, r4, r5, r6, 0x40, 0x7ff}, 0x7, 0xee8d, 0x4}) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:11 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6310}], 0x0, 0x0, 0x0}) 09:17:11 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x7a00000000000000, 0x0, 0x0}) 09:17:11 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x40486312, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:11 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 687.146681] binder: 8882:8885 ioctl c0306201 20000140 returned -14 [ 687.159634] binder: 8879:8890 unknown command 1074553616 [ 687.178843] binder: 8879:8890 ioctl c0306201 20000140 returned -22 [ 687.188892] binder: BINDER_SET_CONTEXT_MGR already set 09:17:11 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000380)='/proc/self/net/pfkey\x00', 0x10000, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r1, 0x0, 0x42, &(0x7f00000003c0)={'ipvs\x00'}, &(0x7f0000000400)=0x1e) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') fcntl$setstatus(r0, 0x4, 0x4000) sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0xec, r3, 0x210, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x34, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA={0x58, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x70}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_NET={0x30, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x40}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x8844}, 0x20000000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r4}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r4}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:11 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6311}], 0x0, 0x0, 0x0}) 09:17:12 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x1200000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 687.233938] binder: 8882:8895 ioctl 40046207 0 returned -16 09:17:12 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 687.280899] binder: 8882:8885 ioctl c0306201 20000140 returned -14 09:17:12 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000180), &(0x7f0000000140)=0x4) [ 687.333403] binder: 8906:8910 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:12 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x100000000000000, 0x0, 0x0}) 09:17:12 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) prctl$PR_GET_TIMERSLACK(0x1e) 09:17:12 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x200000000000000) [ 687.400594] binder: 8906:8910 unknown command 1074553617 [ 687.421240] binder: 8906:8910 ioctl c0306201 20000140 returned -22 09:17:12 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x4800000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:12 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046302}], 0x0, 0x0, 0x0}) 09:17:12 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x2000000) [ 687.537421] binder: 8927:8932 ioctl c0306201 20000140 returned -14 [ 687.563946] binder: BINDER_SET_CONTEXT_MGR already set [ 687.580856] binder: 8927:8939 ioctl 40046207 0 returned -16 09:17:12 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x13, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:12 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x0, 0x0) accept4$tipc(r2, 0x0, &(0x7f0000000140), 0x800) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 687.611858] binder: BC_ACQUIRE_RESULT not supported [ 687.615576] binder: 8927:8932 ioctl c0306201 20000140 returned -14 [ 687.627563] binder: 8942:8943 ioctl c0306201 20000140 returned -22 09:17:12 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x7630440, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:12 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0xff000000) [ 687.676688] binder: 8942:8943 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:12 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x74, 0x0, 0x0}) [ 687.752577] binder: BC_ACQUIRE_RESULT not supported 09:17:12 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = semget$private(0x0, 0x40000000006, 0xbea38bf390e9ec79) semop(r2, &(0x7f0000000100)=[{0x3, 0x0, 0x1000}, {0x1, 0x9, 0x1000}, {0x2, 0x27, 0x1000}], 0x3) r3 = timerfd_create(0x0, 0x800) fstat(r3, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f0000000380)=0xc) syz_mount_image$f2fs(&(0x7f0000000180)='f2fs\x00', &(0x7f00000001c0)='./file0\x00', 0x401, 0x2, &(0x7f0000000240)=[{&(0x7f00000004c0)="2ac01dfb9848b60d4f1c2072c725b53b0a0cc40002530739d13f6f812ec0fb8a14c4c7e1cae8eec654b7d0b1b53d1365106b0e3766f39482a88392d9486d4b46ef4ed648afa1ebd95bb540ae7d413acf61c168f21c4272832822779e3761e5b7ca7df388b6954d3ac7645e78b29a613dc86968d3abf7b1b05d64dbc3e0cd98009255f2627ebe47bd472bb1a0c5f9751798c73d2e53c19cf13054cac0fcdbcf1b9aa9cf331508c88055fc04b87e9a9483e7074c22216d00f3b0513f2362a922304ba3208fd967c2f845e4cccef6651524466045d2936888e6150f07cf529813e1ff06baada5f2e5a1b4b6d0c69e20cf4b6a4a439091434c8d60aca9355a6b6b042d653036139fb7af8aa8fa4e7459bb5f89881749c8b5e8427e793d9181828dc1b16431589986902bc27ab917796a424d6fa183c6b8fe1eb50bea3c3dc6232ebe68e296af5532a2a2fdedf3b2ba23561ff0b295f660ef826e4c2b1e048e80821e225e66ee07d6cb92b9ecbaac5f88207bc76363e617e3e422ac1555b83c6a0226030619ba8f6a841b2643a7d73abe633dc73a879915f53b36dec77d549557f9f3cdf4cb6410b39d7ef22b8c058cf2c6f1a84ff80c9c3ea0c7d48ac258d11178b6a3239dc78527db83601dae3ccc4723aca703eea5f5e19a03196500d1efa10558507181adec42eeb0e25af3c1cdc67ecdbba4a65576bea821a71b544277a392ad8ff766c88ba68e97e5813882fa853b96b205aa2ba5ed077101fba132323d40eaa5d97b4a618d667d21264bde83a912ad0238861f629810b470452b1748af0abef01e30f958ffc367d34452d58d6c74770ddf52411aad30e955c01336af84c581df0eae2d3f16fdd28a6d9de52a44bc8d2ae75f69410f0f9cd1286de86d5a1334408f442ece06a939da7dc60bf54fd01291113d7fae24ed2c9fb81df0448505538c9d83363a00cf96ec1e76fa95cf275ab436e6e8a68336c6a16acac36672a9916e9cd8afa1ea78672b330275f2324f401f0bf749bf37d839e73ce08e0a6547b50299656c643c9fe22eca05c5ca64b99d1f8da0d46e88331f05ac1aef9d9ce119778ad7bb5d3f3efe1dabd3d3dd0b277ab5dc1a87368b993fe924a59b2c1db6863ad394849267e64d55ceca97984762874beaab0eb2ea747c8d29f69d77978a11b4bce52b124839c46a400bca3817fa740934aec23ca58c24137d7aac40f871a2dc3e1566e1d25cbb924f0f888f6be34e09f65876e328597b4bc8fe1f67b7066df25c3ff8efd23ad2178a40e653afa882d5c456fd2dedbbb52317ba8d2e230e38f527c093b151c6ea19936ad8139ba4f5052194e326bc6f1bc10a23057a18ee4ab91b24eebe7116efb35c16294c87ed71f4d282ef92860d257d80eb3fdff458524738c687b44352fe7c8f131a4d6da20ff089327b62a0737daaab1e9b1dc4588791ebf2b1880c07264a91b2a7e1638e8a686f9773f9fe061388df04a5e555c2ca9d52a49faf110efa5c976171e24fca5d8929788a662d6affb2559fb9399da0b3f8cc979751a09b56d680ebc463f56546b55b125ceabb69e0e0be83826dcac58a6b6ffd3968cb3d72a54cff74327b8f23a78769bb54e8445eb7338241c6cf5589288540b9044aa57ba296a782c87a6509a6787ca290ff86aa1742a288965d6e99a006bdaefcf1548ff975ec47f9a29b1c174869db41e23b1cab2dc9195cd81d8304b44fd3fa248ffa895ff04d4a36a61931188466fece0ee718214583845fbb2e00380151f63bbfe8a2448ce18fb007ea6484b875aba16ff1b69a8058a052c02fad74c06d7b3136609c20a6b46b451e0cbd78d39835bfd3a991145519198bf5fc27401f395e726532468b55f6d73496e1d6949c63d6874af6363d256bd72a04ccf7ef96ddc6051099c9b71b6a1ef23bbf4199a1052085c0a003f1708861450edcd18d16709c29b9878cb492608e94447a6786f633c5020a26964ae82b92e802caf63c0bfc223b35992c81ca1a892856a073d494f2a478c633a499341e1a528c1ac68ca48eebcac4f1ea230cdba090d278cd4fc8fa548915680c74222d406a45775a2daf4aae9d9ecd6bbab658854027277a5c2b33fb539fdac3887e580550a498757111743838a12572590898332de291f256362e3eb1f0e3ff5dd1ba059de8fc1224186ac6728c8985217294f44548c6504157e62aeb4df86bbf2621cd598fd828e167920a4baf8605a73ea2a007fce9cfa930b1c06b98e3b332ca35eb3087dd1a9d1b50a72985c7864a5873d97a3af5562a6af97d3a83bb45e853382e767acdab334a2a1228ab0a31b69851ecefd0774c6800106ea23d4266905977b5505fe1cd0b25a545d3fc67bdf7bcca7a5c468cf36fc6712a8d3ae7eecb3a04b829db4f6d0a6ce6933fcf9cb3905d98137f984275d8e88e4955aba5af6ea579a5661b3ee7ca8931c591fbbbb40ce854a9d08eecffc4e80333f2fc5500eefc7c28dac94fadba16307da1ce42716a0a46d36a594a10f113a173bfe3b86715e19ef6a2c68297af05321f9240ea58eba5cb5da0ba00447b00594d028e37b74e3bcf6c11c84d7b9f15520ab9e5d7585b0c70587373c0f0ad4765611832c7a74b2bc2015c35fd22d0fa26ed7f533a273f1359e5f21bec61d212c7f1161b3b6207a3f8c69aa9e7691697e62ab49a1fdbeb9dbe7d4d8337467fcc7fe9e5d13c1f87cfb1dde1ecf7b76ba25f82d4d584cdbc8731ac4b3236766a6ffc2c90ca33a4e36393f57f293e7b894d8d773b27049f0a3659f7f4e91de80f108c6b53dfd38d2418bede225b6acf8c4884b802dc375a41ce340eeae082c4defe4e34d0b792069c387b3dab9a84290ac10b3e688b29d6cb0885a47f7b3d2442adbaa943d472dca58825995f851fd6b47ffe6c38b0cddb73f0822fc81a94d260a959bc35fa4d5e7b18e536a218142ef3c5aef7eccffaf26da6c010943842a9a6d311a5aa94a95fd6b411c0fc0be8310121809e023ea420afe35fefe3ed275458fe39d8de635298f9f918f7ceee2d117a3dd9397da0a05cd49b973d0e61f929c1fdc2d178ad05df010d6a180d25ab19ad11d7ca986bd7e45d2970b8d9cbbba1e81d62ca1bb788b698f1726134284cd392ba1625b258517dfc563c0d2f757f69e582cac8fbf66cedf24264d071c19450323922b4175e1189257505adae99a7d2d09cb727f64443c8b3b984856eccae8dea8444223038748ac367b2d884378df4f07cec9979507af411cfc1af80cee947902841f978e08802393e9ca432a1faf8bf43c95317dd603b81ed95e84a06025f5b916febb8f0af5947d0c1b6c48f17d917f7f8a0f341cfe8efe9cf9adae4e5fdbfd750b373ed05136a1c877c1a471bda45a3943f81baa5ba024eda01b66685d7598b1ecc18c8bc3e3dc457b9b2ce33a911d38adbc7b557ee97a408a9065bdc993e13087bb7500561ec7265dd8bce1658611272effd60132210202accedd6ee8b9c0f0ae21e56dec7c9f2d6657c208a1fe659ab2d40edba5820f51cd7b717de9601ccad7e631bd2588ab1c0b153a907131cb2220786547e9859d753e699a65113752f1f8bfc7a12ff50e565cfb7a44218fde6b1d4ec64dc57ee575d3201c2b217417ef427c07ef0842b6bc6b5989db7f8581d9394d94c6dac1bf81cbfff9c70864044fccb304e37a20ab6fc7fc9cccbe05ea9c540a24bf74b91c30d6d5049b8229b2236612c1c189bf1748e4e16170828ab79809488e6c9ab9c8fb6e6013a1dd0594410cdf04f9618aa857da31c4a38e581b34854c66627375722faf9d1c6fd276fbfca76abc2a7c49557b49ce24905836c50b8b30f60afdb16fd3261e97300187ae1b1742da281c3066f0f0eba152b478ad5e7e84571eed8c1e2eaa454aa31045dc09329cde0498ef3b8332b38b040a093c39d262c68fad465f5c9ced7ffc2b524f37cbb735d39dbc1c98f2cb255473a30d7fa3a438530aaf0c24699f80478d4d3130c632c3ee1d9ae2a658ca7812b98990b46ef1e2d6be3c78f3b38762ceeea327ad1abf3ead6932220a6ca59a76f4023f86bf2107317eb5b8e3b6a4b785ab564a2ccf67817d5bab3449b92a4de3da99e87bcafb2a6112a6bb2240f1dff5f9850ec73f87410e903e93933e888fc32dd14229827aa508b1806406dc7aa1eaa9377f09e004476bf6f0719d9be89e9a0141e6860beb87baa96ad64f28e80c846c45abd032ca014731af89d7a4da8054d45bc0f21322fd35c8311e071c5753fec85d2a9a100b101af2b9c199b9c73875342d8e79c5bde25cee132fb623987144a7fb49c3e547631cae646cad3549ced5823c897e37a1b878049fbec967d03a1e0e3493ab91890224dfa9cc628c3b983245f2e7f404c50e69602cfca021ca486172c64468aa90af085f69488418ee17e3f0a9c558258ff71832f6a75074071aabbe4704383686d227267d0c05ef30f8e91579c1576b95b556ec31210779c5457f57f2793ae7c2da32b3c953267bcacd4f8b7b5e4814c45e2bd04fb05f83384f883732110eec876e1f295ce02c0379475fe083d3d31414b3cc2513215862908420b3b3754c98cdad1169c0b3bb308a688f0f23eda528b136ac010a9ae847b88c6d5a78accdc1281c6ec06098e838d10ae256d381bfd6866d839064e97136d6370aec201a25e471d86e96439e79844838c98b7cf6d4f4eb4260ce0e4792cbcc89c06d205790c111c9d4a86b80bfb50922ee86bb93123ff897ffa0fdd876b7c6dea87811fc1a80e2d9a7589bb02f63acde427abf0026db61205c5ebeb5d56188ea33364fd1910f6b6384d45f9faa2ba95b8e5ebbb6a7dc6ee9dcc632a175956f78863646ba878a3f73d2e1dee779d1f1e80f08e8a6d82cda99986f3ccd06adee89bbe2a32878f74371b75df25a1d051dbf339a66b8d03fe3c8dcd4e23096d0cafef2b63ab0934a95821f77596cda82b0745ebaac2f3047c33ecfb814e304ad008052140deb1d3c79cfc6da949dd960c78bba4eaca22f386620cdef24776562eabba419d5ed71b42de2648402027559c560385cd2b626116c2c81d97c82b76180cca51f375d399f0632840057e5ec7d5c115e2c2e126ab3be478205c6729d070907fb3bb145a32d40039ab96287923df03c12c6069bb1c8733fc7ca8851d3b7d4f1763db472e56e3e8dcec0cb5beb2f206e6c7fcfce0932c7e378149318f77a65b769c2f2575820ee93b98692a52da12d91ce792e3acf5c9898d40fde7f09341a636ad55d515168dbe2f8f1b7b0d5f4b5d28a55a7fb5e08ee6ba4ae0552ce141fc96d8a9e9eff67020aef59d0e82fc7d9a4046c77821c28ffec7e409860d6afd83fdc4123d7170321f5f2991b3b5ecf7a500bdd6245ffe18a9590169af42111b05fb2fc5fab8eb696855a1acf507aeeaa3aac37fda9018677ea1787a56a6515ede623fbc22f5ee3be8d96429d37b341ca1fcbc8fcec75ead5b2338eab403da4f9c97bd6c8ebe382c02d07f2aebebb7e11eb5edecd611c299ad3940f92d3be68650b2842e02c8033a0d1c60b58f1d61be0ae8cf3348977c0b09f5bdd085e27b7a8f0cb9cc7508f1afc9c9bd3a542de00ad443e1556049740c8de34a76f095ce48fd619e07538bba2263ff17fbffde2b6026cde19d5743cc2992831b7b79d226edef918da27490ac96c733ff44daf7e777fae182931367b6e40eed1220b567d8f406fea4b26ff1c4bacc2de4d380232c897d738c4f80c03e1acba652f5611e94d592632bf05eb3d435341e39270b8093ed0f3fa29b53feb727f736a3c5b563135dd9ce0d", 0x1000, 0xfffffffffffffffe}, {&(0x7f0000000200), 0x0, 0xfffffffffffffffa}], 0x10400, &(0x7f00000003c0)={[{@noflush_merge='noflush_merge'}, {@disable_roll_forward='disable_roll_forward'}, {@noinline_xattr='noinline_xattr'}, {@fsync_mode_strict='fsync_mode=strict'}, {@noinline_data='noinline_data'}, {@grpjquota={'grpjquota', 0x3d, 'vcan0\x00'}}, {@prjquota={'prjquota', 0x3d, '%'}}, {@noheap='noheap'}], [{@func={'func', 0x3d, 'MODULE_CHECK'}}, {@fowner_eq={'fowner', 0x3d, r4}}, {@euid_lt={'euid<', r5}}]}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000140)=0x8884, 0x4) [ 687.775913] binder: 8942:8943 ioctl c0306201 20000140 returned -22 09:17:12 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x100000000000000) 09:17:12 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x20000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:12 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x0) r1 = dup(r0) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000000)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000180)={{0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, [], 0x13}, 0x40}, {0xa, 0x4e20, 0x9, @mcast1, 0x8}, 0x2, [0x40, 0x5, 0xd91d, 0x1538e190, 0x2, 0x202000000000, 0x2, 0x17c]}, 0x5c) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000100)={{0xa, 0x4e23, 0x3, @local, 0x2}, {0xa, 0x4e23, 0x8001, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xf}}, 0x1a95}, 0x7, [0xb9, 0x4, 0x8, 0x1, 0x0, 0xe2, 0x7, 0x80000001]}, 0x5c) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:12 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40406300}], 0x0, 0x0, 0x0}) [ 687.824932] binder: 8967:8968 ioctl c0306201 20000140 returned -14 [ 687.885007] binder: BINDER_SET_CONTEXT_MGR already set [ 687.933049] binder: 8967:8973 ioctl 40046207 0 returned -16 [ 687.957981] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 687.973798] binder: 8982:8988 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:12 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x1000000000000000) 09:17:12 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x7400000000000000, 0x0, 0x0}) 09:17:12 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x74, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 687.990324] binder: 8982:8988 transaction failed 29189/-22, size 0-0 line 2834 [ 687.997912] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 688.015406] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) 09:17:12 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xd, &(0x7f0000000000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 688.060768] binder: 8982:8988 Acquire 1 refcount change on invalid ref 0 ret -22 [ 688.075964] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 688.095094] binder: undelivered TRANSACTION_ERROR: 29189 [ 688.110203] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 688.121570] binder: 8997:9000 ioctl c0306201 20000140 returned -14 [ 688.131750] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 688.140599] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 688.150670] binder_alloc: 8997: binder_alloc_buf, no vma 09:17:12 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0xffffff7f) 09:17:12 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x634040, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 688.158760] binder: BINDER_SET_CONTEXT_MGR already set [ 688.164572] binder: 8982:8988 transaction failed 29189/-3, size 0-0 line 2973 [ 688.172138] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 688.201879] binder: 8997:9003 ioctl 40046207 0 returned -16 [ 688.213927] binder: undelivered TRANSACTION_ERROR: 29189 09:17:13 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x630c}], 0x0, 0x0, 0x0}) 09:17:13 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x3f000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:13 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @empty, 0xe52}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:13 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0xff00) 09:17:13 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, 0x0, 0x0) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) close(r0) r2 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x8, 0x40002) ioctl$BLKGETSIZE(r2, 0x1260, &(0x7f0000000140)) 09:17:13 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x20000000, 0x0, 0x0}) [ 688.357203] binder: 9018:9019 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:13 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x40106309, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 688.409748] binder: 9018:9019 unknown command 0 [ 688.426513] binder: 9027:9029 ioctl c0306201 20000140 returned -14 [ 688.440400] binder: 9018:9019 ioctl c0306201 20000140 returned -22 [ 688.469276] binder: BINDER_SET_CONTEXT_MGR already set 09:17:13 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x8) 09:17:13 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0x3ff, @remote, 0x7}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x1, 0x100) getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f0000000100)={'NETMAP\x00'}, &(0x7f0000000140)=0x1e) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:13 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:13 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0xffffffffffffff08) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000008011edfa700000000000000000000005a34a59932"], 0x48}}, 0x0) [ 688.498860] binder: 9027:9036 ioctl 40046207 0 returned -16 [ 688.524502] binder: 9027:9029 ioctl c0306201 20000140 returned -14 09:17:13 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x40046307, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:13 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0xffffff7f, 0x0, 0x0}) [ 688.604568] binder: 9047:9053 Acquire 1 refcount change on invalid ref 0 ret -22 [ 688.643329] binder: 9047:9053 IncRefs 0 refcount change on invalid ref 0 ret -22 09:17:13 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x2) [ 688.669915] binder: 9047:9053 unknown command 0 [ 688.691149] binder: 9047:9053 ioctl c0306201 20000140 returned -22 09:17:13 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) mq_unlink(&(0x7f0000000100)='Icgroupmime_type\xa8mime_type\x00') connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 688.731389] binder: 9062:9064 ioctl c0306201 20000140 returned -14 [ 688.771584] binder: BINDER_SET_CONTEXT_MGR already set 09:17:13 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xc63000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:13 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40086303}], 0x0, 0x0, 0x0}) 09:17:13 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x100, 0x128) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x1, &(0x7f0000000100)='\x00', 0xffffffffffffffff}, 0x30) write$FUSE_LK(r2, &(0x7f0000000180)={0x28, 0x0, 0x6, {{0x8, 0x5, 0x0, r3}}}, 0x28) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 688.800763] binder: 9062:9071 ioctl 40046207 0 returned -16 09:17:13 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0xffffff7f00000000) 09:17:13 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0xe965, {0x77359400}, {}, {0x0, 0x200, 0x7faf}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x200000, 0x0) recvfrom$llc(r2, &(0x7f0000000200)=""/157, 0x9d, 0x21, &(0x7f0000000300)={0x1a, 0x201, 0x8000, 0x5000000000000000, 0xffff, 0x5, @dev={[], 0x21}}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x100, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x800) [ 688.846514] binder: 9062:9064 ioctl c0306201 20000140 returned -14 09:17:13 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x1000000, 0x0, 0x0}) [ 688.947411] binder: 9084:9091 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:13 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x2, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:13 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x80008, 0x8000000000000007) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000100)=0x3, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 688.992388] binder: 9084:9091 BC_FREE_BUFFER u0000000000000000 no match [ 688.999138] binder_thread_write: 14 callbacks suppressed [ 688.999149] binder: 9095:9097 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 689.009915] binder: 9084:9091 unknown command 0 [ 689.022734] binder: 9084:9091 ioctl c0306201 20000140 returned -22 09:17:13 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x800000000000000) 09:17:13 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@loopback, @in=@dev}}, {{@in=@broadcast}, 0x0, @in=@empty}}, &(0x7f0000000200)=0xe8) accept4$packet(0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000440)=0xffffff52, 0xfffffffffffffffe) getpeername$packet(0xffffffffffffffff, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000500)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000540)={0x0, @multicast2, @remote}, &(0x7f0000000580)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000005c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 689.049637] binder: 9098:9100 unknown command 16388 [ 689.060261] binder: 9095:9097 ioctl c0306201 20000140 returned -14 [ 689.080611] binder: 9098:9100 ioctl c0306201 20000140 returned -22 09:17:13 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x630b}], 0x0, 0x0, 0x0}) [ 689.114744] binder: BINDER_SET_CONTEXT_MGR already set [ 689.129796] binder: 9098:9111 unknown command 16388 [ 689.159009] binder: 9095:9106 ioctl 40046207 0 returned -16 [ 689.167413] binder: 9098:9111 ioctl c0306201 20000140 returned -22 [ 689.168920] binder_thread_write: 5 callbacks suppressed [ 689.168934] binder: 9095:9097 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 689.197378] binder: 9095:9097 ioctl c0306201 20000140 returned -14 09:17:13 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x10000000) 09:17:13 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6c00000000000000, 0x0, 0x0}) 09:17:13 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x463044000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:14 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:14 executing program 3: r0 = socket$inet6(0xa, 0xffffffffffffffff, 0x3) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 689.226235] binder: 9120:9122 ERROR: BC_REGISTER_LOOPER called without request [ 689.252291] binder: 9120:9122 unknown command 0 [ 689.303423] binder: 9120:9122 ioctl c0306201 20000140 returned -22 [ 689.347404] binder: 9132:9133 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:14 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x10) 09:17:14 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6354}], 0x0, 0x0, 0x0}) 09:17:14 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r2 = dup2(r0, r0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000280)={0x0, 0x0, 0x8}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000300)=@assoc_value={r3, 0x3}, 0x8) r4 = memfd_create(&(0x7f0000000000)='vmnet1)+[@selfGPLvboxnet1+]!\x00', 0x0) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x0, 0xffffffffffffffff, 0x3}}, 0x30) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000180)=@assoc_value={0x0}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000200)={r5}, &(0x7f0000000240)=0x8) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) setsockopt$inet_dccp_buf(r4, 0x21, 0xcf, &(0x7f0000000140)="a765ab807dc9c0664d955050953c4e28f8d37deed365c4e7ddf5147bf5d517675b3432f1d7fb7f58", 0x28) [ 689.388002] binder: 9132:9133 ioctl c0306201 20000140 returned -14 [ 689.417448] binder: BINDER_SET_CONTEXT_MGR already set [ 689.443722] binder: 9132:9142 ioctl 40046207 0 returned -16 [ 689.468467] binder: 9132:9133 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:14 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x6000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:14 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0xffffff7f00000000, 0x0, 0x0}) 09:17:14 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2c4b9289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000100080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) [ 689.490240] binder: 9132:9133 ioctl c0306201 20000140 returned -14 [ 689.492662] binder: 9151:9152 unknown command 1074553684 09:17:14 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0xff00000000000000) [ 689.550335] binder: 9151:9152 ioctl c0306201 20000140 returned -22 09:17:14 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x1) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x6, 0xb1aa103f51dd69a1) r2 = socket(0x1, 0x3234aa8c217601cc, 0x5) sendmsg$kcm(r2, &(0x7f0000003500)={&(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x3, 0x4, 0x2, 0x2, {0xa, 0x4e20, 0xfffffffffffffffb, @dev={0xfe, 0x80, [], 0x15}, 0x400}}}, 0x80, &(0x7f0000002400)=[{&(0x7f00000001c0)="8365b68015d46c1995be9d6d729eb39de47885e72926c86563655291b268ef870d38d97dfaad2048de1228acd1208b65ddef0b379524141bf04d227ec02f9c1c3ba0620102fdd5bcdc5da5fe81389895293b215622edae453f1c15b6616a6a8c64f0e574fe9e535ef200d615984cc02b339ea2cacc6560af075457a2048c6a984ca0168f9f", 0x85}, {&(0x7f0000000280)="3cbae99e0bd4dce9922974013c8f308a6cdfc0f398ef86aa1dade9a715a84af2385e052340bae16c87dec37c7d583594465389ab2ea390694aa8faea644f975f261c7d3d57070a8cba1c6443d2bac5a3b38c339e77483eaf1a83068df528eaadd549c33dea903220826f8960bd3cd136ce6bb221a5a7dbb23332ebfcca5b0d3bb740cddc5bedc26d5184958a9d97582e028605ad02aa8548cb82c46d1437251c6639a3bd00b8b7127564e4562c156c556e71418da05e329813a4fb39e692cf9d75608cb90608584382e720e0cac26323512cae3b3ad0609068a72af5bce7d4", 0xdf}, {&(0x7f0000000380)="980b8c78d1c6c096e1bd6f7df6c33fdda16576a57aa1a8cab5a43606ddfb3ecd64658737b1cfd90a42403731b31e02acbd27793150a0b77dae3d98d948de01e035d695a1f7c692f722b17a4f5a8c5d88f7854e", 0x53}, {&(0x7f0000000080)="afdf9577776bd78ed41284e733e14d7251a64ec6", 0x14}, {&(0x7f0000000400)="39cdeaf45aa00699744bbc93ce3caef937ac933c480ef75f37a38c3aac6c4031faa43d1ac1bed998be59541e6e3dd3d3143b7b763488b17371d58cdf7f881b4f4f9dad851bd1d94df304be4c542db1e9a282c8e32922f6ca4811f5d05733b5379e818daa9344361a9caa5b1222dc852a574866fc0393bf4b13a49e10ebc6e0c89deee312e41e698ddca8386836b537dcf9e2ef9a21d9ee6d4509ee8e531b854d38f18ee54b737bffdeff9914db6a90c6d4d6688a7386010b5791b4014ac94b22ce49614c24942354ed6f3b0c443e0ced907ca7ab3e5f11c67adbd8d4d12a461e87fb17969640002d5cb6786b204fcdae4c8d349e8fd10e716cb351aa61dcd81bdfe22cb589739d7999126736ee6b65d3fcf3b688002f7cef2b9dbfbdd05d6c3866176c87d53794a27ce58c345054b7336a58aa605b7b9f46209c1dd09cc673681968c526a5d7191bbe1ad07644ce1f7b756b1aeadd22db66080f69011e0ef2549c2fb5675b7160a5e4cc1783c57f1d620ce745ca942376579d0b34bbcf5faebcf8c3fb88a2aa6e727e45909adb47d41c80debcbf6dd1e0d6de603dc205cd0d66de7fe79d9dcb5f3739c7ce5ba38a41a1b371944be5032a8d7543e3f040f1d7e6344618f62bd2b89a1efc8dede8dd99e8982ed51b532ced66d6d5901bd707a2303ebd2ae2e50fc0a22f2106cd90b8ffd159da9422220e11c6eef39835da9e4591ed2a2f9914354cb0193668f6e167bad359ad46913cc1256c52a455a86d1f1f83d6a8b1de0131801ca7a94bfd55a9a54b3a464c421c762f5b3473073dae9faf4490f24f2fafa1b4b4f500319548079e013c2cecac5986258b6c656896ae388e58495f60758be3bc50b2c4a3373dcd082a00306bfd7553d098487107c4ef06b017074a0206896ebc35b1f12aa2f9a332c3f873393011531ee0470a251022f69624b92d63d790471fd3db9dad92efb7b7b0e8a76310bf9395a7482f98258f58c1e023411c28901c1ec638d05506ccc61b2f2f9a421b89ea1dcc3fbd0c78b4c9a636d77c40b939bcbac90f0e3dc7d00ee39b122e574bbcd47c05ab1db05ae9150637c3e8c0e0959d0df0c6880774a06b641a6755b4a31f1640a442ce38b3bf2c8a881dbbfa6b26601512dc8eb09ae67a0caf007d54f03e13f8faf87f7e1d279cc82d4751dce2831ca48c12addf288c7c4efbd2c491df01bd12216747aa927220227ee468e17620f7ffbe9ed49b5602130c8a4c00e860a407d3e8ed72827395aa066e416db7413509f54d7dd4a65718a7391b70b1aa5e8228b5dcd1cfc2c6686c0b4c2bbd9adf082b6eddfa188169de42720b8fd41841fa6cae27e3459ecca1e20c53df9d0ebf8220397a7460b25da4acbbcec8690cb04c0774bbd26c8c24667b8213f22b22e4c5f75c9c11d057e7bf89e52614943bae8a1993992a4cd04394de74c21af9cbf5171b0bb6cd7a7953e42ab7baa95833a6e3c02b8233a9784865775198607f4bdf75d8b15fa0cfbc2190581522b7f2d74d9813c6ebe86ca987a188aa4b6c2a603affffb5271cff4d0fd6276d2208db74fff094e3927faae2bac6d20e3b25015ea6144d6d2c58d03d8bfa2df37c2b2bf91e3846645262f47c09752197e233fedeea9224247a91396fd81d3bf540b58db0d4b764652ac1851155f7c8ebca0dc0e05aff37ddaadd02640acd076e4879186af3652db7db4262ae2fa16c9bbb6bef49a324b6bc60ec867ddb99a90c0d844b9b841253b981ec7c24a26455c4c218ca70951f083c26acfc0e85c7993e7a872c5b3437e3d7a4a637e07ade56ad9f54786bccf5aaed6f36d7dfc0fa4c8f5c697e0a8b88acc354e5659f08aca60adbfbc580c3c30187645388b0450e80a68133a29bd5ca93a4f11cad4870ea368eec9ef7ac100a52ddd5fa26337a968523bc79c4761c0e7c046045cd593725dc5e300ac8bb0a9cfe85a91a871e83252bec7691daa57dbc54f2affa9083fcb884b6113826971f7e4d5940e0138e628381d0986087ee1cfd8a1f1dfa10569774e5683c92926f33f05bf077d7a0ae9ed145c3bd8f9e9fe217125845f28895d72af08553b05b8f8bea65ec55afdeb8b143aef7e8bc5350eeabf79ea9d36efa12859f184d7a3c8cd08e08a1375692d43d499e703573c329f2bed4e50df66ec377f1d3e66938210b645fa6c0d1bc28a0bfbc51613c736db96638a4d1d0b4d4a380a207a06efa773e8dabc12737b498c344b56775d2440876cccb38bd59d1dfad17c0919499ac568660cc262fb6c1739507fad05da380daa6372a9eec0822ca69c8590a473eb645b98e371a32d2dbbe203e61dc9608883d6e9fcac881b95393cf84fa77c34df6ddba1a566eb4937fb6b11355cda76d030f742f33453941ad8a9a2feb2dcc3dc2c0c1ed1bb2b23c1d471f2dbee2077018079160c8d4ee7021ba5a7570df81e9bfed45b42f853eb0152f148f041e6cb07eaa79c7d14fb84e4a2be72dd2db902ae69a3de213d07230e34247174d7be0cdda2a104435f33262bc68e7cb0534697ef5541d29299c7fc30f5a78907e5f1b5f82a3157192168102346b57422c570dcd2cbd11de1df405bd5731b03d29ae1424ba96fb51e0644313b4d83a289a7a298d9db59e96d5075e6956e06475b0fe0c1cc5088abe44a4cad6eda2ed745da76fb21ceca79be1180e22df028a6415e866b0bdc0d0413bfa6f18387ac7cce56cb892cd090132a1522cd44203d8de04a1f8f7ef91b284adfa5fd040c7279c4ae4ba4664af1f7e82111b3367e10530b50eea460139ddd06a2013f709767e44091d131139d4112e5e4d7d09f7403d80a05c5512c4646b010922343941982ccc14ba2fa5d716caf8142a8f9861d88e6aaea373f0b2d4b73b6c32ee6c403ad9bcfdb6b8735f4a5e01a0266a0a036b06b911c9f2f81d9536353b82e1714ba532a38103b3ccba112f00d67e6c31e1ec1c9bf0233fc9207dabbcd6bc9ed82c524436dd42fb8f6047668959819b99a5881584c60baf9d50c7a85c6aba1454d7195756489668453dd16ce964047687fe8e61aac5bfe4e21fd653e040b2e9c2f783822d6bb5576128fb4d7c03623223b1fcbf7c345a3ffd9a44d6cd6a5eacfdb4ef1b986f993aa44d76f17fabddb12144d5cf216ca7883a210ae64a1d6e193efed0aa5e3bfc4ca08bbac715eb9df3eeb629b5e021a0259c4fa874dbf6df07d09cc7c438f764aa4bf07f7fc170bdb5b4eff3ac8299bc2733b44b45fd3d4e6c3c23fc0879987be036b174c2d3ee1f6e0bb35f67989f0426d07af1aa26d58e968cc45de0769992b3b1e6624966ba7a33f7a15f3436c1eeb4317633d8004f8fcdb65dc819ef76804e26635e5fbf8d48ed821a746a92b1bd10d6b9718b9c7d8be458018d531bb8308aa5f26ef0d2f9ea7e24af50aad6b664f5eae85243ffffe607aaf256d08d02d28d11a030b471d5457040f4a7c0acdb80d911f7244c2ee14676e6fcec2459f65ee7ddb239daabd4c8c702de1865cb977cb500add734352476b39fc332492dc8db5aa427c9a6c8622b91f8408934bf46a2ad0a605cfb03105ab52c697ef69a4dd932f3a651da152e23b449d475a6c9d9f05b99dda3042dbccf8df57b1690f66653028ce2d4c9c80f5981d31e282dbd8882c2e1708f442cf40116788232a470b5b21660a58b1f097352988ecc02de81d3efa5771652645288efb37590ce2c48f0f1938b48402ced2bde282f8feb33c892e97101fa1b99ccf17bb42dbcf43067486931702117732bc2e796e7c4074665e4aa29a73a29a32c54da5bc9c9e1f32bda6930b0fb17531a7e6c17e8970ff1c1b1429cae8e4ced8a2d731d9d9239dd9deed70f3a595eaea5b07cdf1c6e1270eb65a6fb38a45a954566e91d9f1c356fae62ffc1f3d21ac1993a9afdb22d24dc0fedacbe797a7ba9e77a4bee897cc2b6a0749d03d505aed8ff65437e672828fa2af48cd6cd387c1f4473da216839ef0e15621495a810ce22af0a6ef0d2cb4a38fc9eee8e2497c91ee73628977fa4c88668bad5224d9c38a430cae7f0cda13712c510db4f6608196716e87a233555913bd5e57d3b96f69613d40f3da3a2693c51c504182447d68e3e693b971b4b2c9765cb4473202375bdee88eb6086678d248ccf6b6f3aab61cb3e48ba58735a45a47edff8975c0f0a838f5da688d2fd29fe18b5198f9ba7e4d418a2a94c2274b1b1fe6741ff68000ced0b7ad31bf63812fdcb8f5bfeaec9ace4fa2b3195d5e0a9c22d291bef4beea6952c8e2fe40eccf0c60c251258eaaa461519c17f4145f008feb2dee27abe5eaa2fec7e2ceb8ce2303c6e91204eaffaf951ddba45db297a534d82f188dc6989061227f30d3bdcff819ebba5921815428045044626be0db304157700d8f993b6ed3e918012c821d708d987cd0a67df83aa983bb58b7f145a4b98d15f9e43cef5b8e22f95399cc4f8aafb5a15c541171839fbc3d0a49d331eb9f933b81907a5061ba0564dc2bd6b39745a55ee4e065590b2baeae38902d808993195428282cfe03780d5b29b53e6405d232652cf9d0e73626fd6184c59fd62cc554709a6ad1ae3e810c14481d17bb160e47a9151b301631ba6b9fdf58749b22d426414f88c6ecfe11f10bc12c77c99e8f02811d4449785174ac181698badd8aee4f2e68e4208e5c2992f972d972adcfff9bf63217e284caa97ba1af24a891f1c0eda5d692f880858a8f78e3724f7988dc339e79784140ee49c588edd2adbf935f04c1ea5530be75c41de3ee123703bd8e12464ad97720e3196250ccc00519d9abe79fb6b0e3de4328397a0f809e63c8346c3c6eb75110671d726a36f5b05fde8b911bd295aea27e65baacd3e9570ff69f1f5d2a7a72b3cd03a888d765a3d0f01fbc30fc37054f1c857eab4cb7ad07a40acf7a61dd2e8d7f99e97bd2cbf883cd298f90bd00a3305097544e656f0fb669f1d1a4c21caf4f171267afddc9d1ca849c5b0be0472d676200a2ea55d7cefd6d7ba12d0843338d09b1f68cb158622c23e67d020a83054a209a7a767093c89d6d7c6990c7529eaedbada3bd8e34f0bdc8dfd610163897e3539b6118d35e8839b1ce89e365c17f835ed53d329230c05a15bbaec54d7e372bba3102b8772ebf7ccc041155f778ffd51fd76025e80261378398ac007df6bf61d3d1e1552f758e382da095099491a0937360f3ddc7c22843a8a05384ca255ff181999ca33df4c5a869ba45ea3d53f9d6a6deaa2d08c4b497414e1f2cecb3a5e197a61bb9a55973145e889c8ce77a3f4ff89030c7534dfd51c13110b95e9ecc7a0ba2934d05af0b733382cadbf4de8226c00cc46e884890fb55fd3d53454c6d11092c8743dba47d691029eb4fec55a0289310bedb8a7368489086cfc955254136f5170d1031efcc780e664ba9fbdb7a4b611dfbff4c1079e552c1ecf40b9900dd2fd7b1fbda95f016bc0078eb3b464ec9adbf3b307147e9bb0de80fc96c2cbe6d954fe10e6f0a0a6ee9183cbc0996e698a056592951220c4a5b0b227a3a27f75c0eb2c0d30f5aa021272f8ede18507b8a0b4f738079c8177ff91b566b9c9d22361df2e9d740174ba11fdc3edd0d0b664e3b47227a85eba459076e8c204f7e126f9ac4c2983f4fc8621563946a0653e488fafa06e879ba735cb04618433dcb488268220a4057f1b1c5862d7d7f70bfbf33977e0cca42c5fee9fec49e9d71a371009c8ab9a847ef48978a755a57ddc7f03a14b1a55ea97f756d88cc5ad776f194ccbe11bbfb83377b1c435ff121a673a2b0c0ee82efec2a7389918e0708aa9f1bdad", 0x1000}, {&(0x7f0000001400)="16e5bd6e3e73466af10aae827ef87879fc5ac6084a3171c693258bda0da40a9911830355726bf05081c9fa9b82f9bcca256c1362e55661a374f1ee107231accd9cd19cf79b6c4abf9dcd8c6c2f9b2705f17f01868f10d4f9506a043cf156c6846ef0201c93e82febc3d1c20711b5b257c181071516cbea18c5b3437108f4e0f99a94558606d18c473993f533246fafaaa9a90875c0ac1640250b5b5b86aec4f266df7e2910d455fbce4ee5ebbe36c0fd20270355a65e9a23794d0b130cd24214acf086e58a434bedbf16b7a27df36a7c26d0c7699d5a992371b73a997e0306b5ab82c93d3f615493251a6318d5ceee91f4980893c5d64195fc062edbe53642b888ef7ada71c6c69fbe73cb5ebe7a723f4aa0f472ce11497bbfb7dcbf15466db5344331570ae8e5708bee28150b1892c24047088d5ddf6886a3d5dc6aecf3cac0e822349349491001612c95a52252f1a18ea370f123ba3c8a782dda5e6aabbae4af51816d47979e88aeb4579e18e50acd99ed8bd0fa13e4c6ad8eb89c5c0fc598476127f5a79a97aab1331ccd766d86750cba58fb37b8f830eab909b51e507ddfa053ab1be8b899f8c62cc4fc0f7de6cc8fe7567ebbc53b0fc5a17147caecd434fe95e21552694c6bf430b1eec77efaea726636165c72064fe5a03db14fc91ced712357e9bfd7a03988af00ca481e728d5052b89542a0e68870d9a28a9bf672f3110fb460f69cae38a1f7f96853c603e7e5e8dd19c7bab09eb9f583d5266a14f7bd3e296d1923b6c6573ebb7e0a2f9c584d2b9a09e4d0965ddfa43af3f727d84bf6b8f9cdc25df182eddd00e978d421c882905bcdac29ba9baa53ea42d1781807864b12ae656a252d9527af5957e224b63e7659cb9fb95d32ae3a8f6442227e1b519d42fe3ceb64668fa82a3a9519d9eb055ac30d4b093e0c9ca0448fff233a2346a8b1f467817895fd7626385045566f5fa2da3b2bbdb2ea62ca69b653d60255bcaf03ea66eab0ffe087a982fc7d4395b605aaf8e13d81111e38a2b9e3a778947ec7ed3ce8e8ba40e3dbd36121fe74c69779991795d618c545e40a86780d11d86dcf7cc86a989cb5d655c461c15bf4931a15645abe91bf2886ac0a063b95daafd86bce675d12a86fb4719800c891e73bc884a7c6c7b247287d91d7398210e547db1669d96b3864bb7843bd10c2e5b9cce3fe4cbea303f3ee881cb9e620bb8daab7fc6bcc9372c8780e76b1a8bc44b762a77abde0bfaee5e4e571e6c49fc49858fa6fcd64b48529e820d6509b7cd4e5bf63592aa0dda471073b6c12172d5fd9c20d39ee0d565c0aa038314567e1f0c4c8c6b79ad5aea40cf1c3d8d490e40b2905c1e11022d3ca45619fba68819b5da49b424780fefd4bb05e8e98230692c2168bf7defb529378e733453b0518276a1d854fd6c225f5e118a4f9ec90f2b29ede151a439482d02fcedef209e01a035fd9a0bfc34d378da5a76156479d8f4e9690f228fd2ab7c40afcb358389bd285357f4c160e822bda64618e10f222e7c9e57f585f1f6d679e68ecd0d77e5b2057f49e359a93abac7a52c0d4951bce580735d9cadb975f435b513c94e682840cad23a27292951632874310826e914bd813d13c74a1d0e8d70476753c23a1f0f1f43b1de5849479b2354be2098d5bca47c3541fdb785c26edfecf265fe53c568bec4e285c5268079a3611f7b5f3227416e0faf74b14d865ff3fd3d2a11872312b7309c1687b1bacafdb30fdf39b2f1eaaa31a78f5388446bcea62b14007b8d2b91f6bad1be6baeb475bd18584d38aca053c618d642d00cb2aa66d77161b1f25e137080e3eb7f47ec03f831931a85bbf33f005b4964fc3adb4213ea587e800ca990c912c46f8d3f60cf4461c1bebfaf17e7afdcafd14044b6b1394a44469e45343e63eac16d2f937023db62d32b4e204d32e69cc0b05165b15441608962a597c8fb4fbc8f4e040f11dd41a7ac341f088c0a187d37ade61fc744430b3c5f306911469fa0c04f94897af8a4b9ff2cdfada7202d983f8fbee6ee4ea9a065b4c4a6b8c2c7c2003d9c51bcaf1f1bdaf7c9e2376467af9e059be359b0dff8a062ca4cb315b985c9ec6d2b925ae24b7b813ff37d1f00b61bcd74980613405191dcaebca9a7f88dadb4f622523605c69ecad1ad00018f92eba55d4c842a36571bdb519f1acf5012a531bc8d679cfb25f3aeef0b009ec610dcf1fc817528a85e4b9eb10dc5b9094a1f6decfc2abffd29c331f0c065d5b221d2325f4268984dc796156f11319e8988319d4d729414c2c399d31f9d606e2c453c659677b07310c941f3b95fc073308098ccf524ee9bbeb785fdec7e9ca2644eef1f10af7b628d1ced2fbdcc30ef521d4e989618cd6d8a6bec4b716ee5bfae8536c2366b03517761c7671291b3266a00f1d8ba79ae837ab6e9b761aa373c10647fc9a3808761c2d86a33101abd09ae8ec8c7570f0bcdf1d81f897777cdf02970cfe6eaea9bd9c2361da5903f02b0c0df0e65050fbb5ac170ea67994338def9f635237764f23f387bb4e2803a5bc4f415681235d6ffe539b1b65e02930d1a6ec4c3f2c81c7154ca15477ad1f1b2312aec989eacc77f382877880e809bb8076098ad97b248cac0db112a4ecf2c526c8093e04de103b815b0a604deb21f6507b75fcb01a9f01cfafc34254bd56db0e0ef1030bbad827bb8a4b3d3c7bfbc8ed0de79e59507d0770276073615fa961f65c528be7c5e717ecfc45edbacdec5b3e0bbf1fe9edd4cca06b7ceb27a90b59d49aa6fe25655b69edeb45a8d15875fd499b33ac1533e7bddfff3f4299f5f2aa586e8afa283c8c56dd9196f0c794bac14d586d62cbed71e435ec93e375ff298ce6d90f9b0646055e34093b162fd53375f2059005ecd4bf35e550b3725af1e520600a0fa33d1753414114b03638ed4b7aeb364821af3f58f87cfddda1470aac5a8b69038a1311e6a7763a045a6776e4f00c2f746aa0d26b2dabf89ca5436bb3a43b0850e4d93ca048ec08779ebfbebcf2de1ff7c394d9a652dee7cdc71666dcceec51a6c91879f019d0820efd30446d60c76f1cc022d3d22ab2406f05294d57565982aedd7c2912290742c494936d6606bc197a75b0dbeb719cc875a644ace10643d68ed9f4c0161519cca41a1c2180113c99ed6d588ce0639bf97f65e466557c3051a5bf7c6881d078cb779f2060dfbdd09d5d7cec3334427fae5f69eca458c8b76e2d57eb2d7a48bddbab579b8bed8587ce2d7bbf6df63b76ab25b28758f166dc9315ad91946fa76d91be4fe8759558e266520b3d7620c95d6e9a546839981c15d323d496202f15d89a7fd638bf868b5d237601f9c1bba343999cdeb36b6710fd1a205abbf1ce21dac206421ed89f4193db6ca31c508cc33b74c4c5c6c36379411f7578e7f148a4a6790232a83f97ae75d89ee5f69941066572d685ab506091727639a6abee4bc5ad39b9efed3209d7cc620c8859a1b5bf37b854698085338ccfc6577e53c1166dcca629c39265a33181b9d23ff394c1e6c4dc0ff9d773fc8e202d9cf92831b49beee737bce0df2f428a17f0fe0ffa6ff1f8d93ed8fecac1d51a23284441d34a203ec49c1a37d8ff96d4778d1644c0fa1bb339c7d200a6e5c21f2ecd52e01bd7e426bb54f60afc563a010f402ae078514fa6add35745db20edc76c607a48c9ccfd5af45f62e923fae5748236efc2080465016b7df4d5624b6d646cbf7d48ff1fefad7fafcbb4e7e15a168d1f0c2f7a27b4718e35613403f9ff4ca27ea9bb6f91cdd7ecaafcb3123d4fb08a4125b840eac4a2841a493c549a22187863b1f7dc40b7416acc3efc90416dc1e7e0da78161cf6bd49dffc5ba1d744e01d47e6c4f9e9a2c7ae5614273d7812abc689eb57f913f5559a6d3f2a6f338f822782eab9e4ad9269d3da3f3e45d3c4fe3deebecdfa5b66dc5dec600a383688c439f56d2822237634bc6dd14664d07eee9498d9202d45e6e8b46be0c618df436c635082d65bd613e75853e4f480b8215c0d9b26dfc17e72dea621385d5f79868ca7cebd926249ca1a1e4cf3b82498f18a24e84dad7c0c4cacba5e4b0641ebb154a1d9221c3c50c141adc31980c3e7d33b91e87eea3f3a969ad2313723a54dbdee2c3bb1a19f2294452fdd1dd6ca5cdb659eaebb20db39ef3c724013354b2e5223d45ed745e855c35f215a5308c3dff8468f7a5d72b27f8450dd4980a964a03e87e1429ccb4637f6b9c48cfed4fae26a204dc0633751bc24168c731dd78bb6ba31213f71dd9f9eba6e57cc167fc11da867200c7884faea13053f58858f9ed7463a38e399ad18bf09a0954cda93131003ebd1c14e0edee15a2f8925ee5779f1a0444612eb9a369b118c1277fd45694a60fc3fa3431698429bf0f6512a57f00fd94ef806c357945d6c59156302188ca2039e7da5deb7025441a459f64bbe79fab214b3692a20f79c4a1148d4952405d7c028e2b71ee3175704fb087fc4bf6586060109e4c999c1236152eec93c337ae04fcc2f571b2af2eec942188723f8f7b72347c619f785ecd894e39cd42a363031a3d559c320df4a4d572edd1630b554304465050cc35c92a22c0300a8fd688abeb7cca7ee7216f3faa984ee25c102cdf92e0d9ef77bd3c81e9411c188273015da67447247f7b1c764403e89a1096a1ae43621cbd10354c4b12b7dd27d5516d00c982d1b125cb0c90f7d537f92a87b6a57f12032b78647f780a908869d4d2bd08b9d66ce326ae5ae2bf0abfa51a16c79f8cc877e295c28c32aab6eca368f702bb50e163db7d4bdb3fa39c946766d3a4f15663d94eace01db7888fe112a3daf8ff8e947ac8c895765dd85fe7c289aae0348442379648d7ab92a3f5c4fec73457886e2139d2fc48a173402087327269cad006df69bece97e73bd09e78e0c404891e842473013c6739139854e41e8db6b21e28545af7ce05d300c8e04f2f696f49c286cd64d83f70297283dff3537cca3b548ade407588f11398840d8620cfb8b5ea95fcdbc5a17570db75a0751d4be725f68fd3ba34a8ddf068ac36199ddaacd4a122ac59c2844b6d4490209c65227b9b60f937a70b7dea2e8c0c941df7d67a25dd5773ee096eed7041c97367ca375d8e18abdbea63f0f0a83689a477810d0638a2260ed94f7ae5612d630eac750c62e4772f046f9d665ec7dbc9acf16200a814b520038fee2f8ace336a81124ff82b6a12f3d2f5a9826c0f2776a97767a6e04f8644583c6bd7a25bc551b36ae7944645451d5db1a608658e8848e176b7540b33eb19eeb9c7aa4ecd3b56162ded9caba4243fcf5b15a34be10dc4acd23d70ce143e20b67fccd60f8b534079783b6b5fb7aa32976bb161db926f87a2cc9716b46840515dc3b2382820002ca58608604f34381f126e6b3df0430a19bf7dc7c0aefa4023d57ffc32ad72c5db9a078c992fffe8f772fd25f85d758014d03b1c4bab2786edc3a68e2ced19d9144b867a17f359c8ce316355c6ab7f5982d58bfa3d48ab349cf30069df1d76ec4a624e9827beb47c0442cbf984b73083e5402681c66973be0a00b5855872efcfb0f1a61bf9c75d93c7233ef842af02c8d3f2eaf722b52423e960b61c47dd4ebe22364e917e6e8fdc5ecc3ad23e53d5067c3e66c3eea701a63671293ee1e3953224ed48ed9b08fc8a5ee33d56a7c7f645cb4738c1b8959b22b8aa9823ab29a9c95dac7f6be85102a880584cb8a481a22f4905683f7fb2e825db6c7a57fa135ed2800ee53ef0e1847f2fcb1c924a2f63f09e95864a0ce96db86c92139ad2771", 0x1000}], 0x6, &(0x7f0000002480)=ANY=[@ANYBLOB="70000000000000001901000080000000e3bb62ac970ebe2f276b65c5b3ca621cff9500823b7e6870fa2652e393f8f3075add6aa7c4632cdddefc599f704cb3786f50a07f2d7d1633f3b184727a937cf76232254001934fc6fd7186e154044e1fbc0b471b548fd61da6ce00000000000010100000000000000501000008000000c962f94a507a53cade5b2f0dc4c3bcd2244b0dddfffd3c4b71ce013d862a9c75b97a710b5eb280ba5b79f71480528b36326d31e20aa961e9f8db9cf6eef165f5985afce1c8ddec15ce165fb50d6dd9730fd12a89ef5be542a9faa512062d504165c27d756f0bcc4146b0046f3e2b3ed0c85c507f5838d1282cd889b97b406c6493a24cc9e6dd982b6d1075aca06bc7322f5a11d9d87c7a7b6e6c374d888314b3ec982b0edd9144bb34d7d68feb52e6624c0939d250e121dbd18388157ac1c9f4a6c5ec760f028d07167af4092436cb2ec956705fcf223f535050e31a0a477cfb376dba3630088336a56ba9551cd39d0994924e5575a15941d9dba720090ef9df0f414f8c8209c3f292089601337da49017feff862d67afb0359651c83b1c825fa7affe56ad3003da3c483dc5e4aa131ef0a5c2314f8a721906ce82366882baa89dc9a812821602b77127d79805085324910d333854fccd7140bf43ecf43b1d4b9e6214681ffbbca9c07ee688356b1668284dc0426133b9ef2684016c3324977cba3877b3e76bccbf47662bab0850ce4615236bf2b719b202a7ed75d16113f8e2bc880d3d6481feb42e0808cd284f7ad239fdc3b314625dcf034efacb2041d6dd5e7b8b96891887a07c0670b1156915b903bf0cde72c0ccb2a90cb9fdf37d9b6bfc5f31f628f15ced7ac28e990ae72733e3643fe47e1edd6358004e64b7c86aacc8c3b9b9bb3a5423a3f6da3c218c4a7748803c75df669cbbe69a62746cdb4107bcf5dcfbdfcdd8fc64ad05a268bb4a0076daa2afda1fab975634ab70eb24aca76eb6a233b831df7667258a8d7e83d74a7ebb70766d92da39afe1159cd5f4a01c868b5884b3a8c7accd6fcd07b0b00e4196ab4014655c472e78c1bb6db2d2e0d0e399581ff5e2ed14691e9882bebe5bcaeaec1a825d4854c49be45d199d6d4566a0110434d0a42f811907a2833f3a8608b4e612fd9849c3a8afd31b0ffa7991df95b67232bfe0a3a38007be39f65e129e3aaffae3cf5b40b47906c0ecf182cda95c5089f2bb0aec39c31fb95a69bab0cac60e390972a36dcb59b20f161c1f9b13cc0f731d76c3d9113b2e8f3ab69d2bb7b501960a9bdc1625a62c0b55fdea81f13c34f64c786c6eb236daa387aa37090b5d2d54ac1e1f20284c47c710eae4b7816d3111d3b85e565002008ac744892e403abd0b18d41272b9510f46949b7763e78cce47f37f30846c4246e349197a84b71a861186eb6258fc431e3708243210b5f09401ed4469368477b6879f18c6f1d075a5cba8a968fbf3e3eb5401057967f89492ff9d985f00c6eb727c6222f092d774d44959309d156f405cf397bf5c85256ac84f32f955f38326955b517a10e2b92c56f9d46578d0ca278274f15d8edbcdd7b262e24e9b1b871aa5b1c93cbfc8e3ccc742400b6e0d942639f01a6e619d6c53d44b9e8b71579bd4617f386696f1d4108fc3877fd393dc6036faaf7c8d7b893241972022227d922c16dd21bf13a484b04913680d441f17bff0d8970445a3066a8f237d9d7b0c9bebdae1d2f711189be6ad1690f195c2ae5051644190af35f604f376c652293515af2c4b6821e5efab67c944275a1cec6b07a5ba4f255b8241acf781f153c45fbcaa49c1a0c46e3387909344dc0cef008db8222772c3c46e608718d984da89de63196e78d385dcc4e5b405096c2f7399afa7010e5257c30c1862cd58fc01f84ae2df0d63a348cd9e1cd0aaddb58e40836c45e2020e235ae0c5538575efb6538d39e9bf0432b0b858c5baf234c02ba35fb66b78be4e36822669f4d0fb12e53aef269bc9bc3054f569525365d1e3e84f19076eef7079b1f776868a83c28268237613e41e6ff10e8e2bb6382d25677b63d6f698ec02cea38dbc00d4393bcf73f97ee337784b4152b4106a14a39895200a46654dfbf1fef19225e4aa59ca8c54caa6fddde08b1bdfbb67ebf79bfe11a3694fdc42ba824953a2d72ce05d15bc93c8ce2345aa2c65862e66df6e01a3a01074edab047259ab847bf0a0b8a166fc3b6340038d43ea6bfcf105a81d9230ae964c4230726002144ae9c450b4fcf8899cb4e0dbf68a4b28ccdb7a279e7453445f59f58d01171687d658838fb1d298211fc5c5fa22cc821ad4152b566b1f2e1f57b24770243ec109ab17b0ed58b98fcd1f2b694b28e8dae13fc8599b3d3e292cb0fbaa2f838f607b8dda1ad41ba297ca39dbd2409dca40eb8a93b1a3dd845727fb38ed9d955810cc7fea5c03689b0f740297ebf19b4ab53f8e6c7088c7177a473d808da51c2793b9a2ef21633e5f41240778a51bc7cc335794e36635746ee14a5fe7a70634d78f07a85a44992c8fbb213420fb7bf31fdb415cf7278775f3c62201b3e08d131d4231ab2a35d06f917e411c1d0fd886e54551bc9c16d64ecf325791fd119154f2847a1b31e8099c945983d8cc62f15cbec824fa3a942b19f82353a5891fe780b0d970834f1d271f2066a608be169fd6c2b7daf509e01322f5afa5101f537e1c493f46df4275b26e45a308a8351660de9d1146e66ffd65f26125bf40b9db114c373a31a44ce1bc68963b2b24fade893de633a9492bf7eb7ff858260bbc4718229fd863456a59052952730e7b8871d65d9a8bc084d8b016f59d5b3b17624d57695a99ecc1b5d56558c32960822ca7296ed958e7af0c4274c810432a73207f140a3845e54e0b6af1b936f1496dd6fb8c25a4c99e96d4117dc751f737840a179468f6ee7fce18f7fcc1b1c2391b809617065e5e94e6bb94497408279e4b63835cd378e336e4e181c130195b862238fbee71df0e6435821ce0a49aa6fcec27a8a4acdf071bc6d16675892eb5b71b73ac6592ad16609fe92f8c29c2c1771af56a1b11306d3c55e5aa99b588f2ea085122e1c106b53b38e4eb93459ef43a55ea6589c1e1b15b2faac0b161ebeac2732194d19b975f070d1f748031bbda9b851988dfa1536e0901ccbaa8be171977ecd0b76ae4a5baad7971c1c5245771cac1c2f896141fa337d835c608cf856a7b6681ad763f443cd9b51a5013a382efda5b2d5c2bb8cf55e5c2cae15d1760da7c0546601cde4a23cf7900ae4775105eec825a7491e535704988f2d87a18d7c5f9ce70fcb2df1e357dec3fa0bf133cf9ffbaa925b33f99180183071ed3a9b62c2e16f17e4a2807cf781a4b17f5301163ba6dca3f2fc501e6b7bf791c496f60bcda1de8a29bc388216413ee59dc684f51b66afb01bf83d4dfc18ad4ba9e1ea704dd942acef10157812ad86cbcf968e7e084e819e277d44581d06c20ee87279f22cc06b7dcc2478a05ab95c4d6daa9843e8f4b930915817508e3562b4793a19762e35a9bb95ea2582d6413e2dfdc9e6ebc2a973f4ed4b423eb9af0ee232f0bc76019ffd723d733256689a7d59bb869f544ab344192faad7a76e02596d7b9a9dfad14d539b79911eb789f10b9b560566f87e6394d5e83bcb7ae693ad305d799e81fd974f431d12b71f5f5213808cd177412dd5c1bc7650d790af632c1a4f9823d9c7c2c62d2938d9781c70ec67ce7e3ece09f4f950688836eec1e83843cd02b215bd090695665d48f9f7c8cd0f6e39a669741e4347d0a92b208ef7d0bea1a8d2b896c370113071ee268c57c1f1e2ea6454650401886a169e58d650c5a2eec12c36e02bde3075356e2a9b65289009322cd9c0ef3af5b89a24fa6cc7dfc395f095e3b5a03f7f89bc398d5a7cc85b77056620e7dd9c5b7cb8f10948349bd7b95659058c47bba200fdb695f237fdb8169ceff01b6046560e4b8e58195346887fca354b7b8ccc9132e920d81830099170874847a322d5d1958ec80f57a6bcb6274776fe773b6f0b84328776427dafb99292f0bb2e09b6d8a45f1cfa8ce2be741d85281ef795f0a9207aa4952c01183d5487c7217f8a9888d8b63e37c4491f0239348bd69e6e6afb2e5d3a63d661e32ccb2e18a0ddd2a04fa3c9a44d8286f644a0fbb606066b1e1e75c29c72ff42f1dcafd57872b44165cb552a137e4eccd9bf2c7e5d2745c41be62aea9395ea8b0244f5efe757edbccfc13cd553d99682f6ed270f4dea7b9f7964b1f11c3b3b9bad6d8a2af5a15a65605b77b70a259607c8723d5185a40a3a7a8b6b822103a6df006b6e37c451441dd5e31f4555c3acc436e63a908f1cc086de128a86fbe91175a0b423181e2e4034bd5de95a39af0d8af482db99fd768d4cee7bcbbb11ae4085c4ba800e2349a7eb205c56c6713115416fe2ba4f18f25b2b7be45be6b57594fa3c6a0aacd972d24baf2043f81202a7757e83c7e282a86ec3160219f76db828dfd47507a03cfa4a23444336e9c821078392409659b006382d15cd626ad903afa6077316183cd3ebc827947f4d533be62b6d3174d3af40358a6e9f043e922fef2b34a82d5b3c572c4f24847e51c9557e22cedf57b7f59450f452361e75cf4ba263926526dd78b1f8ced74a0ddd11ab330c4a4f166ce39c74ca8690cd65dd967d57f9ab5ca1b5eaa80bb2d49209eb07547c71ff2c9a7ea47d125e5b188d7ff128c5544018576a4ffbfb7c96bcbf8158a0e13946b4c90bc3ce7fb4471a12d7841bd5d66b9831bad54419986b24bcb459e2ec6d8e00d903bf81639d314a0d6c637912f9867faa4f3452a1818a3fda4eced8db72ac344ff854ffaeecd20964d02a42a116ef1b102a25db44a4bb90e1f6c56ed595fbbc8eaea425a93ec875be500aaeb74d24e38714ee0feef5ca2c8f6565e66e2a25084e372469dc71480f13e27f3d0e68b1c94c052ecade034745326666690e2d7ddca931cab5874a42d1b8c5afb7614f89fd6058d3770134060fc2c341c298a83350dce37f2d16ed4d0c9a4010ee24e8fa148edf97edea95dbbae0d41c6357072619b9c90bbec3f1ddcf359fc58266c177ef03e25c614ce39b206c5716842fb28b4f5641e5df75502e87d8eaccf44e5eb361aa6a56392ecb3c0e14486d9bd44813cd1de5b50fbe9503fd55b06b38f347dbb5d52a57cd6746ac76afc10927bff934170eb70fbb30c41c112bc35034799fa5c4426e3899bd0cc62c4313dda53733e2790886a772c9b06066a290474b23901609efc8469f5605858ee6ff755c0ea9f763fc8960198bd341b0d1f4fa5022d824d1d1b11970190cb540111689f4ab9220944be473f1e0d02d3ea2fa8f464d83351e19a37bfe09da713ca9d9cd3359a1e5e3ad7680f08ccea670e8c672e7da1bbe5b8da0cf4744ab5c9a6fd6364c4b666dddc3cf15224c799a0a5d00c34797ff34715600f54ad358603f988b0df85136192fe4a84340c3830210efb8097a1684d968b8184ab4b6bf6dfba9742dc94e8d75105546ef20bfbf9891ebbac5c5958fa4b572f88dc0c293371dd85d14e7bae274663489a77a1bb26f29e690f9de8bf0018b714eb2fb27c0200b928464417dc0446ec0062ca85df416e8f3d72fb38b92cc2433edcac11b24e52d2b0c7323b8b190ef0d9f59ba3c875f82eb5a6888558529a1a320dc019b06032bffa0cdd5d2df0c64ca36b0b85cfb062a104b593b1b9aad40ce71cfb8a69c611f25685964dc494fb3bccdc9252cc2403f9ca48884707e856cf89b867ff656eb25d64ebce101ff140c92b21aabb88cba607cef1334a50d3fa9e2f299e32583bedc70c379c17505dbedb320c67c85262a18f538427f37eb338988b81f4484c982c4d4318a921259d5b64c3745519203cc084bca5252b248a1f3fffd24c9b69b7a7975f81e1cdcbb995e8e7ea751b290526cadadef7ba932c1885880faf45da6d2cb810d151981173f67c"], 0x1080}, 0x40000) fdatasync(r0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @mcast2, 0xb}, 0x1c) 09:17:14 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6302}], 0x0, 0x0, 0x0}) 09:17:14 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x40086310, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 689.616153] binder: 9159:9166 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:14 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x8000000) [ 689.701258] binder: 9159:9166 ioctl c0306201 20000140 returned -14 [ 689.722025] binder: BINDER_SET_CONTEXT_MGR already set 09:17:14 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000110000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) [ 689.747319] binder: 9175:9179 unknown command 1074553602 [ 689.750822] binder: 9159:9180 ioctl 40046207 0 returned -16 [ 689.757492] binder: 9175:9179 ioctl c0306201 20000140 returned -22 [ 689.770883] binder: 9159:9166 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 689.798343] binder: 9159:9166 ioctl c0306201 20000140 returned -14 09:17:14 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6312}], 0x0, 0x0, 0x0}) 09:17:14 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x3f00000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:14 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x1000000) 09:17:14 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x4800, 0x0, 0x0}) 09:17:14 executing program 3: r0 = socket$inet6(0xa, 0x100000002, 0x20000000001004) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:14 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x1, 0x310641af4248cc46) bind$can_raw(r2, &(0x7f0000000140)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 689.960469] binder: 9201:9202 unknown command 1074553618 [ 689.966009] binder: 9201:9202 ioctl c0306201 20000140 returned -22 [ 689.982612] binder: 9205:9208 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:14 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000000)=@assoc_value={0x0, 0x9}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000140)=ANY=[@ANYRES32=r2, @ANYBLOB="5f00000048979170303af7cb38cf4e2432f8c036d1f2ab251372f0200972e77e281e668a502434807cd2ac0aedfb936c0f5cdac2223a87dcccb8706e3cec261d6f009b754aa13f5813f1ec046f662d3f2c26b9c111dded0f0100000000000000000000"], &(0x7f00000001c0)=0x67) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:14 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x300000000000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 690.012723] binder: 9205:9208 ioctl c0306201 20000140 returned -14 [ 690.041641] binder: BINDER_SET_CONTEXT_MGR already set [ 690.047962] binder: 9205:9219 ioctl 40046207 0 returned -16 09:17:14 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x189080, 0x0) connect$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2711}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:14 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40486311}], 0x0, 0x0, 0x0}) 09:17:14 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x20000, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e21, @empty}, @in6={0xa, 0x4e20, 0x9, @local, 0xc10}, @in={0x2, 0x4e20, @empty}], 0x3c) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:14 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x200000000000000, 0x0, 0x0}) 09:17:14 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x6, 0x1) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:14 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = accept4$alg(0xffffffffffffff9c, 0x0, 0x0, 0x80800) ioctl$void(r1, 0xc0045878) socketpair$unix(0x1, 0x2000000000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[&\xe5\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ}\xb7\xf3\xfe\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4', 0x2761, 0x0) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_pid(r3, &(0x7f0000000000), 0x12) setsockopt$inet_tcp_buf(r3, 0x6, 0x1a, &(0x7f0000000100)="353e28c46c4b601076aaf73dd4e63008320dbdbeee4d84d17c5b11ca265e96fbab28f2d6be7f716ec9293fc729d906db3e2266b3131d80f3f0a3053cbb85de1162a92980476dad418ea0f32bb7f6b518078f3ac562c77f78b96fa2df8f49bf92d21f9c68d571ead3772d421c89a2c1ebb8033c7bb7db0aa65ec4e3362bf4b1c28a41a7c4d2b1e8d786143d0fc042392c1f57a82546dd5f83c23e", 0x9a) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x660c, 0x0) fsetxattr$security_evm(r3, &(0x7f00000001c0)='security.evm\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="e67becaf68ea66eec750ebb1b6c04fab"], 0x5, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r4}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r4}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:14 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x4c000000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 690.242129] binder: 9233:9236 transaction failed 29189/-22, size 0-0 line 2834 [ 690.267692] binder: 9237:9238 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 690.281120] binder: undelivered TRANSACTION_ERROR: 29189 09:17:15 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) accept4$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14, 0x800) connect$can_bcm(r0, &(0x7f0000000240)={0x1d, r1}, 0x10) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:15 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6307}], 0x0, 0x0, 0x0}) [ 690.336162] binder: 9237:9238 ioctl c0306201 20000140 returned -14 [ 690.358702] binder: BINDER_SET_CONTEXT_MGR already set [ 690.370859] binder: 9237:9254 ioctl 40046207 0 returned -16 09:17:15 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x4630440, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:15 executing program 3: r0 = socket$inet6(0xa, 0x4, 0xfffffffffffffffe) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x80007, 0x8000) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f0000000000)=0x6, 0x35d) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) socket$inet6(0xa, 0x0, 0x9) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 690.397255] binder: 9237:9238 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:15 executing program 0: connect(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r0}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000240)=@abs={0x1, 0x0, 0x4e22}, 0xc6) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r0}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 690.462143] binder: 9237:9238 ioctl c0306201 20000140 returned -14 [ 690.470088] binder: 9257:9262 unknown command 1074553607 09:17:15 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x50000, 0x0) connect$tipc(r1, &(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x1}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 690.508214] binder: 9257:9262 ioctl c0306201 20000140 returned -22 09:17:15 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xd630000, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:15 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x74000000, 0x0, 0x0}) 09:17:15 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6308}], 0x0, 0x0, 0x0}) 09:17:15 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)={0x1, 0x0, 0x0, {0x77359400}, {r2, r3/1000+30000}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:15 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) setfsuid(r2) 09:17:15 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000d1c000)=0x6, 0x7baf8d178f2f5f2c) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) pwrite64(r0, &(0x7f0000000100)="022907c4e95d150cee5bd99967a454c81979a562c481995b2c27a30085673f77df8a681aeb59b8b3c8e648f2ebea7ed06d031ff5974066ffd6e1f9b072461f7da3054e600946dd0b35a644b929725ff787b56ec1aa68ad77c7689af030e6110ba48383b53c1dd481571a74716b75f1b1af1a6abaaf8da09685cf83504e23d168b040ac4bbf7fee00035f03eb0d43bd5234a2ade1bd53beb6e4fe056880a349c040e2c89857410bc3ec569ade8a3d18dc30026db0fe20941746a820d9a759591d60413f3a42d0ed34189f96c507f19ea98777e07232a68532cfac53d3f562b93e", 0xe0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 690.664817] binder: 9287:9288 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:15 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x7a00, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 690.704963] binder: 9287:9288 ioctl c0306201 20000140 returned -14 [ 690.741797] binder: BINDER_SET_CONTEXT_MGR already set 09:17:15 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100ed000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="0100060056d0b6b95526000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000080100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, r2, 0x300, 0x70bd2a, 0x25dfdbfd, {{}, 0x0, 0xb, 0x0, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", ""]}, 0x28}}, 0x80) 09:17:15 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xc, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x5, 0x1) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 690.780233] binder: 9287:9296 ioctl 40046207 0 returned -16 [ 690.786094] binder: 9294:9300 unknown command 1074553608 [ 690.814558] binder: 9294:9300 ioctl c0306201 20000140 returned -22 09:17:15 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xc63, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:15 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x68000000, 0x0, 0x0}) 09:17:15 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x2, 0x240000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000001c0)={0x0, 0xf4, "c3c30285fd5d199d9ebd610cd870001b5997ccdee1b803030963284e10047a3d875c0f6531d10ee3176b61a0b049b020214711c0e211d7b4e760e94b4b8e0c4d0aa81fc5b8d979121ee10b5773e6979d6035d65638c2ed4db01f89706c04b910dfae0d820511784c527ca10fc59393cc5ec0ed12d70ff0bced763c975ab1b635dc6a62243d24ed5e37ae1c864054e4b50acffabd3a2993f0487481f11201a3ee5429248d38a07072e2ce46d0fe98b0ab483f27646f45fec32a035f9989a28453e40070a83a681a73f117aecccb742870a529430aa851bc9d19721e071fa0035a28b2ae14feaab9a0d355a0939a27420a8b7630ed"}, &(0x7f0000000300)=0xfc) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000340)={0x0, 0xf6, "2cd2d2e0639108e05cd406096fbef92b8d0e081d72c781f41657347c2d6b2b663bea92be2fde557ec886a43c480320c1208339f84a9275a997ff437bd659c4be58a7536404e845626cf52c15f4758f997af89037fe7693411533f78daf3d8988870849753521ff43566385df46dbc87591551f8bd09f26ccda50cb15516b39cdfcc188704d29fd45862aa5628f7f0294c59d8202f62b230f1db2a6c7a0c861b668b59f91c18aa914d82d7eb2b54f3263c37a57f329cc9a77445c0ab66db9ac572c960463675a6c3e44da9764ecd379667cb6e0a2b61b30f762436881c322c29cd428c3b92150cea245b88eae5b18874e189ed0bb1c8e"}, &(0x7f0000000440)=0xfe) sendmsg$inet_sctp(r2, &(0x7f0000000600)={&(0x7f0000000140)=@in={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f0000000180), 0x0, &(0x7f00000004c0)=[@dstaddrv4={0x18, 0x84, 0x7, @loopback}, @dstaddrv4={0x18, 0x84, 0x7, @dev={0xac, 0x14, 0x14, 0x1b}}, @dstaddrv4={0x18, 0x84, 0x7, @multicast1}, @sndrcv={0x30, 0x84, 0x1, {0xff, 0x8000, 0x0, 0x7, 0x109b, 0x4, 0x4, 0x5, r3}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x9}}, @init={0x18, 0x84, 0x0, {0x0, 0x3, 0x80, 0x1}}, @sndrcv={0x30, 0x84, 0x1, {0x9, 0x1ff, 0x8, 0x1, 0x4, 0x4, 0x7, 0x1000, r4}}, @authinfo={0x18, 0x84, 0x6, {0x1}}, @init={0x18, 0x84, 0x0, {0x8, 0x4, 0x101, 0x2}}], 0x108, 0x40000}, 0x800) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 690.903306] binder: 9294:9300 unknown command 1074553608 [ 690.975815] binder: 9294:9300 ioctl c0306201 20000140 returned -22 09:17:15 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5bff00000000d9f257c273fd34d32588c4b40000ffffff0300000000000000b6630277b26beacac69393bd61b87072f90b9021252b4feb3fdea363fca8d83331899dd6fe4aa94c8be6a8521d5611451f68f9445cf53a7cea829ed7c322aa2228231c99ca55c4d114f61aa79eb0e4c3360cad93cfcd0969a786e52d0ac0980fd207787635872b8954b74181973909367d1fd1ee88dec0317d7070938ae4daf8adf41eac62974dc03dd4d4adbf1d848c05509750e6a89f77c915650282b5377a95401f659aa9c8cb0080b81a804744afb6e078c95bc8e0e1ceddfe5bccdd821f8ab0875c59f3de53ba7a582b914c5609ba478996dce0c5a5ea8849c5ad5a9f23c8da97aa8ecb6c28454b0f6c64773045637e60de480bf5e432f61b189638d9057fe692edec3cacfcac93472e1dbc05e8523faace5796f4b5821a59f6d496a22daa412dad43a72270c89805824339033e82b54cfe7eadef928bedf16afa116b1f5cf87f313ffcd00da0d46ac2bf43577a40cac4438bdf52aa07d446934e8cac", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) r2 = dup2(r0, r0) ioctl$KVM_XEN_HVM_CONFIG(r2, 0x4038ae7a, &(0x7f0000000240)={0x8001, 0x2f2, &(0x7f0000000100)="9896ee18e1131476375888656e551d262bbfe84a5c3d7e60a2e9ce79cfb746e9f5fd8f4a2721a15eb5da4f854fc8f8626dcc2d22ee5cf83e6323a822191f0881f4bbe391243509d96b", &(0x7f0000000180)="e4de4eb4d46064ace39ad314e8cc4bb762b4223b047fe68b01fda6a015202e572431faedc70d3db4ed2da8e369c8762b13a0464d8b5fc854c8ace79729642a2d5bae533d8800bec782a46581a1721df2878529c004fcb94a5e705bcc0e30d9a16e70a58de2f60c9871fa9b868000471025932cb69c616bcc34d43b8ade89fc9089ad26e9c50bbb8f109312a6d4f27d6f2ed83b804b899705203ef49f02356e64b94064f6c0f10be866cb22de4af151f1ad7ebd92", 0x49, 0xb4}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:15 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40406301}], 0x0, 0x0, 0x0}) 09:17:15 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) syz_extract_tcp_res$synack(&(0x7f0000000080), 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = semget$private(0x0, 0x2, 0x100) semctl$GETNCNT(r2, 0x2, 0xe, &(0x7f0000000200)=""/159) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000140)=ANY=[@ANYBLOB="10000000000000000000000007cdd896ca4a7015f6e3c89c4dad24135ee56f2f6f9e12e0cf3459920524950a6e191203d88be4d9a8944295cbde10045ee83179a5b9909fb092f4926d1514f1cecdefa2b75c03e7abe40e31a14a0a4dc5712ad638a692bae139db102304700700000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) r3 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x0, 0x2) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r3, 0x114, 0xa, &(0x7f0000000340)={0x3, "cbd9c2"}, 0x4) r4 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x800, 0x111000) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000100)) [ 691.024635] binder: 9321:9327 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 691.036365] binder: 9321:9327 ioctl c0306201 20000140 returned -14 [ 691.054088] binder: BINDER_SET_CONTEXT_MGR already set 09:17:15 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x40106308, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 691.077209] binder: 9321:9331 ioctl 40046207 0 returned -16 [ 691.107852] binder: 9321:9327 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:15 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r2 = dup(r1) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000000)={0x2, 0x40}, 0x2) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 691.158113] binder: 9321:9327 ioctl c0306201 20000140 returned -14 09:17:15 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x7a000000, 0x0, 0x0}) 09:17:15 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="cdc2b64a283c86042b99000000000000000000000000000000000000496d46a85aa3"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x0, 0x0, {}, {}, {0x8000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 691.216948] binder: 9344:9345 got reply transaction with no transaction stack 09:17:16 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuset.effective_cpus\x00', 0x0, 0x0) r2 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x6, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) fanotify_mark(r1, 0x20, 0x9, r2, &(0x7f0000000240)='./file0\x00') connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) accept4(r0, &(0x7f0000000100)=@xdp, &(0x7f0000000180)=0x80, 0x80800) 09:17:16 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0xa00, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 691.276410] binder: 9344:9345 transaction failed 29201/-71, size 0-0 line 2741 [ 691.285175] binder: 9355:9358 ioctl c0306201 20000140 returned -14 09:17:16 executing program 3: setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) socket(0x11, 0x2, 0x3) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:16 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6304}], 0x0, 0x0, 0x0}) 09:17:16 executing program 2: syz_emit_ethernet(0xfffffffffffffdc3, &(0x7f0000000100)={@link_local={0x1, 0x80, 0xc2, 0x4000}, @dev, [{[], {0x8100, 0xfffffffc, 0x5, 0x1}}], {@generic={0x18, "cb157d1d4affc6b9869c3775839d48b638051b8b66948041573b32156192cf0d1e0eda1dd6bbdccc02915f3470daa79c95ae0341d8875034092f8eba679f6d685b27f2f78921e989a7ba60e1d900bb89e307637901dcebba29d35ce673de82240a37622b520c5b6bbec6242a232f2c813ad2970b1983a83044e0407586c19a6c60efbe4ef08142b3703c4d782346ce2dacb58e091f73100cc045b88d591cce5dec83015b746cd3d757b226894b11d4321ecfd5509b32659c1a3742da12a2de6f4fae2e8946cb0d7ef0ad08da0b442060e2e0da3a25d0f00c"}}}, 0x0) [ 691.325210] binder: undelivered TRANSACTION_ERROR: 29201 [ 691.336285] binder: BINDER_SET_CONTEXT_MGR already set [ 691.358167] binder: 9355:9365 ioctl 40046207 0 returned -16 09:17:16 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="0100000000000000a9cc000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000100000000006000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000140)={0x0, @dev, @loopback}, &(0x7f0000000180)=0xc) 09:17:16 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046312}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:16 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x700, 0x0, 0x0}) 09:17:16 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x40000000015, 0x1738, &(0x7f0000000000)=ANY=[@ANYBLOB="1800c8d3265e000000000000000800007110140200000000859f002000000000"], &(0x7f0000000040)='GPL\x00', 0x80, 0xfb, &(0x7f00001a7f05)=""/251, 0x0, 0x1}, 0x48) [ 691.476895] binder: 9373:9378 unknown command 1074553604 [ 691.488049] binder: 9373:9378 ioctl c0306201 20000140 returned -22 09:17:16 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6306}], 0x0, 0x0, 0x0}) 09:17:16 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000180)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000d9fbbf36c10a68a2ac27b740b80b05197498010642c1c50dcaf16e161538b01eb49e0dd7010810614c284e078240304de8585babb87fd68c250b117a5ca18b52e25a48526cb2a30683faeee299e7b3cb51fb661d92c7188e57968b9ad4da607fb4300aa043c8ea4f66ebc8a7dac0a1e9b38ada965ad9913961524254273b8bcb471554d8085582"], 0x48}}, 0x0) [ 691.595393] binder: 9387:9390 unknown command 1074029330 [ 691.603202] binder: 9389:9392 ioctl c0306201 20000140 returned -14 [ 691.628235] binder: BINDER_SET_CONTEXT_MGR already set 09:17:16 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x17, &(0x7f0000d1c000)=0xa, 0xfffffffffffffda7) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000001c0)={@empty, 0x40, 0x1, 0x2, 0xb, 0x0, 0x200}, &(0x7f0000000180)=0x20) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0xffffffffffffffe1) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000100)={{0xa, 0x4e24, 0x9, @empty, 0x9}, {0xa, 0x4e21, 0xfffffffffffff978, @dev={0xfe, 0x80, [], 0xa}, 0x2}, 0x5, [0x8, 0x800, 0x0, 0x9, 0xfffffffffffffff8, 0x9, 0x5, 0x5]}, 0x5c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x806e20, 0x0, @dev={0xfe, 0x80, [], 0x1d}, 0x9}, 0xffffff82) 09:17:16 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x74, 0x4) bind$inet(r0, &(0x7f0000000a00)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0xda9, 0x4) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rfkill\x00', 0x101d40, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000b40)) getgroups(0x7, &(0x7f0000000b80)=[0xffffffffffffffff, 0x0, 0xee00, 0xffffffffffffffff, 0xee00, 0x0, 0xffffffffffffffff]) fcntl$getownex(r0, 0x10, &(0x7f0000000bc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000c00)={{{@in, @in6=@mcast2}}, {{@in=@broadcast}, 0x0, @in6=@loopback}}, 0x0) getgroups(0x2, &(0x7f0000000d40)=[0xffffffffffffffff, 0x0]) gettid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000d80)={{{@in=@empty, @in=@local}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000e80)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, &(0x7f0000001600)) getresgid(0x0, &(0x7f0000001680), &(0x7f00000016c0)) getpgrp(0xffffffffffffffff) geteuid() lstat(&(0x7f0000001700)='./file0\x00', 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000017c0)={{{@in=@empty, @in=@multicast1}}, {{@in=@multicast2}, 0x0, @in6=@local}}, 0x0) getgroups(0x3, &(0x7f0000001900)=[0xee01, 0xee00, 0xee00]) getpgrp(0x0) stat(&(0x7f0000001940)='./file0\x00', 0x0) getgroups(0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001a80)={{{@in=@multicast2, @in=@loopback}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@remote}}, &(0x7f0000001b80)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001bc0), &(0x7f0000001c00)=0xc) sendmmsg$unix(r1, 0x0, 0x0, 0x40000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000280)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000049000000e17500355176215e31994d9c439f35384d8c785add4f5ff0ed1a7f6906dcb8e575af9035a88bdfefe586770385ee936bf469f6fa3a9722379de4e3cef0f341e9bf29cf9f060ddc63e2bf4cac38e3bb03127ae4443fa6c67403ee80b78696a75cbbb4c62d977a52a67b2a2a9b5b6993abe1181aa300feb59e4c5d77794f8b4081fe4ddcfbfaec2ed5fa9e59097e0b990dd77a0d25fed4f52a66b6194e2f87c60f8a99c6a97de5356cddd9f5608c8a93897e1d4d82402dbd"], 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open_by_handle_at(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="1900bf09db15a6cc5db53e272404ad9126a137fca0b5a74c8f"], 0x240002) write$binfmt_elf32(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="7f454c4600010000000000000000000000003e0000000000000000003800000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000004000008e519901d693e390c2849abe6b14901a84289395a7196030fff7de511ccc5ca776ea0a02af6313726d11f153dbdce8682280ec174c6b4b2f2c9604ba3dff44c037d1e369823e4f636d2df139a6c59c22a869e8bd40509f64fece7a5ec56bc4c27ff2332b4bacd980500a913659920c86fb44a56bf1904002000000000000fcffffffffff5bb74e26a78691bdb598ebd56ba8ec43d720682c0cb95fd592bf78b89ad06ad52e86f4fbd326642cc979f8a127ce739a8fc63637842b1cea8d47155b1fe7fb0321821d7ddff463c66d0742284cd44d1bc871221c507b0052b6e25ef45b2ef4bd5b442a6af910de3aad5daca68629f36b6b05ce536d3db1d62ee8d5e38f48a2917c03cf1bf551d467907ba8524e488309f3465444b0c9faadaf073b52c14a7ae18620f65ca6def202785da2b1e10b5ad6483ad6b0c22e71899d744948caafafcc1d5c19a48411cbc3bf3c9083500a10c19753db23e7d520db66d9a759ff30f3bb"], 0x1bc) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) [ 691.640645] binder: 9387:9390 ioctl c0306201 20000140 returned -22 [ 691.650426] binder: 9389:9395 ioctl 40046207 0 returned -16 [ 691.657580] binder: 9393:9396 unknown command 1074553606 [ 691.670157] binder: 9387:9399 unknown command 1074029330 [ 691.675706] binder: 9389:9392 ioctl c0306201 20000140 returned -14 09:17:16 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="007f000001000000000000000000006995a200f2cdc2b64a"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:16 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x68, 0x0, 0x0}) [ 691.698690] binder: 9393:9396 ioctl c0306201 20000140 returned -22 [ 691.720112] binder: 9387:9399 ioctl c0306201 20000140 returned -22 09:17:16 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40086310}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 691.793043] binder_thread_write: 10 callbacks suppressed [ 691.793057] binder: 9393:9396 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:16 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x840, 0x0) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:16 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 691.847109] binder: 9393:9396 unknown command 1074553606 [ 691.863271] binder: 9415:9416 ioctl c0306201 20000140 returned -14 [ 691.879107] binder: 9393:9396 ioctl c0306201 20000140 returned -22 [ 691.902447] binder: 9419:9423 BC_DEAD_BINDER_DONE 4004630400000000 not found [ 691.929484] binder: BINDER_SET_CONTEXT_MGR already set [ 691.938018] binder: 9419:9423 unknown command 0 09:17:16 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40106308}], 0x0, 0x0, 0x0}) [ 691.947852] binder: 9419:9423 ioctl c0306201 20000140 returned -22 [ 691.958833] binder: 9415:9424 ioctl 40046207 0 returned -16 [ 691.971198] binder: 9415:9416 ioctl c0306201 20000140 returned -14 [ 691.992656] binder: 9419:9432 BC_DEAD_BINDER_DONE 4004630400000000 not found 09:17:16 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x7, 0x0, 0x0}) 09:17:16 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0xf, 0x9) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/exec\x00', 0x2, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 691.999883] binder: 9419:9432 unknown command 0 09:17:16 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100004000000000000000d80ccdc2b64a289968"], 0x48}}, 0x0) socketpair(0x5, 0x80007, 0x3ff, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000180), 0x4) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000004000005a34a59932ac27b7"], 0x48}}, 0x0) r3 = gettid() ptrace$peek(0x3, r3, &(0x7f0000000100)) [ 692.075466] binder: 9437:9439 Acquire 1 refcount change on invalid ref 0 ret -22 [ 692.097996] binder: 9438:9442 ioctl c0306201 20000140 returned -14 [ 692.122686] binder: 9437:9439 BC_INCREFS_DONE u0000000000000000 no match [ 692.131819] binder: BINDER_SET_CONTEXT_MGR already set [ 692.137226] binder: 9438:9448 ioctl 40046207 0 returned -16 [ 692.150571] binder: 9437:9439 unknown command 0 [ 692.157143] binder: 9437:9439 ioctl c0306201 20000140 returned -22 [ 692.158008] binder: 9419:9432 ioctl c0306201 20000140 returned -22 09:17:16 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0xffffffffffffff59) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 692.164285] binder: 9438:9442 ioctl c0306201 20000140 returned -14 09:17:16 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x400, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000180)={0x10000000, 0x2, 0x7}) connect$can_bcm(r0, &(0x7f0000000100), 0x10) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 692.340440] Unknown ioctl -1072143302 [ 692.367850] Unknown ioctl -1072143302 09:17:17 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x4c00000000000000, 0x0, 0x0}) 09:17:17 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x630d}], 0x0, 0x0, 0x0}) 09:17:17 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40486312}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:17 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x100000000001, @mcast2, 0xffff}, 0x1c) 09:17:17 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000600)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r3 = fcntl$getown(r0, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000200)={0x0, 0xffffffffffffff9c, 0x0, 0x1, &(0x7f00000001c0)='\x00', 0xffffffffffffffff}, 0x30) rt_tgsigqueueinfo(r3, r4, 0x2f, &(0x7f0000000240)={0x8, 0xaae, 0x40}) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000000100)={&(0x7f0000000080)={0x1, 0x10, 0x200000000000000, {}, {}, {0x2}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x4040801}, 0x0) 09:17:17 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x74, 0x4) bind$inet(r0, &(0x7f0000000a00)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0xda9, 0x4) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rfkill\x00', 0x101d40, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000b40)) getgroups(0x7, &(0x7f0000000b80)=[0xffffffffffffffff, 0x0, 0xee00, 0xffffffffffffffff, 0xee00, 0x0, 0xffffffffffffffff]) fcntl$getownex(r0, 0x10, &(0x7f0000000bc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000c00)={{{@in, @in6=@mcast2}}, {{@in=@broadcast}, 0x0, @in6=@loopback}}, 0x0) getgroups(0x2, &(0x7f0000000d40)=[0xffffffffffffffff, 0x0]) gettid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000d80)={{{@in=@empty, @in=@local}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000e80)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, &(0x7f0000001600)) getresgid(0x0, &(0x7f0000001680), &(0x7f00000016c0)) getpgrp(0xffffffffffffffff) geteuid() lstat(&(0x7f0000001700)='./file0\x00', 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000017c0)={{{@in=@empty, @in=@multicast1}}, {{@in=@multicast2}, 0x0, @in6=@local}}, 0x0) getgroups(0x3, &(0x7f0000001900)=[0xee01, 0xee00, 0xee00]) getpgrp(0x0) stat(&(0x7f0000001940)='./file0\x00', 0x0) getgroups(0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001a80)={{{@in=@multicast2, @in=@loopback}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@remote}}, &(0x7f0000001b80)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001bc0), &(0x7f0000001c00)=0xc) sendmmsg$unix(r1, 0x0, 0x0, 0x40000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000280)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000049000000e17500355176215e31994d9c439f35384d8c785add4f5ff0ed1a7f6906dcb8e575af9035a88bdfefe586770385ee936bf469f6fa3a9722379de4e3cef0f341e9bf29cf9f060ddc63e2bf4cac38e3bb03127ae4443fa6c67403ee80b78696a75cbbb4c62d977a52a67b2a2a9b5b6993abe1181aa300feb59e4c5d77794f8b4081fe4ddcfbfaec2ed5fa9e59097e0b990dd77a0d25fed4f52a66b6194e2f87c60f8a99c6a97de5356cddd9f5608c8a93897e1d4d82402dbd"], 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open_by_handle_at(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="1900bf09db15a6cc5db53e272404ad9126a137fca0b5a74c8f"], 0x240002) write$binfmt_elf32(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="7f454c4600010000000000000000000000003e0000000000000000003800000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000004000008e519901d693e390c2849abe6b14901a84289395a7196030fff7de511ccc5ca776ea0a02af6313726d11f153dbdce8682280ec174c6b4b2f2c9604ba3dff44c037d1e369823e4f636d2df139a6c59c22a869e8bd40509f64fece7a5ec56bc4c27ff2332b4bacd980500a913659920c86fb44a56bf1904002000000000000fcffffffffff5bb74e26a78691bdb598ebd56ba8ec43d720682c0cb95fd592bf78b89ad06ad52e86f4fbd326642cc979f8a127ce739a8fc63637842b1cea8d47155b1fe7fb0321821d7ddff463c66d0742284cd44d1bc871221c507b0052b6e25ef45b2ef4bd5b442a6af910de3aad5daca68629f36b6b05ce536d3db1d62ee8d5e38f48a2917c03cf1bf551d467907ba8524e488309f3465444b0c9faadaf073b52c14a7ae18620f65ca6def202785da2b1e10b5ad6483ad6b0c22e71899d744948caafafcc1d5c19a48411cbc3bf3c9083500a10c19753db23e7d520db66d9a759ff30f3bb"], 0x1bc) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) [ 692.958523] binder: 9466:9476 ioctl c0306201 20000140 returned -14 [ 692.960992] binder: 9465:9474 got reply transaction with no transaction stack [ 692.976221] binder: 9471:9473 unknown command 0 [ 692.982691] binder: BINDER_SET_CONTEXT_MGR already set [ 692.989351] binder: 9471:9473 ioctl c0306201 20000140 returned -22 [ 693.001040] binder: 9466:9478 ioctl 40046207 0 returned -16 09:17:17 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = accept4$unix(0xffffffffffffff9c, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e, 0x80000) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000001580)=0x0) fstat(r0, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000001640), &(0x7f0000001680), &(0x7f00000016c0)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001700)={0x0}, &(0x7f0000001740)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001780)={{{@in=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000001880)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000018c0)={0x0, 0x0, 0x0}, &(0x7f0000001900)=0xc) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000001c80)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001cc0)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f0000001dc0)=0xe8) getresgid(&(0x7f0000001e00), &(0x7f0000001e40)=0x0, &(0x7f0000001e80)) r11 = getpgrp(0x0) stat(&(0x7f0000001ec0)='./file0\x00', &(0x7f0000001f00)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000001f80)='./file0\x00', &(0x7f0000001fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = gettid() r15 = geteuid() getgroups(0x7, &(0x7f0000002040)=[0x0, 0xffffffffffffffff, 0xee01, 0xee01, 0xee01, 0xee01, 0x0]) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000002080)=0x0) fstat(r0, &(0x7f00000020c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r19 = getegid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000002180)={0x0, 0xffffffffffffffff, 0x0, 0x13, &(0x7f0000002140)='self)vmnet1}cgroup\x00'}, 0x30) r21 = geteuid() stat(&(0x7f00000021c0)='./file0\x00', &(0x7f0000002200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r1, &(0x7f0000002400)=[{&(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000002c0)=[{&(0x7f0000000200)="8d8d53fb0394ec8e0a79b46c823e5ea6627f3d12ca43749c587cb057d5bc0fcd40505613ed8df553146c1832cbd4ae26689cf418e30443e52bfa41a0f4e240d033840173538face2dbbc0762801489720326c33a761c", 0x56}, {&(0x7f0000000280)="7644643b88239690c645e8ef680c2d3702a097aaf6e38272089b75", 0x1b}], 0x2, 0x0, 0x0, 0x4000}, {&(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001540)=[{&(0x7f0000000380)="947e3b20d0bddbbb5398f16d16bf54e9bca20669ff7fc9dcd110ab1fba44a9e86301ca482dc5173bcb7aee73ddfcb6a12ea48a0a8ce599cb483d508ab6c3df11572691a06429b8116e4eb971b559253cdf889f9280b23bbf1b5530fa7d684c13412587cacc014a9bc73ceee1ae7f2443b4bbcf9cd7eb479302ccadb63e28734aebec939a0b1a3d97223f6b55d4d800d010a50a7fb9f4d6cef4559360563f04b9a7e7ee92ff9ad0c320ce8cebb316655c4c2e6f3bc91865a10254ca17147094b7fbacac98f5409e8fc140839902c6dc914b02c6df8e0514dbb789c114eea8ab27660d5d21175ec6260a202fedcfd4d8dafcd5fca98d927d38063f6bc7ff491eae6bdc26933349ff468234110521d2acf90cf82c7f3fa407137ca96ff7cb92fef9fd4149c21d10c2ed3bf1d1603f76fd042a04e923d8cd34585854683cd255db1fcd660a279d19522530c39c6ae04ba573c6368276b3e861804aab11b4bc8d5bf4573ef5031604f28b5fda50ca42ab6167b442b9b9d0cccc088eb413c60f61baca5bc6f280c06f33c43f6c3c88b580be00b72bd35fa2a67f7c79c157e71bf23ffe4efea5a6729d3b8e7ab3935e6b63e73a6235ce9fc5093ab7722ff5f80fde3e51bb3c4d9d6dca9b1a2c6c184346e40685fd5d8a65b7a05b06e64ecdd794055bc91f557b7a4b114473811908fe26b8ec1fc3be8a0d79ec1ad6f34a708600bc61cd2d104215dc59662b5f6fdc5fe0e24e619397d76834282b3f17b6b91279756158dce7b534e1bfb891867fd0333241afd36419b78d265898e684ccb717492fdf093162078aba83c318dbcb5d03b17920fb1d9dd77354c46623c9d9d8878ad0243af1015753348ea4b4193c192774117618975ea8f483dfe0c39c0afa0a0fec94c5697f8ae77fe70797827c28f1c3c503e96ee6d17e65593a7c0290f7f34b9492162748cc37885bb8eeca32320d41412f1f86ee902658ad5c57e3abae11c7b7772960ea009aa110a502f36010a4773321f30d8bd92488b55d9de7da22566bba2ef27191f89680f4387e4551a3a2af95d66b6f2ad5356f22df39c8157a5f3d2b729407b15189a849af3ba57f36239c6519aefb9c4c0c2d41fa69802986f0d0759a4a0e4030cca9d2b7ec7f9b4fbcd95507ac5aa2c74439f69b701a4794bedcdd6915e1c13aceeced7ea206b3b986eb2109dbdf2e0b951d37bcca5746935c4dd0288bd744300abc530be957dadefa5936c931331e8096f73ca2215d8834e4ba720b7459e020c50446cd1cb46e6b39810df0bec952a263b4b34060ecebb9fa469ee5d14f790d6f98b87f6b3f9efad83ff108584ca9bf801feadb039adbe7ef9a9c35865e7cf2a72a4a39bc323376f0bc281e2c6b1aa3d0676d1833b60727200631fe7dbaff0b9993bc799d0a2462d7d729bae61e45f19b3dff70b13f9c39bf94ef94256915d047d2aab05aed5c74e5c22566d5cad5511793e301226a9a774502dab7d4eb493abad6c95c27d5986ccdd5d7fa98a899a6e76d04d89e3b4d72e4c2341f2602d61c13557e691c8a2245bb76c8fc2cd46bcfb3bb06c472ed7639ba434def36ec2243e7ee83631b3933a6733f9c31bb23aead6532e89323a011ed5870ba8fa519e8526256b0cd28a12dbb662669456f8d106e471d9d2c51e86c85b46960172121d1dd5ce677cc1b2b49ee6b746799036e27ed6234fedb4845182585a8642bfa59a3fcf40fc49ef53fb3025b0110b4cde4067175870b0ed5c72c3d85dc51ee87abf60122b86e049bb0dff8eae6091a6c638b7d71f3ce387c2e0217ad6c693fe12eeb7c7af6f5ed3be471a97a00c40e1b13fa3b29f52f0293069b6d3b9c3a4ec6bfca70f22738e5f5837b3fef7924cdc45fc46dc26f33674301f7eed88804c96c2aa02f26dca6821eefdff0227a989f8e50d80c8b3535b73232048183e7e85d03de25f478fd6b4269f1239ad5205cfcead3382e7129e8ece345c02477e8dae640fc537b5637ead513bfefcdc6ae7767ea47e02c8c58f120e77036ec98438f7e2731c7df5a359c403204a2f271d6723bf7502c66fa94a3412462bfa63c3b9cf371489e31aab63fe8332324137ebc71955e18da3af430b1e5fb7d7398bccd0c840ead05cb76bc5427c3443366bf93cd0fb8d94e59b5d6f9cff0866ad93f89cbda6ae671fa16297239781a29da569e74c18c8bed6b9c64d2f88716cc604417364a6c9705a166742eeb34c67c8c2a64bb66b9e0639bd760406c9cfcaa9b452177a288c36b5e007ee9d1726763cec60143eae7b11b3b6d264c58c2ba289f85110ebd09a3211fde36e58fa48ea6ea44a84dbd27d9303c885bfe8dac0469689db0d831e7340df2053a8510c27cb28efa4ee3738fd9a23ae95b1088116131d48ffacd9d69c164f3820ac20eaa0ab6f1626040bc5293007b9a61fa0e2da93d5c36bfc5a928199314547ef7be7b570932e6d96d581620f504649249638845107c83394b17af476b3d91a4feda872939dabe26137c121e1c4de913e8a5102fc9e8cf1faaef3089b6aa3f2ca314fb3a75d54ea622cf4891d3d32e1405bb7f9040ae83baca6e1b3088e17a6002c7383b19276154cc032f73087b28718304b3600402697b524211afe286544664db1c7bf495814e3be4051341dd51cfb765ff747f113b2f412518d22d95326214883c3364a29f492029d103df4a140e38789540fce2877ef7147df14a2264c041f410284358e2c17e9c91aba1d06138a2c811b96a8a16fe174f9d2f09c9178fdd2e78f051534f289a5cee41cdef28b7c1f441af8c39d84bbe449b7887787806a363005043137d92bbb07c6048043d3d6bdb043c7c801bc1bfad55699c4b3c4f685d227813d72afaa0365e8f73f79683c4e64bbd15d11e4ea43badd9fd768285531baab2223bbe415ba13f5df0b13fe36ec776bae1b110eb999417e7c37d8a6efd39dfa3a3be6af4502987f66b7c122c46fe45acd3d6f56ed9dab1353f7e377c994648e6c6c395368b0b1c6009975c4d1555618655331e4d29a6ca770d5706c4092f7f284fd5afaff1ceb0063ecafa045b9c9f0994a9bad6938dc1d6a445bf42fa6d3f11cd264742e5b1f4e08c2183a52dddf0bbc4897959630660fc0aa24f4a0914307588318b59e8ff01b96b76f063e7a0e9a18fd6655de5a3001061ac260e466683e899d0e22609e51ecbb510d47794506869b9e1c355c3a2e48a534d3fc24d2d57b6ca76ceff344f86f7a485a64cd779be544da2d1f7980af7c383f50158926ff001ae78325e0af7ceae5498d87d9480c5e80f58fa83eb83bbd272442f37a1e91e7fedc78a7d43afb40deb2810d4d1857eef1f27f8b60bff70f233fd201007cd287e8692fc09eaebf8ce8229922022a97612ce96e23f26bc94d30b49c4ff611190d65ca3da411d72389e4b3b6c0c8088c0c0d6d290791e0dfe39e8b92bfccc93d7b830f6fe86dac300ca52cdb74247adcd431436a19984f761d666e068e7804958e55046d7b53e6919a2d95c7106af0989af86c360cd7e01d22e4f9dd804ec24d44e432f1f8687b7a7df5b76ba5f86dca67fca214fd93a86d768ee1ad0156ba479acc29ba242f2554e855bb486e28b5fe6c240e074e54ed27e8fc1bb15847b506a10a79cca6b54874cc4b2abadc34dd31e7c3b87c3f0a3a5705627cd9f7ce194d009fb8cebb53367e403d7b0829a12a5269b0009884a2a9819505927777931f4fe91c6492199ed6a8fe4eaca80e5f6528a3e50a5e1a14598c5f64505afe53ccd5c994d8cd83ee1651984844a2c33c7d8cb71886c8e73d63559fc1cd5aa69455f2b647f41c7e1a2a6036ab6fbe672fb113fab8f2665d8608cf840488a4a50888f939406a96d2ca4a1576a6ec22e7d3de2d0ad196f93015c09e027fae0207b362f31d8853673529b2f0810f949a234a08b2d68f8fd06b313488e4c251ab9b4ccc5ee73a61163348b2f66648a71bffdf35c603d353bf4064852515828aaff90f6bbd56ff3cc3a5de44f8be905b11ffd2565f1fae70df9b00f5497ae71d9b9f329d1bcb84d1daeccd6c1712566fb4433cc49fd89eabfe2af5817f237511773d0c76a5cf011ce08bd99b190bed6ff744ff3f0484b349841b9a3e42d12d9eb221355e75439b68204eb9913461a8f1d82436601b56bf14710c3c19c388cc9b381ce1ce558b93913ead2228a4245252da97cefc44f4b8b77f8d2e113983767d70bed3f2390c63e8c3050c3585a7a69dbaa6cfaffa1622be9e894e9397462b333c28f8eceb82c51f3b1b17394a72b6366eda103f6ef08ab15b0925f9a68f1c924456ec777435e5ff683e0761412e019dc5c00629a0902aa48abe82bec05cc45f2593f474b41b1840df1337062f52bb499b1af99806a5c325499b85eb77edb87deb50b21f9b4352a06938168b634f2242b3840d0cf5086d99df7e853ad295f3f3611b0d745f6bf248d02d404a79d4decd7f9fe30ae2c9cd186b4578f1840527aeb84f0a05e00f0e7ff049640f0a9e0be86ae70e773648fc17a73a79109696de72e9963d7360ab1f8ddfd432ba6a0103c4b4d9474428158c2c15d146a3cdb9b6d9ca6db71ed561695ad10e53d70f78201e8bc0240ca61e16b1f2d75e8894f9f7f18c0e7395798eeee0327caf902bef8acdf6689685a3f4199df6687e6cd91c3010dd033012f5b6e4972f7533863041eecb09641800723d385c5cee46d6f545b6a632de58ff52f0fab187550898356748f7370972118f95b20180e4d3c5089ef0cd514e7dfca59ef93a6a735e867c77824291255964f62ac3330baa7c9f602590cdde00406bf43f7983cd18217b912b3d1ff34040d38832bfb19934a2756ffc5f8ec68f0ba051d20690be399a71b02460399e8a9569158e7fee1b013ead89e1aba777ad741a32bb1ad6f474a69032ecf692c6166add5c0f571da8c565b1dddf227af1c14fed0339326cb7ff7c6fbfab29be2ec99cbb9398aaed667b4c96b82d06e24fb11e9950418636f0ac6882fa3debc025b26e8efc28a36fec6e966328f87ac2ead826fc113795483b289122813b6f1aa89c0f7507ae7e64245d866d19a6bf5f89dd66411cd615fb515923cc7e9bd3615d028e431585af894ac5e8afde50aa75203fe65da454b4ed1c981e2e37cec56f97718decfd30405433806cf5158919c6a98d9cddaadc1a3b71131bbdcd61c3569de429e0fc1ed3f4425fd6f1d8657a62a3f7c504ee90739ec4c03ad1c82b45fa99b01702562507403c4425026f68924b9a50aa30bc783ee916218ca1ecbc246f2b84ba7922a054fa5589af892626e067bdc39aca395e58273ae91fdf86bcaca21ae4cc32b6d0419da220e0f074d749d20d38df8ccaa218ab26da8a4734b40571d94e3854d25c692d7169ccff29d8a0d5665335df3a0ba683442f18f0742cbd3f9c321c5f11ad63ab2981cc5edc480539785faae4d660f94f62783485d549c53b2fadea1c6f239808c2bfe1b8c6669d5f7fc0a7f7d20475d205ea66048f691ea0ddc6b59a51bde2bb559af4e74a77dfa262c78473a3d1c77fc96706ad36f444133ab19e1f0ad3386719b7ea01037417f634e6d38ce1f6d05b495ae80c59115ca16c1609449aa0a20473a8854360c8e8a74917bccc915f5f61c38acaa179e1bb3370f3c5905b7fab4a9392c0ecc77d7a026f7bf0aea89c34220286f530a46336e3b7fe97130cf91ff16bed6e7fcbe63b632126852e04bd610fd73c92a124d510e86ca291e51b4a8023ac65780438d05b8d2f4d586b1ffd236d921809ffec207b66ebc13091de91194f48a9d0f6df9", 0x1000}, {&(0x7f0000001380)="0ec2f2f98440a1baa95e18c09f6063403151b4e7d815e6fbabf1eecb2ec2c14fc4e373a6de56a88b53b42dbf6b236c311ee5f9420856462409c5d8f0d0a2c098904c2d6c1e6f61dd3f6bd7612a982884e624c8c221245fbcd5fc42053f653cdf090f2aae510ce99c03d8468acd6e57508b339f90281802b2121fac65cf3968cd15273bd995f8dce9c91c6cd1236288018c6f4a9fce1a392f2207fe02a93b854c11dc1707c75bb1c5daf408e5e9ad417e6896cfcbd7c907671e978dda61ed5eadb7cf385b38087d4b1a6bf369b11d0c5233828eb431c0d9d53fc4f0209c720ab4916d34e5d4a33a655290764b05d3f8", 0xef}, {&(0x7f0000001480)="67b1b64e788e731913026dc88293a869b79e036b84438687967a38c48b293cd1ed5ffe9d1bc3c8b96565353d8036cd291e5f0862c853a34f643a0c85df55324931986c702dbf2822a6ca4a787ad2647bd999fc708b881699cd1abba49c83b9563d47435922faf905599ce27e30ae7f94722fd1b51b873f1d5996a1931837beabd51ce7d299149a1f64acf4a365545a0ab0bfd7863960587368a3f7", 0x9b}], 0x3, &(0x7f0000001940)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @cred={0x20, 0x1, 0x2, r5, r6, r7}], 0x40, 0x80}, {&(0x7f0000001980)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000001c40)=[{&(0x7f0000001a00)="004ca3aa27dc1182e9db8f3b4fa919f0eb72ece0884c7391615dee23a6f9ef302886f174f86fa1fec7245a36db04027d1999862f0282431a6e8454ddeff69d928eb239350e9a8f8df3cbb3b743c44a5fec7ad2070b9c8eab2492f23fc458d42bb9fb316ba2494f3fc72169d201e737e56e99c2ab916515262606c7853794ab46ac4fc188e413cb5812c5f9fc46be61ff337c4a45b8b1c6782ee9875962e2dc1b3151b372905decc9c7ded0d060d4843a534cb8151eaa422630633846b852d79066dbebc7199deda0707abbac77a1", 0xce}, {&(0x7f0000001b00)="96cbac1b02eccce2921ad384ca78408fa11ed124ead0258a05d2af7eb99cc28b318c073b8f90bcc2052d5858f918474925afdb414119d44140c561813c1e0d18a01a", 0x42}, {&(0x7f0000001b80)}, {&(0x7f0000001bc0)="ec84cac19cbaf607f23947914e26689a46469b64246285fff35dba7c5f8e388ba185479488bbd1b575d18fad4e9cae0dd83672ea412a202042e3fa0ee3da547e146725c1f755b894d14f754270ef1f216f98c638367570936ab17fe431bd6952ca8f3154948fa09c0c9c2e2fd5eb9dbda03f8b1160d07c330b4d5ea4a7dc85be", 0x80}], 0x4, &(0x7f0000002280)=[@rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0]}, @rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r11, r12, r13}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r14, r15, r16}, @cred={0x20, 0x1, 0x2, r17, r18, r19}, @cred={0x20, 0x1, 0x2, r20, r21, r22}], 0x160, 0x40000}], 0x3, 0x800) r23 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r23, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r23, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r23, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:17 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000000100)={0x1d, r1}, 0xfffffffffffffe70, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES16=r1, @ANYBLOB="000000d3effe86000101000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 693.001870] binder: 9465:9474 transaction failed 29201/-71, size 0-0 line 2741 [ 693.011711] binder: 9466:9476 ioctl c0306201 20000140 returned -14 09:17:17 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630c}], 0x0, 0x0, 0x0}) [ 693.066264] binder: 9465:9485 got reply transaction with no transaction stack [ 693.096231] binder: 9465:9485 transaction failed 29201/-71, size 0-0 line 2741 09:17:17 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x7400, 0x0, 0x0}) 09:17:17 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) socketpair(0x10, 0xe, 0x1, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = getuid() sendmsg$nl_netfilter(r2, &(0x7f0000001380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001340)={&(0x7f0000000140)={0x11e4, 0x9, 0x4, 0x2, 0x70bd28, 0x25dfdbfe, {0xf, 0x0, 0x1}, [@nested={0x11d0, 0x70, [@generic="a9b8f209a2f83e25548097b720338d1b70f4add19691c9d6ba74c91f194e57034cce5a08594a990d67f32b6027bd83c219675dabb539762d99610067f70c77174aac200206845a10f888834d7861c27fd91f0fc1b839b132914de29d5272e4041da7408aed6848b69c3576f6", @generic="d53833c302e9ab62fce02e9a731b6afa3a644c166e51ae229528cb8781d062d639e5b0b4d7115388d2f03364c84326e81e9d97c2abf86322ad6691543f5b0a7dbeba2613f395f4f228c71e0ab3eaed4c21fc3258846970accf14a111674f3fd488b3e3b896f136507f71495566dc0039bbd8e94196e0f0db7e7639d4fd1a912b59e217c00bb9bfc021b4b43503c8b07a548a882247e2b7410ab6c3cbeed9aa35392a21b229851f84c943e70544c42c88a3f9d8e9bb0a4fa6f0238531eebf69d36673dff7a3528b84", @generic="3d5401ce7f5fb764873a8ef245a4fb468045510ba3691057085ade2ba55e5c6af004141ba3cda55253bdad74c2d4483ed6d3088cf7d38f55a0b69fc07cef29e63f893704b3ccfa9d30aaa286dee911810b0afd91", @typed={0x14, 0x4d, @ipv6=@loopback}, @generic="27e6578359632ed3e5241002553596bc61ecdc22b98a8b78057257ec74269754be8f77747fab5464b7c53e4a8bfa145ff93493500f58720902c988f17fd73cd88e1c3e70a598b7c0336f65cc1e91aaf2fb2d2891038a37e87c805608567974fb187eec9fc0afe68e172c410fd1695bd7f1d4b33b9fd4769c0750c991aaa038240428e70de0058a9c51f1244dfbfccf3381958f60e3014cc981a32118327512a1bb925caff920984d4422d4d4a32c32f6ec18e3b89b66427335ddab1c75fd228a7c829e05774d220360ab521d50f9dff4211037a23713c15324e94e764b7c49125df022608f43a2ea5dfa0038cde3e355476747bac7cc345749e6e319b3774b11e8031675a88fd8c0bbe27eb3985d9dd016a0481a0233823e959d5ec235e683795ab45ec027d731cb03f2daa0a2105c0d4a265a3f4ab7de1767a171a0476b28afd3149f8e8a74a488775478aa87a8a2c35a5e7f15aa8b496c9844c3ee9f0fc40eba3f5311b0a121fa9374e379b5bc0bc93a74886a5e7ad6fa82ac2034389888668bdbc1005c9c06ce2070c07561be424a8b5467bb9593e84333422775cd6c46259a5d96c81bbceb8d5f6194fd96a9afe69ed5238708db385958fde194f657e067fab5c85d0c26ef65bb1894ed262bc0ee78552cd33fa26ed42de6cad6e793e0e538e63cc04630ecab0e2f38f5666e017b001c5af6c703229a8eb08585d1ee3720a94835c61a7e30bb91d7d928beaebdcb57390eb9dfb9e6e11b9a0e2312f5c78dd52bbcece7a886d5fb421220977d245a4d63415594b62cd281a3b3568fccf79c97822a0d0c44550fc10a274f8a58ec34b9d1a6e4ba2a2d8081d0dddcbfd571caaab1e2d878d85e2e91a947182435cc26fa97620c9c3b19276ceb6158a04d11ca58b1e80816b2df8dc0c0f7ab2e4cf8819a1f2bd159cfa50998a862404d9d96d067cac50d544d541cb3980f4606775e4252c3ef9a5353a4680db66aeb760ba4c7658b75e336ee6a4f859a0db2fe522fd13caef0673182c2f6b584a93f8e5f50c51660630dd8ca3fbfc65233c6d3b6c7627bc74620c192fa6d4f30476b6a7910bd0d5ccc53165f5067bc628429b103e524388d00d12d5df266983df44e25e138394df53f860601bd468c6db75e1df1e9e99e0dcdf4ffa9fbaabf4ab95e9de08f814b6fc3d19936a089cc82db813a72213e03de3cf1d9409b9ff5a423dac6d56ad537cf464f7392ebe9620083763a5ca6876bf3cce40cfb16f4ccef6b7dffa7ae26db595789e3cd071d1a478b0369fd5b5cf0b3f132c0f4c9472e31613e1757fccc9639adb646fd571d5e1052eae8ef61f02fe6df6f989dbaed617686ae55cb861981a5d49f3b754e37ddf12f20a782d4df3bedf5d35e0ce9ecfca5ce464b87b8baadfeae4d043851e36776fa0bfed0aadb1a7e1cf9a0c10d7202edc7013319dc61bf129062dcad1f5acfe32dde151a5fae9330e3d42f4eb8a9649ef67b80926bdfd900ea0df81cc2ad7f2d2a1a7ae6cfb18f7ac87f2975d6eb2c57449ef2fed722cfdacd1425ec550ad9f83f20cd9f5b909ea5658bd4bbd12e395208ad6f7192ca8739a457700afb2d77cecce18983a0c10f468925085a7306837124956b02e97bb227dfb48d92d01237de1002fa2302fb8a1caeec400fa089c0ce9e1acf6199f2de1bc0fd7716048a515680eb97048bb59d3c1d67e0737ed9ed3bed11bf59b90ca211bf5748f7cc4b96a98eaae421f281b0e4b270db559cbb223e49cf6db94c2d9024f60b853e9aa9adf450fd92440852d9d8d0071ca941e98bcab648a895a011a5df8b7047f5dec00a1134ce79925b2e25aface3b580152d1039cea3e9b9e1c43909141ac3999e3d447251f5cdb063a88dca681c8fbb137832286db879caace611f387a14a68359c3d601e1755ba6152ea16fb8fa61f59a43a2163aa99dd5d68ec6af97cea24238d91be7bb9b15496cb58880bd1b56271946a6b1df1c2c1bdeeb64fcd9026c6a100733bd0428755eb8789801cdf5d883d905cf03daee28aa54d6b4eed4723e1996c0c9c4fd88df09f9dd01b0d9a3d12b5fa2e753046c102d9c385e48b91facc5de1d971b1276e65e125ff6ef6cb535feb983b02268d529248ceda086e953ee372b702ad42b2ccc8163de08257b6004f86c9da0f3268548f109e8c878e160574c69ffadeb49e370a86d0f8844f240d02e33f3791bf899affabddd3f94fe75803b8f21e3f597625be991db22fdc7327ac869be312b89c7c856b10a73b186c54e19e7aee2c336b8823a5c6642ded286258da378905625130311c20647a78d73cc679288867ff78c4f98bf099d03f28cba3ce872c883afc4b1d346fcb429504ee770ff0c2958597d892724d697fcff606fdb1ce58b7dac2405e77bb62569441cbb39217889c110a4d3e1a44f2d0d9c203f410d3be1449bf4a20bb27d775727ea439402cc9fb57baca62c3e90a0e0994eb6ed2e052fe061d2957e1934cdf22835e247122774b0520b1548ed3ea89f4afa5df6d3385a1c8121366baf459a17fcecd05d9d81f5afbca6cdf44aedbaaef6f8a834eb4dae7f074f8f11628e1b7dc981cd94d7ae8c63ca3ab8d805cc2856a2a3df5bfda30680fc63072eb2a42a83b62b1c256338f34104be184d845e97843341696ca2a45a474dc0029354ba6f09d341e4018e448bdd4dbe38c5f41d0115e2e5851f48962570ae932a6bdc5f9adea02c16ae112fa7d7d07acafc5c13a345f25bf01f041192f4efe6184788441f120195e3b99ee2e76cf2f7da2b162d15ee63b602558cc38ec46abe7aaa607afeb4dc4e72682a19139cefb14e0eb13afe34727e115ceab97e6ec1a7b88517a39d79f305a8d6f461c22408e7215df6a1468be800c9bb4ce13b4f9e7ab57a1fa21d8d017903f4b7acfd47a5503b3048b10673bbde182ff084d50a1bccc46a3c992663be93ce76528258c0f5edad9161697d88330f70772887c0f548e36f45b5b64301ba90eb0acc188721bdc8f46afccac995f3cb2388b3043c29c64daf12364cc788e48a9dc35c509f943ace786f92dd0f615ab360180507608476eda8f6a333b1ff8b732104313c9bbce30a8ccc470f5d62012af4705c425b21af98d17c06dfc52a1b4065e7cde6e4d9ad722074addb12e1a8371387323f490c7ff6199c215dd4a352202da4ee03338650ba4729b3fd7ee131868b5aeae29cb361a184850b75645e7369ff00690401d7ec4aceed5bafa08cda62d0c5bc7fef6e581ecead042c1a9aa8a339eb23d6a25be4726c59b93cbfb9bd40ba112098f1993c475bedbdb0183e5dff722aec803a50a6c1e902fadd89bfa27580ec8b7262ba939b6bc6d63f5ba5ce154692aead4813005e3c5c746e459dfc1887be3316351842e434a3a096e2c682c418b10ab8b3e8c08441e9ffe0ebbe819ccf79010adf96e3c9efeafdbe4ad8e3185847b6916b2acf3fb5bec2cb9a54a36acf1ea747bd882fea394f606193039d2d4057b95f935fefb7e665ca9e54087b74ad188c183e3299b015753f1cd4e6338c48a1dbce0c86cab8cc1da93273b798d74f663b0383e2298b1623894edc2f1d58249c8a92ba6d3e2cade098aebb66aa7378f321fbf8f1cdf49257217ac1b212be1c6fb8a3dcd2662239e4ca2a0a7e50aaf8b6bea2ab1d0a5f2cccc4a7f18c082fb8d42a4435d14a7a461d28abf48aac6f5c5cd46afefbf86f46f0a688478cc55b4c755e4da66b91c4f962681ccb43b687c08373e9ecd69db5d84c0e91eb5717000d3f5b206dda687e247d64a70a9e94aaf41935efc2dfa594fe7e831654aa52401311fb69cbd584815b41447b467dd8539f70df8786a41e3e756b6515cd54f58e659b373e696b511445260a2a0786deb0b5f36be579599d8eda1ca2922748830937f9691bbc6901121fa8424e7e3fa9a3a45da93c42837463bf6f515b21ff2ab9db7092d6c066fca6475d22d6b0ed4a01d880eed5b46a061fa8a4b06dc8c6b7105b46ea16c5a663ee793022345c69f936355eaef1b05cd88fce6b429edd6cae7e5fe6c9e238fbc75188d0ca43993302838aa3c6c7079782cf0f41829cfa67e4ab7fb550e632db46c74ca2a0471521efa620f8f53dabfe7a60620d9e82a763e6e072e46a2635d158fa1f8188be5ba8a7c1113dd84cb9aa11c46bd23d7cd5589e06c5e099603069919e97e95c1cd6071fd33c9e945e145f60f0482180a01104931ee63e1e179a97024a9af9c9baa3c96d7d4c98a16c46bc5f85c7f5ccece08a5ae761b0bc1fce49edef78da0d9e40a8d55272490448b29022e0fd1d669d175147f1eb6aef146711b32a22722aebbfc569f9c882c8505ee04125e5a7beb5ea4e0a9a5991d072359411ec7573430466444b5428d76f18596f567963b85d072a8ff631e8011cab887b15949d679db6566643ede48aea4dd45286ed75122f9662a68b37200536713435c420af97f04e03a4db6daea1b159d7f0dfd92e7e1d620937d00c05d99cd2101210b4453c27a900f81edfa721970543402085c6e4398a3a53c850a54b720e2e042467d1948e21f781c7fa53aa4b986c38d8e88f3e71a399ab626c588adc3ac9b6245a52b04e4be3c79c53a26a280afe384cea96998bb501bac97abc97c91f46bf2a83f32cacc78b85355ef0a7a07eef73dedc5dfbf0623892f8e8646da2c01e37118e224188ad1affb4d772bae275c8754038959787f840a543cf850fc121bba004865bffd1b64cc8feb08db58749dbc322ec0928056a4cf94d835d91f31b815a717621a5f6cb36d423aa8f814d6f3efceec503fec2cfb581102f6e7761baa4c108de3aa7f8d083bca853b81edafaeb3a556cd55005c904bab526b488b876f04bdf591950b279dbf26e155aa4db5d3ee891df1f97daf505af766eb67103d0010a91b9569127c2bd4ce743047c0279a5a0c323b954317889ec3d37bfb4808e63b300258b3f8596c5894183555dc8882944268667f132f5bfcab81f481c906ddc47326c6c1f47e76da98beaa894e482b96873965620998220198c0b3f9a17e0e8810266c5aa18c66958762586f8cbc72f8f3769bfb2e199b1ae1e9b1590c28d0cdacfeb226f422bc1ae228068367c07de0b35cc7c18dcc240a7a0607149d54593b9a29bc616b65613224bbfcc51eaa5bbb43b6e8398430e2c8ed61f057ea5a470f21701372eea82851f7ae8a226c7b0aaf5e6ee85f95de31e8e4701f59881009efd26cae018646c0d401eee0e139101d656c533017657ecf9d2244626775053c8448d3f46bd4e216b599d5af9a0ced82287f806db86379a79387417483afd36bf69d172cbb992352d6559dbd9610e587f439c2e93a8a19ece9585576cf22fd89a49f87bc28f9a43fddeaa6f30df11d3ae0cccf940a599724b260a31261aa30286ddc0552ae4429113e803efa57b328429b16991a5475da271cbb4deb05323858d43d98a19fe0ec5615e01b1053dabb0b559b55674be2453e69b28ef283145b2c7088f28e928d0584775f6a10811b8c4c962960097b678fef90c1ab02d7f11f8ecdd326da01c356e0dd15648c9f7e46e29c12abca8bf272b37d8eefff873588360af7c32de57bfaaac1d4ed4c77cd25cd3b1e92fe2f582b1654ad36c8ff12f225c57cce6e8f8419eb12d7cb3d763d69f40a709812e197cf3b27b78fbd25b5b73a93b5632aec466bb47119c3c262335d87104d6b6d2c172a6ffd28c0e6491d80ea45e9cb58f56127d813cbad00c384f5ec13c2918039d84afe3644d60d044bf12ee3fc6238a687846cf22790ead289448b35a0189a96c6cd", @typed={0x8, 0x66, @uid=r3}, @typed={0x14, 0x3b, @ipv6=@mcast2}, @typed={0x14, 0x95, @ipv6=@loopback}]}]}, 0x11e4}, 0x1, 0x0, 0x0, 0x8000}, 0x1) [ 693.125025] binder: undelivered TRANSACTION_ERROR: 29201 [ 693.130681] binder: undelivered TRANSACTION_ERROR: 29201 09:17:17 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40486311}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:17 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000000640)=0xe8) sendmsg$nl_route(r1, &(0x7f0000000740)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)=@ipv6_newroute={0x48, 0x18, 0x800, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x90, 0xffffffff, 0xfd, 0x6, 0xff, 0x1, 0x900}, [@RTA_UID={0x8, 0x19, r2}, @RTA_ENCAP={0x24, 0x16, @generic="be4841a61278fc0c72a59a2e2c6a4b9d8540ee5c6a4050ed37f70122a48d"}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x40000) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f00000001c0)={@dev, @remote, 0x0}, &(0x7f0000000200)=0xc) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000300)=0x14, 0x80000) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000340)={0x13c, r3, 0x200, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x120, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x4}, 0x50) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r6}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="010000000008c3cecd05f4f75e9f0000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0xffffffffffffffff) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r6}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 693.191185] binder: 9491:9493 Acquire 1 refcount change on invalid ref 0 ret -22 [ 693.240648] binder: 9491:9493 unknown command 1074553612 [ 693.245779] binder: 9496:9497 ioctl c0306201 20000140 returned -14 [ 693.254457] binder: BINDER_SET_CONTEXT_MGR already set [ 693.261599] binder: 9491:9493 ioctl c0306201 20000140 returned -22 [ 693.268069] binder: 9496:9498 ioctl 40046207 0 returned -16 [ 693.293347] binder: 9496:9497 ioctl c0306201 20000140 returned -14 [ 693.314613] binder_alloc: 9496: binder_alloc_buf, no vma 09:17:18 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x8000, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) r2 = perf_event_open(&(0x7f0000000180)={0x3, 0x70, 0x2, 0x200, 0x9, 0x7, 0x0, 0x743, 0x0, 0x8, 0x37, 0x10000, 0x8, 0x3, 0x9, 0x687d83dd, 0x401, 0xffffffff, 0x8ab, 0x8, 0x1, 0x100000000, 0x6574, 0xfff, 0x1000, 0x0, 0x2, 0x0, 0x81, 0x4, 0x1, 0x2, 0x6, 0x8, 0x9, 0x98, 0x80000000, 0x1, 0x0, 0x1, 0x0, @perf_bp={&(0x7f0000000140), 0x7}, 0x14020, 0x10001, 0x81, 0x3, 0x3ff, 0x9, 0x5}, 0x0, 0xc, 0xffffffffffffffff, 0x3) connect(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000300)=0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000340)=0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='keyring\x00', r0}, 0x10) kcmp(r4, r5, 0x1, r0, r2) ioctl$VIDIOC_S_JPEGCOMP(r0, 0x408c563e, &(0x7f0000000200)={0x1, 0xe, 0x37, "561ded57a526a53e256f66c9a803e6ee2c749c008c13f4e781d559ab771b01119c8524bf32a1931c0cb24d2bd54e494d799f8eb23bf66add5ad1ef5d", 0x29, "78761f01d34dfad1e1f345743351449a004fb8a90d4308226f808ff045be8252da24988ff80da68800115f592a98e08a679b687bc47158b7809b9b0c", 0x40}) 09:17:18 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x2000, 0x0, 0x0}) 09:17:18 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r2, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x808800}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xe8, r3, 0x700, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x203}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x10000}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4f}]}, @TIPC_NLA_MEDIA={0x58, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400000000000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x38, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'ip6_vti0\x00'}}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'ib', 0x3a, 'ifb0\x00'}}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x40}, 0x8000) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 693.345963] binder: 9504:9505 transaction failed 29189/-3, size 0-0 line 2973 [ 693.400592] binder: 9504:9510 transaction failed 29189/-22, size 0-0 line 2834 09:17:18 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6305}], 0x0, 0x0, 0x0}) [ 693.451241] binder: undelivered TRANSACTION_ERROR: 29189 [ 693.456830] binder: undelivered TRANSACTION_ERROR: 29189 [ 693.501514] binder: 9513:9517 ioctl c0306201 20000140 returned -14 [ 693.516041] binder: 9519:9521 unknown command 1074553605 [ 693.525017] binder: BINDER_SET_CONTEXT_MGR already set [ 693.542609] binder: 9513:9523 ioctl 40046207 0 returned -16 [ 693.553479] binder: 9519:9521 ioctl c0306201 20000140 returned -22 [ 693.569513] binder: 9513:9517 ioctl c0306201 20000140 returned -14 09:17:18 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x74, 0x4) bind$inet(r0, &(0x7f0000000a00)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0xda9, 0x4) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rfkill\x00', 0x101d40, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000b40)) getgroups(0x7, &(0x7f0000000b80)=[0xffffffffffffffff, 0x0, 0xee00, 0xffffffffffffffff, 0xee00, 0x0, 0xffffffffffffffff]) fcntl$getownex(r0, 0x10, &(0x7f0000000bc0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000c00)={{{@in, @in6=@mcast2}}, {{@in=@broadcast}, 0x0, @in6=@loopback}}, 0x0) getgroups(0x2, &(0x7f0000000d40)=[0xffffffffffffffff, 0x0]) gettid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000d80)={{{@in=@empty, @in=@local}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000000e80)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, &(0x7f0000001600)) getresgid(0x0, &(0x7f0000001680), &(0x7f00000016c0)) getpgrp(0xffffffffffffffff) geteuid() lstat(&(0x7f0000001700)='./file0\x00', 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000017c0)={{{@in=@empty, @in=@multicast1}}, {{@in=@multicast2}, 0x0, @in6=@local}}, 0x0) getgroups(0x3, &(0x7f0000001900)=[0xee01, 0xee00, 0xee00]) getpgrp(0x0) stat(&(0x7f0000001940)='./file0\x00', 0x0) getgroups(0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001a80)={{{@in=@multicast2, @in=@loopback}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@remote}}, &(0x7f0000001b80)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001bc0), &(0x7f0000001c00)=0xc) sendmmsg$unix(r1, 0x0, 0x0, 0x40000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000280)=ANY=[@ANYBLOB="6d616e676c65000000000000000000000000000000000000000000000000000049000000e17500355176215e31994d9c439f35384d8c785add4f5ff0ed1a7f6906dcb8e575af9035a88bdfefe586770385ee936bf469f6fa3a9722379de4e3cef0f341e9bf29cf9f060ddc63e2bf4cac38e3bb03127ae4443fa6c67403ee80b78696a75cbbb4c62d977a52a67b2a2a9b5b6993abe1181aa300feb59e4c5d77794f8b4081fe4ddcfbfaec2ed5fa9e59097e0b990dd77a0d25fed4f52a66b6194e2f87c60f8a99c6a97de5356cddd9f5608c8a93897e1d4d82402dbd"], 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open_by_handle_at(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="1900bf09db15a6cc5db53e272404ad9126a137fca0b5a74c8f"], 0x240002) write$binfmt_elf32(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="7f454c4600010000000000000000000000003e0000000000000000003800000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000004000008e519901d693e390c2849abe6b14901a84289395a7196030fff7de511ccc5ca776ea0a02af6313726d11f153dbdce8682280ec174c6b4b2f2c9604ba3dff44c037d1e369823e4f636d2df139a6c59c22a869e8bd40509f64fece7a5ec56bc4c27ff2332b4bacd980500a913659920c86fb44a56bf1904002000000000000fcffffffffff5bb74e26a78691bdb598ebd56ba8ec43d720682c0cb95fd592bf78b89ad06ad52e86f4fbd326642cc979f8a127ce739a8fc63637842b1cea8d47155b1fe7fb0321821d7ddff463c66d0742284cd44d1bc871221c507b0052b6e25ef45b2ef4bd5b442a6af910de3aad5daca68629f36b6b05ce536d3db1d62ee8d5e38f48a2917c03cf1bf551d467907ba8524e488309f3465444b0c9faadaf073b52c14a7ae18620f65ca6def202785da2b1e10b5ad6483ad6b0c22e71899d744948caafafcc1d5c19a48411cbc3bf3c9083500a10c19753db23e7d520db66d9a759ff30f3bb"], 0x1bc) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) 09:17:18 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046302}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:18 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x8000) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x2) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x101000, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x200) ioctl$RTC_AIE_ON(r2, 0x7001) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000100)=0x1, 0x4) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:18 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000240)=@nfc_llcp={0x27, 0x1, 0x0, 0x7, 0x101, 0xfffffffffffffc01, "aba381f6e8fe82e34d15b1042ff2355417d04eccb71d338d63f4c652313cd957f4b0a43bb16c278cbdf2eb74f9e3cd5c506ba777ad92c34ce8f8a0f860f61c", 0x2d}, 0xfffffffffffffe52) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x80000, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x4000000004200, 0x0) fanotify_mark(r2, 0x0, 0x3, r3, &(0x7f0000000100)='./file0\x00') accept4$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000040)=0x10, 0x800) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000300)=ANY=[@ANYBLOB="010000001000000000000000000000003e34a53167403fbc9e15425dae560ed3d0ec88d30e6afa7175ac5802b5d9a04a6cbeeb3c72f57e5668cfa020735195b2c19b467c3cd44cd7df3f48b8b1f6af55fed9f84d323b4a2083f40824f37ca4defd676aa154703f02aef92b52b9650cafac5df70800000045066fad0b969a31854ada93ae86395f4856ebe8e6efe5db7a12fc009191b1af07000000be62ff78a8177d707b912810b229fb3f06b232070000000000000031cd3a47bf8cb9fc8d800458586ba9e5e48860e935ae23eafe6267d7dd3ab540990d0d6898a58db59ecd36afb5ffc70232da43", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f00000000c0)) 09:17:18 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630b}], 0x0, 0x0, 0x0}) 09:17:18 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x5, 0x0, 0x0}) 09:17:18 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000000300)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {0x0, 0x0, 0x3}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = accept4(r0, 0x0, &(0x7f0000000140), 0x7ff) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x18000040}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r3, 0x0, 0x70bd2a, 0x25dfdbff, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz2\x00'}}, ["", "", "", "", "", "", "", ""]}, 0x2c}}, 0x20048045) r4 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x3, 0x1) accept4$alg(r4, 0x0, 0x0, 0x0) [ 693.934692] binder: 9530:9531 Acquire 1 refcount change on invalid ref 0 ret -22 [ 693.950218] binder: 9530:9531 unknown command 1074553611 [ 693.956330] binder: 9530:9531 ioctl c0306201 20000140 returned -22 [ 693.963267] binder: BC_ACQUIRE_RESULT not supported [ 693.966087] binder: 9534:9541 ioctl c0306201 20000140 returned -14 [ 693.976849] binder: 9529:9540 ioctl c0306201 20000140 returned -22 09:17:18 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 694.010687] binder: BINDER_SET_CONTEXT_MGR already set [ 694.039085] binder: 9534:9546 ioctl 40046207 0 returned -16 [ 694.045115] binder: BC_ACQUIRE_RESULT not supported [ 694.061690] binder: 9529:9548 ioctl c0306201 20000140 returned -22 [ 694.068299] binder_thread_write: 14 callbacks suppressed [ 694.068310] binder: 9534:9541 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:18 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630e}], 0x0, 0x0, 0x0}) [ 694.105674] binder: 9534:9541 ioctl c0306201 20000140 returned -14 09:17:18 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x630b}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:18 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)={0x1, 0xfffffffffffffffe, 0x0, {0x77359400}, {}, {0x0, 0x3}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x1000000000000000) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 694.158101] binder: 9555:9556 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:18 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0xfdfdffff00000000, 0x0, 0x0}) [ 694.207438] binder: 9555:9556 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 694.214930] binder: 9555:9556 unknown command 0 [ 694.229285] binder: 9555:9556 ioctl c0306201 20000140 returned -22 [ 694.309856] binder: 9561:9564 ERROR: BC_REGISTER_LOOPER called without request [ 694.338906] binder: 9566:9569 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 694.353983] binder: 9561:9564 unknown command 0 [ 694.371923] binder: 9561:9564 ioctl c0306201 20000140 returned -22 [ 694.382290] binder: 9566:9569 ioctl c0306201 20000140 returned -14 [ 694.403765] binder: 9561:9571 ERROR: BC_REGISTER_LOOPER called without request [ 694.426876] binder: 9561:9571 unknown command 0 [ 694.432622] binder: BINDER_SET_CONTEXT_MGR already set [ 694.440210] binder: 9561:9571 ioctl c0306201 20000140 returned -22 [ 694.443927] binder: 9566:9572 ioctl 40046207 0 returned -16 09:17:19 executing program 2: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40486311}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:19 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x538) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x7ff, 0x187) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x80100, 0x0) ioctl$DRM_IOCTL_AGP_ACQUIRE(r2, 0x6430) bind(r0, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @local}, 0x1, 0x0, 0x3, 0x3}}, 0x80) r3 = dup3(r1, r0, 0x80000) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000000000)=0x10001, 0x4) 09:17:19 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40486312}], 0x0, 0x0, 0x0}) 09:17:19 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = accept4(r0, 0x0, &(0x7f0000000100), 0x80000) recvmmsg(r0, &(0x7f0000003540)=[{{&(0x7f0000000140)=@hci={0x1f, 0x0}, 0x80, &(0x7f00000008c0)=[{&(0x7f00000001c0)=""/235, 0xeb}, {&(0x7f0000000300)=""/50, 0x32}, {&(0x7f0000000340)=""/236, 0xec}, {&(0x7f00000004c0)=""/159, 0x9f}, {&(0x7f0000000580)=""/80, 0x50}, {&(0x7f0000000600)=""/253, 0xfd}, {&(0x7f0000000440)=""/59, 0x3b}, {&(0x7f0000000700)=""/21, 0x15}, {&(0x7f0000000740)=""/112, 0x70}, {&(0x7f00000007c0)=""/214, 0xd6}], 0xa, &(0x7f0000000980)=""/4096, 0x1000}, 0x1}, {{&(0x7f0000001980)=@hci, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000001a00)=""/101, 0x65}, {&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/185, 0xb9}, {&(0x7f0000002bc0)=""/230, 0xe6}, {&(0x7f0000002cc0)=""/229, 0xe5}, {&(0x7f0000002dc0)=""/202, 0xca}], 0x6, &(0x7f0000003000)=""/219, 0xdb}, 0x5}, {{&(0x7f0000002f40)=@alg, 0x80, &(0x7f00000033c0)=[{&(0x7f0000003100)=""/244, 0xf4}, {&(0x7f0000001b40)=""/5, 0x5}, {&(0x7f0000003200)=""/46, 0x2e}, {&(0x7f0000004040)=""/4096, 0x1000}, {&(0x7f0000003240)=""/129, 0x81}, {&(0x7f0000003300)=""/132, 0x84}], 0x6, &(0x7f0000003440)=""/229, 0xe5}, 0x1}], 0x3, 0x40, 0x0) sendmsg$xdp(r1, &(0x7f0000003780)={&(0x7f0000003600)={0x2c, 0x1, r2, 0x2b}, 0x10, &(0x7f0000003740)=[{&(0x7f0000003640)="83eb1043630b5447b99223a7065797de31368640dc30078a06bf27a1ba9b82ff393b613a865023638fe1831b9dc25f371a9b585d73a459ed09830426fe103def2b05c5", 0x43}, {&(0x7f00000036c0)="1e6e88d6d5bac0fd7d0d3c3059865880bd6ebceffc38ee2c393481395a165de38dc8b8f1067cce34b148f85dd999d0a970836e661e0751800faf2bb4ef3a2b8967f2924f08963f237b9a5c1d067225e20be81c0d15613f53ea8e18e9e148bbc9e131d9c089", 0x65}], 0x2, 0x0, 0x0, 0x8000}, 0x801) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:19 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x6c000000, 0x0, 0x0}) 09:17:19 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40406300}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 694.568078] binder: 9575:9576 Acquire 1 refcount change on invalid ref 0 ret -22 [ 694.592053] binder: 9578:9579 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 694.596855] binder: 9575:9576 got reply transaction with no transaction stack [ 694.601857] binder_alloc: 9578: binder_alloc_buf, no vma 09:17:19 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x3, @empty, 0x40000000}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 694.620925] binder: 9575:9576 transaction failed 29201/-71, size 0-0 line 2741 [ 694.631777] binder: 9578:9579 ioctl c0306201 20000140 returned -14 [ 694.643053] binder: 9580:9582 transaction failed 29189/-3, size 0-0 line 2973 [ 694.643267] binder_alloc: 9578: binder_alloc_buf, no vma [ 694.660237] binder: undelivered TRANSACTION_ERROR: 29201 09:17:19 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x20100, 0x0) sendmmsg$alg(r1, &(0x7f00000070c0)=[{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="5231fca4a981d741eb3ff5086be0d7f3cfa49dd9956873ba8184631400365b5327894a3c620db81ff5", 0x29}], 0x1, &(0x7f00000004c0)=[@assoc={0x18, 0x117, 0x4, 0x2}, @op={0x18}, @iv={0xc0, 0x117, 0x2, 0xa6, "a0e02875e80f9093e71576ee76a6b4ff5d956501bd2113d19a55fd2f3497ce948005c90142f9610c1746d29d0bd8957683f1cef92d2f0ecd3ff3bda54f72e5bf4ef4b09655cdb604474b4713628eaec4b9a958deadee39cb9fa0376b88f16afb05a4fbc985d60a315b842a00e76e8bae2c58dee7d492affdeaf8065e7600f87ab13a1915ce280661d220cc4547bbdc8013972ed222da8c12a711e5d317f386c2d0f4f6f9f3ad"}, @assoc={0x18, 0x117, 0x4, 0x80000001}, @assoc={0x18}, @iv={0x48, 0x117, 0x2, 0x31, "91cb205d93961fe1c17d88db01b86da61837cf14af80cedd45a5f87d4dd092073fde9437d873ccdde1cea37fada120aa54"}, @iv={0xe0, 0x117, 0x2, 0xc5, "aed8c499ef87707ab92915237d921490145148357a3cb60d5a7de3a1cc62f972d8f986f155c6c206b3458d78c29daff558b6a9655fbaee041f00075dd75bd4b663fb292100844b938a7df0a2862c1f2850cee173e6cee8faf67aef6ed720b0c742036e03d1dfc0d9b8d90a4c01de6abb68e545a2ebe0df1f8a1f4056a55f5e0c428cedfb3fdf5d030b262d95eb65ad1b8530ebe547f33644483708eaf37c0a8574103669dc40de38dc8e25cf5bf7a10007b9598d4fc888597a5a49816300e20c051fc0f652"}, @op={0x18}, @assoc={0x18, 0x117, 0x4, 0xff}], 0x278, 0x4000000}, {0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000001c0)="16aaa0f7ea28af14a6cf0d766cc3068a205f3867406554d2fb693a62ab6ba32fdb7b244cf3f6762c5d5af5cbb0eb3b778251831461b635e2170cd5c32956c3b7062e6415638dec3f58b95086047130e5f3a49deed6f54652821b94318bec59e44232224375f0e198abb2d13f92e2d4c49ee1f33fce8e38e75e3e2137df9ebb13c82c0593e53f1df22f14581eb9ff01bc68b61c901c1f67e9a44f2b47c8d06a4cc01fc3ef54116f6842db08ec9e00325bb99654d493f6dbd70df2c540225665183e7467887186b1fbb4ddb3402166531576fca898cb7d6a335f2a197396abefe0d671176e592faecc7303e52e75779246fae9b8cf89d376012564f21cb3261a", 0xff}, {&(0x7f0000000300)="296ef48f2b7ebb3318b99d50431ae90fb0fe6dea202a", 0x16}, {&(0x7f0000000340)="234495ca685c402c7eaffb41d4e693970c8486f7b6d7ed60f863e77c38fd5251efbe5df0712d9d6ca615bbdf26bc83f1d00f80fceae998fa8573f7230b211937d861052a9d8c0bdc6d0285751430c7c08cafd8bcebec8111b67a4e64ae758d8074bf3f83f46ef2b93d047d67fc814ec692b299c8d03746bf1a24fa916627aa510e2b137ce55e34191503f519eedaf915ee4e7b16f8c483bd72e5adc718cea296f7f0be0139b990f1298bf6f104f90e7711d4acd455bbc5a187b0c155926f9aab9b3b17e042844e1c585f0e81d936310ada4d4f85f92dd84f8229c215f36f5ee4c54dff96d29d9f48", 0xe8}], 0x3, &(0x7f0000000740)=[@assoc={0x18, 0x117, 0x4, 0xffffffff}, @iv={0x1018, 0x117, 0x2, 0x1000, "17d77cd68a79c0176402274ffee5874c05dc8bbb83e1fb5694a121c75c2023ef38b837ce7eb6b59b61365c2066ffe141373aed420469063c2f4f80a1ff10ee83709caa8c46e549ba608e4baf652c7f12958990e4ad230bcadb2f90a39c67904afdc5731cd25758717d6a296cf75308986610ce05adf17ac2086b58305ffab70646f2061af43a607f085611f0e97551ceff9b5b23a7103ae920773056805cf96f89fc22ef0b49489b096f2ba1daa75f582be7c73363c74673cb9fe228d9c4829f1bacd0bfb7c3de50421b4557af90c09c82c05986c6cdb384a7c7b9649b3cd448f9a0de3977c7f725296278d2aab79b4619f1c8a393992a58cf774b82c67f5b4f68f274dc0eb7a46c56c3a566a685d88cbd7e5fee5c3c7574f4184248b551fafd48ad755638ee155a81ae15b8724b01fa604f2790fd2c82289e4764d197f845dc2af00977167b6b2ba0226c34c81a92da99990a9e1c716404ed7848e8ffa84769224588fdcece4dd1abc352d43966d0ed8b2a432218142b3f051477aef3ef09df85c70932ec29297715595a178e4f6ce4a4b2981cd5d3601c02f9272170e6603b66fa20cf1acb1c5b035750915baafa857b66692574815d7862cafcdb7a96934bda3d9d4281c875bb004c13a1685db9f191d4ead43d1fc05f9e09adf8f07761f7e242db7d805733db2ff8d6e5781822327d12b6e22f91b6d21f3f50c74dc1b060c9d663ad515ab2f9fb656e3b41c7b915e05a1b00d2ffbb9d7acdd47a137adb93525e060fb0b1cee40e9fb47d5f96947f4c6505d464b9c84c8b8b886207f8442fd2b0d151531320f187830cb2d12dcbe37b7308e64375df6990e5728cf41663a9b1166f9517dc88c80614c746cd87f54c45ad010bdfc925e173cd8aaef55d5608a5c2f8c1d9cdaf8d756134ddadd5304119730a0d9cf36659c795fb5a287cd3dc804e3fde011f8dc0ab4da98c4eeff9f5c4f6decef22696f78b93fbecf9ecf5f74aee823b7dcdf3dae28c36f42e822ffa5ca9424b33fb8a7e27597d739b2063ffe398eede0f9d9ec8b6b0f9976e424661923e65828eba4154525f4e56417188ac2ea002c12b772cc0414ae02a6ead1adc479009c77597cd7d98dd8e4800c366d4c1b019d3c3b14ffeb8c024840ad3175e54abe4ccdd643676acc7044fba34de8e202a9f7d9c5bdff1ae045e331aa33e5d209a5364ea7d6cef69d205d2322d7d33d5f050169de8e2352d364b1812cca220281004ccd18d507ce0495d7d97c8853dfaba033afaf524a68f8885fdf9f657b757cc53f6ed5cf64ed4da33ccd5f3b15b3223ea2088081e077b34cac474ba576c758bec5b5066247b38f336a83595591b3b4cf4ad9c40f741bbdd683453c9d980228e119a4fa80cf8ef5a3a29e33862b4c265db2e745d73a0d881710bc3080407b17cb4c4b16fb9a0c2ded1697dce7dad5bb30d804eaa1645aba3f1aa013bf7031298c6774289f08f8a3d255ac102f8f419e5d28b8feb53cec9ac7ef7a5b9b4f7a9ab8557f28311ee0766b815fc6ccafaa02f296524113f656e82ad7c68dc665ca0d60dce0e532dfe30ffcbabf4ca0307348448a5bf9c776755d70e4799eb425e8ef1f0231559855d0301b05e93ed60f47e2e20b57ea0715f1c94c7bc132b48d1a3ff8f68f4c241af3218ea8df53e252a67291da6090d4d7dd1e08c05faa0d62dcf3a092e966771afecedc0bfdad8640882e5210437d82e2b90003a04302be29ec83c58d477c1216b0e468c5d91aad17e431a4fea67ff36825a2437e7fe147a7b28cd737721dab63b36d4db998896e48455f05bb6e33f2f65ee6b6b205977c442a43a8200a6e4a2a1d8a690ea96f63342f294d343443564d21bc03154ddf0fd559e5b3006871a6a7a2847201a1708b9988f978994f4904cc79f01fe265842cd5d3906b2b720666592c5bdd9eeeef08895fca39739463b136f49102a3a580ea74b983e4bbe3c8d1a1044e31f0e0affc0040fa8c4b4d465573d1d2886bb31ab4bb5a063fbfd19b4161e2721e481f0f2b968fc427d2cc4d3b3f0b3904b0430349b46c5bb8e082476fdb750d7b2be3278d4ac1d1f50a716789d9ee53705d28c7df88d1987b1f29188550f74ed7ed1ccb568dc59cc7752c99b68b1f393438653e861294b96103d465e4d0a5c8df00ddab06fac9f12eefc8040e1316f00985054df025a0f424cab1c08ba68582414a1b5b292ff8e99e81e409e265d7f40dae4b46f7755d0032e23ec502e532d55ea148d3fa5bfba7989a563fbba42fc9a52e3221b0f6a14435c3b04ae300fa6716b7bf5d6ef29114786016236ab1036b667db29e5f39a2dc31adac236ca9dac6f6beb3c5103c0306bc9dba9905ce4bcc3dbc4c8bff669af94ffb637e5545fa4d63e8228fca5ece5c9c8200f591a85a1d49d4c5e574f5a3e09118c7ff1d1e4ef7f3c40cf333ccfca0e604ea49bdd528f5e1e4baa75d6629d0e4266009cd6a1a0969699c0ec7277bc3a3c2f9303e772a43baa91fd14860cdce9346b150b4a9ac9de2039c47913c853693d1a4b94db1febe992eaaeb1dd3ee6a9418464f1efce1e30c07328b9e8853f304783844a334b69922844cc98515a3ce66d5fe0620934a30b9d6b8e86eeba6f20ed962322d38877643de92807bbcd8d2df1ab7f1936f017d834db7906a0655b70f9407b34131f7a1191c4f3b918946493472de605d783b7c6a1fdd25c28e62f01065e0f2609e65eddc349dc3aa6a21c617250f6130b852bdcddf2cd815786013929f34684adf360a2fd97c4f55adff29781e88674ebdf427bc28c3de7ec4bfdd64258c892601bf51ab9944f777fd50e15cc9ddbbfab2236ae6d284b6b79e50a61c217cc58daf4c92652c8440ca212dab73755e4aa220e9388bd9b84b77d824e5a15f83ec9fbfe2b15e3516d5fbfd884e1716191494b2cf69da8c462835efb5e375058fd0190d50524034cf12146020df123d80bda5aa738e764f5fa3575ab26b33937fa4913fdc8e791f154efb03951805e33f4702d2f156872189998b35be07b2971eb614ba6f1b02988bb7c61b0a8a71b1548369c6c438fb2477785b9a72d4cb287cc0c6357c492aa556d49b1f9e95d25f2af3e7a373b48f2508982fa601ba606d54bb156071f7ec0000eddec6cca5d752da177935364cb1ef36db41f6b267999e41f31852195a956eb7230821a0f17b0058f93300d8a6106f6e65337af40d7f1762d38a368e5117336e842d4297a0a18fafc20b77eca07a97ac4eaf887dca3d847aefe2fc3e231d51cf2d311bc8c5fe695ea10adeb7e6756b385aa2f8ae6e42f16fd6e9bda8a14e9533a39e6fc09a09e51f5d4a2306c9cbec3396398033c4a21b7dcf34dfee3e279610a804152945b1f4e4245e3dddbe921566b67b803a28e9ba9c7d08f1819a85220ca77d79a0422008d63db2f6ad7b2235142a402a0e1ef2ba0607b8106ff6cd47fdfc9e0f58e9aab93ead641076261fd39dc5b03211ad6f4481582c6f29b79321b58444f878e0d5186ef82a26ddf53593907af4348dcc49df061b5960e64f59011ac864883ff6da77fe9f7b53ce836a728489a16b11b1576c02c99798eea4daae2308cf55310b328e78a38bdce45c30441b840c8d663a3fd5e7ea9131721c89f6e701ec9eb1f5d8c5ebb9ade723ea4bd1204df1f0f92cfb8af284b2ca20537fca62a047f3d9fb3810bd5a990d289f83d35beb31ef15dccb86aa9cfc86c57be6402d0db7673ba74a00561fe01e087a17dfd1887038facaa535e173e440ff3bf3a8fb62b403ce413f02cf313fc86b6c16db5a3287235d1557bfe8ff3b1358edbfe157389a6109204c8377bba23b9ee6361ceb4547407a9c7d1a5dcfed309eef45352288c9454a27809e8b942b2dc5a0d91cbb30ba03002b87f3de73a29931d08dc15b6685febf0f8dae527fe22da9d173c0896652d75cfb2f5738c4c4e79ce938c1472fa94000f410825fea7d0b5d7dd9e33652aed11f917887399e03fdc4c05c3131ea4ac9333d8d09fd612fd78e33fbb0c228f8af065b841ab9041bc731c95902f4386f92e2743d447425858b6030b2ee2f961b3c0159129af43781175e3fd2e267793dc98fb75c6b48b604d9274003928edc862531693bb4f0491c2e3125cbe70d12a438fef933f3e6fc42ac2764a72bf39e6b52620142aed9b8eed879a9f14a7ef89247bd670a670d232241ed14c9e37780b8ce35ab3bba42ac8b9079c67c56b4ff6a70962c81614ebc0dcaff3104abfbae08f36e33e22d1b9495acb84ad2e5b428ba5a4520346e21917a40145415a1fb9b90940da1c983a61a804214672971cd1775bbb107a45df49cd53b1dbcccc696f761caed603891da8c5996b2e09f8f778b4b27c1e4b9d78f63b4e1f30a63fcac261ec8957d1c932556c20626d735068936b12895d0c382aa3457da5aac3bed9ca5a3815439e0301e0bbe74304aeee5f6eefb5c4733d79b4e700475638e73ee76640693f3cf8d4455e9f786f5b136ea946b7b481b0a3f177e9e2030188d06fc24ff03ad55ea74268899b6730fa72f09cc3b82355daa21fff962b607680d8d5d35a0d7b82478edb503f9a9e7cdc354f6e12ef7e4758fab91da32ca840a81a65def3528653b3b6262d522fcfcf6e2d9f01eafa1d744ad36b15e4b6cf108cf262d183b5c077facd01d5d6cb4d33dc4456cda85fc99b45a25313f58462f385a8404c70467e0483e22022de1cd742a52f1ff5f504cbbe26e0ec42605aa1f379c0d5ac0318e5b5349e8885b320cf6c270dbbf633224ddd8131b7f0307747be7aa97be7cec0e1e13b537fc477f1be4c3837d830d35e5a47564cc302a8b070be20a3e2548a5c00afdcfbb1129527dd945cfcfa5c8b12d49c180d98aa585c175bae16209138d0a7193af24f81b8a6561f9619ffb348491f621833ef84c1e2516b3c2855eafe777839e603516378a8a14473affe4c6637a676f80e4366b18d2d137d155e3d37754295da1349bdae6510bb9d678a370936e276e7f3f495f27cf2461ae0edd9e79f213e8975c106a4d23e6ab0a199515ba83097e7a13dd308fbe91e807b7ccfd93443234e01477edbaf8cff5a4b148f42184fe1cd99f60be3baccca52f0eed9d6853baefd49b2a68cba2526a0a71b1837a9bd37b87a80a29c572115ae822c74af3c6227f91a6c189935988e3111c54d5e297cf15c8133c992caa29a1905a048a6ef0c314be0696cc7421c9fc8199a5a093cd81ffa7974a84de3470e3b9cc7bdbe789c2b6de23fed1779be84cfff7fb3fc4b5a0525721df2c7364b01e354f2ca0d815f63001c35cf40a82555192a87c4d9b43cec765fb73964bfffda2cb196648dcf77e36fcc54a20529fc8826ecbfa5f4ebf7f338cb8b33a0b166998b0d29da27430c401e295c7e3159acecb80b7db0920bf4fbe0a97558320548be428674f45fd62a7825c2f17d6ea777c554d0ea8ebf577b9b1e071eebab84f03519c02a07e2c86b0397f3c7493bb2893af7f1f1d8d4f3fa8582685e965c5bcbb11803799fcdf720b805b950576de98bfd59054fd4d478d7a8ca4d2e629dfb281e37715d3694dd2e00d37ca311e6690c48c938fa964c71ae33113823c9c66935955f9dc59d73eef10cbd83fe27c81c506e1bf692fadf0b551d5d25d370645f38382e4be64d74de2d9659a53794e386838339bb84c52868c8b6afc41fde7fb06746f9fb7f1120d96318e728724d6142545bd6270e2277616b8ff00877acfe1d85aa9f467ef7769c0431e5874d44d9f7d1fdb28bc0722447a525740dad1d6082c5e8140ef57c280a44db"}], 0x1030, 0x10}, {0x0, 0x0, &(0x7f0000001900)=[{&(0x7f0000001780)="6d41d2da2c064d22866929a20a9bbaf5dbb20d210402ec56af68c5cc51bb408e9ca4f7333ec43f52f78c89b9c62df8a41be4cbd978f63183fb436e03699bc57c53b255d448fe8e0859438d595256080b78d5d52809189c25a912cc0a1229fa83694b019f4ee4befb9aca8886cbb2345e38b712d01b8720ac7cc4deaf84eb8fd53d7bb5fc463126a9873e259b7fea32fef1486b413642334f37ca3e6ca6fded6949f4994577f0cf89178c6eca5f86209d89d9032bb5359914961930e6", 0xbc}, {&(0x7f0000001840)="2f609356884ef8f85e915cd0bf30a8508ff89de4cd9a138dd97230f58f25bca255aa1ef97b43d0a22aa4037a147a25f9b551a455cef383aaa542aadcedc686d8de139cd2cf3064f6bb3bb76c71ad00ae", 0x50}, {&(0x7f00000018c0)="a560a9a3", 0x4}], 0x3, &(0x7f0000001940)=[@assoc={0x18, 0x117, 0x4, 0x3}, @iv={0xf8, 0x117, 0x2, 0xe1, "9a57020dfbf525223a9b657eb854cb9bc57e1f774a055d7c530aba137219b1af99955de46df1122d709ca108b1590802c7a7b5ab7276b4cb4bc0fb00ca1c5cdc6264948085b3ba2dc8fd778e025e14439353e468bae756ef6113c43955ed2c502a90e7c3150da214db5b3b0a509da8d9b61b83f467e92b63d89592840ae78b04401c40ba0eebfd9c652ddb68cf1b24dba62b2d23a6f1a306bb9e54346bceead6836f509c6468ab4cbae3f64f5531b0cd2531ca763f05b5e1908398dc81176c868a98c4d8f031eaff45a15aee5df5d0a0916c6d597066fbcfdc985e9afea93270d6"}], 0x110, 0x1}, {0x0, 0x0, &(0x7f0000001e00)=[{&(0x7f0000001a80)="885c9e2dcdd1da92adf2a8947cdee3ad04ceb3015c859d7c261dc11532dac46787094c52b2c3275f92cd9e122cdbad6f7f755d50b506565c38a2661d70796a2a706b3dd85b2ec0a415bd682948f145395d9d75526ec749d5a1d3bbf895fd1ef4ee", 0x61}, {&(0x7f0000001bc0)="bff70fe98469966ddb6322f2954e32cf91fbb83bc791a8a70ddee2791bd9f132f908111b0408ddf59908e683dec4d6d0ccf05b2e8b6381836f426ff131e7e88c166061d969265856339410686f3f0563538570dd467a11e1a18b6d8f416a0768ca07a2e8538bd7bd10e46f2b6968e2df2b6e2c822277fb9ce98df3062b03830e8009b4f1cbcf060b4068b53db14857dbc73ec53ad7e45e28fa7d873ea6f7e4bb9b320b740120b3cfd0d1739a48a8f8ef5c2d65301afceba1f20e", 0xba}, {&(0x7f0000001b00)="3577049154238249c1314eefa40bbaf6adc6eea75ce120dad59e403cd1de2784f99a560506abac2a2b2611c3b223461836f215b76fca927445215ee483a9b1ab0b9d24c8dccbef354b76a5b585d82923bad2ba9aa19266eb91648b93fd9dbe571307879a2cc1365a3edcad04", 0x6c}, {&(0x7f0000001c80)="332f4c0be4a9a1a679e875cf07c6788224e67530d9cfb803e336d6f7383a8e2fec31b205e9f2c3c56deaab0c11615c0de0fe4164779719c3c1af34f93891ec81537bbff4941b3232d017a0e55f25bfca6674b880880425470617dfe4c84c658999af0d6b9a8449d13285ddf109dccee2181a187300a2e5f067fa8a50cc00382692da63b3a571b57bc49e851c7a1c8b579197fe299f2a5396fb913bf157d39ebe4c49b78f7017debb4622b16239eeeaad14e50abbbf48ed4e8e3445043c0cad77851ff8438876dc162b60e8606b2d13aca2b764bfe7910278851cd99e3dc731ad805f0dfaa96559f20cf760a980", 0xed}, {&(0x7f0000001d80)="33700d847dc20124348aa49167406d1c34b564bc8ef189f9d9c15c4c276eb3a3597108a839a44eb763e111bec04c00d6209a38e4f722a459d79f2f6cf5562f7cfb83ec72fdf8dc482f0457866f3453f25c12cdd25f2fd2e155695641d81b0a07", 0x60}], 0x5, &(0x7f0000001e80)=[@assoc={0x18}], 0x18, 0x800}, {0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000001ec0)="8e3d448570e433b0ab879a4e27373d9771823c24cbfb5db3f78bdc118619453e211e7d6bf9707f2c6a79dc2cdb3a907a909a432eba475a09069c5b9501ea48f4bf73772998ccac750ef62e257f4bd9c9c1cf5737982509aa8b4d2ef1caee2b9cf56cc1d2fa8482c432ed5d4082c44a536e6ada937594ebde36df30b832dfc75b549aa6c1ed4cc21d7470beccac787b9ee3f7639e4ecde7a3b33e45504e8c", 0x9e}, {&(0x7f0000001f80)="fa5fb4e05fe3dcfad2cbe06246", 0xd}, {&(0x7f0000001fc0)="ce0b6ac33a9eb32500d21fff4bb5ccd94c87bf180436", 0x16}], 0x3, &(0x7f0000002040)=[@assoc={0x18, 0x117, 0x4, 0x1ff}, @assoc={0x18, 0x117, 0x4, 0x6}, @iv={0xc0, 0x117, 0x2, 0xa5, "4e45e5f1ce7f5337cd3e87138f5fc8da9390ea840df2ab05649a68ff20662c2031165bcb0a093e36a75092639f4cb01fb07c140166c9cd84046d1d5428e717e7827fd389b5672ac9238726178fc1cb9da397ed72e327253c6383f402133440db9e7214bdc8bbe4f5508ed84aed7a2a21a781bbbac1b4ae6877f3002ebe13b28ceddbf672e4d47379cf3af2bce2f63c30683f37ce99d044b60de0c174e074eabfbd3e2940bb"}], 0xf0, 0x800}, {0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002140)="10b07cbbfbabd5bd3758f352c446eb40e3beaeb062159f4a37c7e79a87d4b62d892dc565a07f3f38394ac8", 0x2b}, {&(0x7f0000002180)="fcceae721040d607ed0fbded110f1294e0a050c9140d613e4c12f758833d", 0x1e}], 0x2, &(0x7f0000002200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40040}, {0x0, 0x0, &(0x7f0000002680)=[{&(0x7f0000003000)="19b51fd106f7c560de2eb3c34452bc4915b493527e25f72bf12a27606a20285a891a3fed7c7e3eca7fad62af3f4f8a36b156b091306e3d61013de967bde86540f982beb617ee7429b93162aeb595841ff3d7f0cff52a0722c5d584380a36e224d4f489a932e04b30c7d01629a3098c7e8123b4d82de26f01635f43ecadfd64e4626ebf3a273c032eb07c46f5b5f406ed1995eec70c79c55113d7f2633379da32f30cdf639be91963d1357a777201d8c85f35164cd851fd951db1f6cc6b7c5d1298b6f1b5ddd5e1617914f9973fd21ff9bfd8147af3566b6e6ad42fb789eab0a27e92e15f6d8058cb37632c58eca28729cc7e87a844c5931e146e4bf329fff9bb1438f12c9da2d0f63911fb766f8e07354dbd695d1756455295c23bad22f8321c2cf1af651e5f873d93e341f56bd4e463f83d3f40c09c7d89804b87ae36fe688f6d745336d227b0a75fae1fa825bda82852d3280cfbfce042a90c6930ec3da9147ebcb28460dfae141570dbe8d27336038a0114bac08eac55390507bd7a356c2bca3242645542e3d6cb30e44759cb518dcc795641b9fac6b895da45697cdc0b96afe533915ffaeba978391456e6287bee6634e87dd6b0a6e11fb52bca064a4bc5428956bece930cbf4acc1a6ec06bab1b264a42df90d348c636ec8dc8d2318e01f0fb087cba2b25043faf8b3d984b5e901768529e9e97c114b61592fe756ca8b3397cfb43a4f09a50556d629eb870ea3a9ed2e7a18fb3421b2e00f895fd434435be7b83cefd97957e8ce08a546340f501cb9e02ef3c254c97fa81f4500700b585b3c2514ca1fee88f80d8cec5baa550820b2953295a50e423bfdeb90f618d23c2de72a52e04c15dbe715ccfad82a986bec8120f30a9570ba03e3cd04608fbcdbf1dcaef9138ff592b039bb5460d056c1e817ac473d292a3e513b598a130bf0c4b108a2f6d302d247feaf889fbff00fbff6e9fb528bb661cb17ffc711f8cc84c4fe2efde1a5e21e06eb135deced493c8cde8f76284a03e95701e8db8c86b24500e8ae6856a1b9401f8427ce143bdd81fa897dec315f67f7c39dc3112beb6727d529cf6cced87b7fb9249308d04ff4d3507e850c9d394a285b7024c3acd1b158382f09087c4777014bb30279838681d3d040dd2f6762568050053bb97143e13e37394acfe6f6f95f184fb26d9e0f38f2a81043a6b9612341cfdfeccccf8c4b46064bbfd56f0cc2b471d34ba55289e68c2708047cfbd854a13f380ac0af2a5b5c5b3b077782d8f31959e8380313c1aed5ec6fc5d0aaf2db688d9768a4aeb447594d992d4b0969b833a0293335dbe5ed9e85f1f38972b6a1070cd8b54287639a9157abc202315086a7b32225ae44492c2ccd751f7aa9fa90a761974b9f3590441be92ff2b5bb7c6841460a102d51293bdb21c87e0273e64e14d97d388e65e1fc96fce8dca70220fe229f472f087f8e73160e4878574a29d2e991a4875fb944f4b1278913e0f9867a161cf831dbbfa39c731a9cd336f1897bf364aa8bdf06a69f61f2d00154fb0a24a6d44afdef82f609da4fbdce64b9c0631a9a79a8e254e4d9b4363fdff7d1086ad85726b606a8468aeeeff36a29fe5a30e46751e2d50536ce39d81ec0316cd541bc89fd30b016d339bb69052b267b453dcc8901f78d0393dd07212894ea9acae164508b24450049094f8a002e5fe0ae67fa6fae14c43be4b829cc6d1c4679cecc8cee12a5b01aa1fbf68dd8ccb50cd6d130ab96ef3a0ed406082eaa24089e39e02357ab529ff005e705f400dc39f2e496969281539a405d1a009c2a7b74e586b8861388f5c84e65f1ac9dd6e42f32c882c93a8f1e40f14c1348143d465a0d3c37e9c4b502643d0271718fb6ff3c2b0d6fc11805d3ce5271f89d5bb90529d8bac99b879c78a00ae43899eb60cc32b46301e834975c29dafa2def041f2a9d4d35402c4f3d82792259c82a32bb4c7d312b20c6588bea52e869aeb31de90be671655b8ca769db665b870a9e7ab54e27a3b36591b1c5b6b203f81170e4a3d5022d74a4460c4b7f858c3c96751764cf4e5bce1ca1444d47e3c14b9f1f9b39d58d6cb352d9ddbb53675e1270ef31c0ea082ece600bb4f8e344da760e573185504f8e0fe02b28e39a02fbbda9e267e47adefb69926dbac04ff144376f249f215be5a3ab1846cfc5c72f702deb9ff28fb3fe2b868dc56ec8cb8d3bd8f749485fd9258fb97045eb602d628a1d68d0cd23b7e0549de3a97100443804811e6aa1727cbaa8934eb5db283324e79e4d2a55d9cb890026cf9318b02ade82077b2572c817de63b285913f639fdba84e003c277c6674b7201ee1c0c68d3bbe270affa346ac45f3ab314dbe8a579a0674dcb95fe11ffd6ffd68c0372348e21cfaf90d7e8c1a3921c86a39ecbfa549b80dd2512eb3188ed2908f3ecfb52dc47a55f0ccb4f75ca056b69663d7fa43f02a5c3a7f12f563c3e7ada7ca3bc09058ae1c4c58fdf1f246ed607af9f8f5a8fa281421676c5cabcb94bbcc792d1060ad96d8b4db1afcdf1599dccdf2f8df05504a5d86e934cd814c841ba587e4d499f3143857a80d0ed62dbcf8036bd80488d62f27df85221504e5fc50fa2bdcda9a3c368015877ae13c462a34b14b44c390344deb87126b8dbc7faf4f29d1472eb27382019ee954c14ea10fc8acd31c0e88793473b4090c66f74aa6f67bc0104da49117cb8624696dd663a0ff09e396c33aca4e3fa88aa6a282d743536c49439258ba0bff023862550ae8a83988f06cafd343c64594d46e3abeceac23b0aec138d97033d5fcd660594055b422bcde6c422e502e3280238801649dcb778ceeefb25d2c69c91f48581eebd539432a5f341736fbefb8aab70e3c19960a43023cbfbfb7bce23985161b316ed9403901d8b49ca5ecea2d5ddc3fda4b2ad3a68e123040b2d69bd97d12230a5aedffe6f58333384be80585178978f716f4fc2cf3c864bb59634c3d7f110a725492f5dc7c130f76dd95e9e0728d7bf5b027afbca27c0b94c4e47bad102633b763601ab795e9a70e5e32a16d91816908bf6a378d8e1babe78bb4523bbd0c58e58c7704173c67204da03ebe80ac4358115e2af184988af3eafb3f4b5c9a5a0d235d3b6a8219476176b73048592958023dee1b0f77dc91a0978e555b416b07ac8619227121b4e002611481be44022442d6ce0775d3047d94f98dec772922337a24475838fcc54b79475c53a136727f29680c4bc2a21361827cf943e6d8b6194318753b6e647ceeec64f96fcac49ab3c933b03169df77d19de2611042dafa02c39c8a91e16a1a660c8440ed32d648801786ce328ba7b12153c390e9f441de158b6b4df4656726fcbe1da571777d94eb6db64de95ec255a9336024646eaebb8d8a4b0b5a047dbfab4b10e50f42029644f3b4f3f77bc04f8ace3101726af915ae904f367c523af9561034bdbaec21b0ef116dcb78d80e331931ca89e6ced41827348467786fb2cfdd5e942f392ad26ef5d7b992fc7a8463507623ea3931d7327e2940deedd3bc5af8a03900b2d90f4a677e93c0b018fcf1d53db6f22c4d44687b92193a6ef67fb6ab30cfb3dc1c2fb3d8d5fd0b9abba54608ddc1f16852a37ee4d43450b4855b92700155c0cf998bbd145401d7116f1f034e27c5d52d45b79b0b0d1989745416add423bc428f52d30e7214382a46196e58fa1859b0aaa6421e909ef36bf785b5f6f5488abf8092af08dc41950148377793e6ac65ca97bafc83b01ccc8f9e2250ab1a35d95d0e91bc7afb67d575def0928fffec0df780e8bf24b95f4ea2f3ee614372c30a2906f772828ea5a744229956035e11799809e86b42cb5175f0c155442132801f5073c74151841cf4bc0735022edb721388aae64af8a2bd3b19bdb4107e0a6ec4569ba6d368ab76e8bb066b61d7f6d03bed52fe860ba35cfb1ad4c745542222dde5b0bcf997c09ce0343bf38efaaa863c0eff28b679b0fc3338661cd4ecb78f850239b17c0b7112b24f602c51fd43178fab2c110493599a6d24484323ff05af4c57936157dbddd1cb10ff47688432ddb1a8c9a8850678a65b906342eea9c23174ad51d128c148089b4f2e999927797231dea65948c84bf4c6d06fbcb466804b95d5855c55b05ce3dd0de96d9a3238fc96e9afe98bcf4e97e27757490af89c742ceb2a67214f4c401d813eab9f92a74653f41d58c5880df9e39bb989b042c16bc6fb0f778d46a071af6f4f83aafd54a2b473bf1282ceebdf184eb084f4bd79ec6712caad7c9fec67b132957df39b3c4b6036c194cc81f8eabd551d4164c7f82b9df6d984bf752d111873e2d2fa5e95ecacc4b484c510cc44f46893eec36c493eb57529c197bc417a9f3fb2fa802552eb79ce4410f3ea34c1f190232c775a9d7c1842742b6b7c01ed6b2d3d3534f92ccca178a4d7d9c36df70c3a177f0e03c502818dc4e96c5dec75a1f65c0898e7779432dd0005501d958c695fd47a2c1928df33017822066d2c4dcbd83f7ebff29e4610c31b3ce750bd667d4161f00b7e55f54f263c72e7fdd386c23880b5920510e634c7917c75c1de3fbc1506f49284db2205d486cc61a1d9a30b3bd3212d96ef37265eb60bfb4d537d013d81a02eb5232e0fc3157b9d8e36b144e74f4314e49977d3e7fb89c235ef3b1ab510f6c1765e4664773e34175b27902edfee6354b2d961c397df34c77ac69301d9c936f43ceea53d208bf5e6592dc0f10bada60d9eee6cb7506b74ca4a698c844cf3c3788a94273205751779af611d7d080b84f47e2ad9697b410a371ec8fd084fe47299672c0ab252259e7f9a505e2b382da679a899f10170a67b531d5a1fae180320f540670c966c9e7c10c12047cbc97c36677f20b87a5f227cb560079962142b537dc591daada4246318c52278876c88ca843e4c179e08cec18960a43f17258b7f6f5446859396a8ba3dcdda798edabea01c1bf71d00bc3ddf94ada6a0736ae88797ade2850cbbbb0bbc5821207afa9b2bd267b1ca17bfac914adc261928ac304a3bb168c662fe4f2cc90e860ccc4950a09968ccb23a81c003cc25550b3bd869aea6162e905cd31f6c7b77fc75f2416d742458ef9328fc331eb4c238360fb1809253777b458f81fdd804a6a22abf29baf75eb4c6046df39a31a9628a1e628a49604ceca9b8c032fff07f542fe160eb12eec13f43d8cf66e6eaaf4bef54b6cf26e102c2e74f763b424e27a487f95f61128356582bd0dada7d9266458321e7fee5f38104eb390afe8a8de8b75d72b6af59505caa824343428c0e3676bc3ea2aeeb86de4940cd9552f23b2f65e64625733e1456e6f87962939bf8c7d34a33c96354eab944eb3a2e78de444cb0fb7288b2e9a87a25f3f34827e8a26c79ce9e61eceaa69a385d00e04422949f1e52e851b961c25f4c979d9df47ac4fea74e3211d34de335649ac296c14e21b5a5c850471f098735954d44ff02ef1aa9cee50db383e19c394776ef563e77c0acfb838d2d4f04a576fcff4f3d8b1bc01df3e1ccdfc0108c6dbcfb2a7bac37a18cc102b8fe40fdae13264e6d50af67c77b45e721cb3a12171bafd480f95b5ccd43cd0ce0505475347ff12fae9fd1b00c8891211c3643248b1dea7f6de64ff1f731d7530029e383da61bbde54a44c08b19ca1b455b2ab11e2b778a5349568d10ba896c4e776d045553f684a424e4bde45487975946e38942364cdf38ee6011fbcc9f82b15fd4599cc59da0d659940e593a4544a6d86a416676e1bf091a77c8b01679ee2560afaa76ee4d64feb09bf15ac05335d7a1", 0x1000}, {&(0x7f0000002240)="126a5d23b2446aeb892c910dd1cd0736a0f3c71ab7ec4a0d2df5c464bcb3f969135182a5a00aa1e9b62daff6ff84eafc3f3fb118e9f02dfb2acc314ac295d993056dfc3524d8ca7e4dea3f0ae162070a9f53a6f35ac4ba003d6e1dc3e9157efa3b441b6ab40600bd33f67cbe96328ae36600b430d7d2c7a119f7c030c91e0e6d8bbfb36af309db9b4a33abbd", 0x8c}, {&(0x7f0000002300)="a733fe3eeed6170819b59cbe5c59a7353c0b71", 0x13}, {&(0x7f0000002340)="7a44c7805bc932530d589e3220b4174ab8c53804787eb8ba69db1581826b7b08d8089f5e9c062d4f570cbea8b90aece69539385f25d1a0314e3391ac13513085413cede5b01c7010ce0046301f05f33d4337ac17823cd94f4e68175b825a3d54dfbea3501eb8982ed4bf18fa81f1f34dec04f768becfcea3061bb2caeea7690145d18fd93dacecf0eb4d810b7391b6271e95c7b052179614ce2f539fc40fbf1d2c1976ed0ffab66658b1fe88cfe6d6156c841968c1cd612715413b61e8ffcf5f6fa7d55b99f32135d9aef25390186a5be2f7aa5a224657f6d54b4e78de6ea993be4fd170d12f9305", 0xe8}, {&(0x7f0000002440)="dc5ab4a642a4c5dd7b894f78ba0567da8303b0e6a89a9221e6c6c74e416881176e70588c53dff7bb7cdfcde5e5f52eca593068c3acff849974d44783be02bc2314947d547923d8d12871aeca9181a0be9d4fafe851e6b4ad55d555d43f698cdaac6af89c7545", 0x66}, {&(0x7f00000024c0)="00f5789ac2ed2cbebb734f4acb53f23584d0b44653a4bc0edf277e2211c4122ae877ff7bb817f564dabadf545fe7d197ea702fa2fca3e0506ac401fd109f0cd41de385573151c462cb7cac2ef0cfab409f777845bf451da103c3c05a0e86d9ca23e79c9438e5c469e6f3991a80570e45facf9f2e2f4be12f2802b7bcaa7dd5cb20feafd42e43c244d635b975fcccadd8091846dce0d18b8d29f6589ac0ba799ea11cf128de4e6ed3d990d87e0d2212c7ba9331dbc110072e", 0xb8}, {&(0x7f0000002580)="ab629bcf8f038ab164c062", 0xb}, {&(0x7f00000025c0)="da0c93549d2ab2f89d641770d995ca0d60409674a09e90350511a1cc6f47e2c7fe705d54bf2305d42fb129a529d4bcdb3e86ff59ff6a491431af7b75a6974b63b4e117b90d4db181334985f2601f4c73d3bd070f03586bb33d8b1d2269263f795b2f572ab123af3115c7568876bfaf6ec6a0758d9746f6698ba17ed58e50f4a19b49433afe84bcf18ef4", 0x8a}], 0x8, &(0x7f0000002700)=[@assoc={0x18}], 0x18, 0x1}, {0x0, 0x0, &(0x7f00000028c0)=[{&(0x7f0000002740)="9ffc41179f19b1d7f882bb16705350e0455ada40851f77bfcd15c872a649e116d0d69204fd8e395612770dee9a22b04f35d58d5cd70ac47c00ef9f2c140b3471509de91484b337a8899958824adaddd63ebaafa54503268bd4951cbb461dfd71ef2ef9567b5238f6698225bf8b12b2b64c74f435ef8afff74df850933a63be517339b7f4ffe546116fc0c80acb0a334ba2966e411523313aac544de9b69180ac", 0xa0}, {&(0x7f0000004040)="e620917ae53011627317fd8c1508a4f008c00e758a2c7f67183eb4bdb94fb43680bd8ca9782db237fb8dda467dbabcced4532ffcd9945dfca748f746130f5e5617862a3aec1c4c3dcb0b0aaf3bbbed3e118f1090b785b16928b64083373e57b80a864358d16bfe31bf1a6b6be57fc77b6329642bdcc0708237ce8849b5baff3a2e9f6cf00eaa3d456a6f492a328194d790159c9a0e74f6fd6420ece6131ab282bb4ca6b6051c7867e5eb5929d574135d44220b8d01cb7035ecbb309e46bd3153c9259c126c86a3344aea92ff2c9af2e5b600f82803176732faeeced5f78c822d6932bb38d701653f2c730cef4c7b6a9251b4b95ee4b28cb2f1e919790625326fed4e3836f9f5408628abc698aed6cd796d49bb610ae9bac2c63379bae79fe3b1835c5d392783cae47e88174987c6aff5cdf45e2a3aad32c4d9c8fc222845b82c2c29125201adc30e254d72cb03ef4de55571869584004efbb940b1a2fb9f6fce55cb9d5e4138b8faef1b1660cfaa1115c0198a9bc385a8894fe28391aa5fdbf6d28eda87db0ed637d8bf4547f82380a0b0bc37b3e67735dfc340fe9a1ed41dde1aca132156ff02eb50bb986eca7bda6d7121e98de482953f2e94c2f9c8d1b62bfd5dd4e386848687a5400c10e4a19772d9e89c5bdf824e16db94cca9cf032df7e244394e3b7b2456cc1c9e1e0bcd19df0574f73738c7a0925337a77d3fe9647e1605ec61e77d0b0ffdcbc6f0b8c1d4d8b4f175c30a8e11fbcd46a83888dccf23f4c082b2ca8c0e7a4dd9e62f075b9419a00e5b558620d35d1ee24769bdc17ea3f4b23a6f9afa763d8fe4fb48c5bfb4f9414f5a4cff56fbadc5b7ce1fa370b23405e7ec6cc69563c112b6ccc6aa9f8f788f6440278bc09fd139a3d8d0af84e191d24dc302c876bda4162a28014b662daf49018ab41b390a7e80d006595757799826dbf723d033b500eacef039550b122e6e2b5bcaa608692aa1913ed0ad2234e4f4b579bbf9e2b4555a9affa879904c19556189b0a3f606bd552d8ac1cae3dcc61246d9ab061dc7b98624befe2a63dbbd0c7fde47c331788976b803b139be4fd42bac2afc54b12f867dac607df25347a8a12293ee2c58b2f8cb2d6a0dade9149dfd5004e249aec35ce55f45d5d27bc28624ece886c932be08681cafddbc8989fd4b5b463356eb5fffd02ad294e42853cf58ad101e2227ad6726a95e016df72fa248798554413fdc24588c507cf571e91f7ec148f65680582af58c70b4668d5113d4ed9d67aa55a41e5a50ed60975f79ae863078feb0fb3a966c134c5146049359d85c548b62df4830cbf29c0948a53ccf0aad707b241e2f6e409c70ebd9c4da68f90b8a9c035f035846b8f10e7abe37f4fe7e513d40a26b0337de2ba90754871fa72fe864bf7a2edf7d9a7582e54b838d8249fac0233bfc8bfa84bfdcd34742f68820a03547c51cc9440f27ce2d132bc1f615390e7ee9f05d1a40a6294fa87f440575061a72b3df5838d73d4eae455bee869aace36498c49ef0b20815d80073a5ca5d3b2301ed888b25063bbaaad5688e7242937ffaf77db23778a8117e49a66ad5450ff89c2d36aa33ed9916c241d0e393bd3d90e2533aa96a01c5d859c595dde00073138364faa503dbbb7810faa6f121304223877eb2c301a1baaa2115036d60c0a013f82639ca7b675c1110fbfed5a933a853e15d8c0de799113f79fada42b7f61a361187e042250d631b8b683c69cc3932155da3303cfb1e88a0935b500a41c18019b4fd46822d5fdf770f3504d02031e3049dc9f8aeb083f4ccda5fe4aa68796ccaf3d83ce759eabe14e8e675b021e3eb473db0f0be5a83dfd4f062f81f7670d033f0323e4af819e920ba9bc2d4a58f26aa1179703486c39908328b0b6e355f46b2002c524ac3afb13379b3bd7f24a9a5fe557a76ff4428b87478f9aa943a9c3fe730297dfb5f98f59a65c5f2488d68333c504e2501d79dfa47ffd7dfcd3498a0873ea6af2009b0d798541b4bb9cac8873c45426d63c2b3b8780199f8f24c6764980fe67d83eed3369fd274e45c1b71dfc23aa68e5f73d969ca093f9d464f2e87ea93bd81e59a381607b0631a580300ed70b769b1d5ce96c2c9a8dc7b11566aa0dd6a02c28a8de87e1f000c09d63bbabf3115ee94b2967ab0267ba38edd2d75bd45e4e5f9c4a14c8d3c71172fee58d9f590e922477d83cad697d9c24e6fbbab80efa6400836764c925a932856f69ec7ae11d55c36762824c2f17441ba69038ef3e5243f59eecffb467e53b5188db72f1f69eefdb74ccf828c847abba945a0c4deecc37243bb0e6cf7e588a4bba0a974aabdd12087973c05c24443e409f8be9382a6ef2fa75ed914eca98c5bc66668e17b04200245a0d311c5af98c7c1151706ec882acdce9369fd6d634d6a276a35dfe75e8f8d98b5fb96e5b4e979dfbaa12b697cef7150c14d0def2c0cda2331048cbf6a3ece67ebe75f1070cc4541fa59771370d4b20eb5b08a0ed2c44fcd9d42998d285b1dc6c32c4793a034037a6a97dbcdb8584eb90f1af38cc12179783710d6c99ea371f3e15eb38b06374b59e6e5720f0618ca646d8ae7e56200152c1ba8eec1dd92d77c0454ffed25b5e33398b81fe1620e1cdf64d5089bd2267912db9be79291af1cee0971c3c820dd3860800723fa13422ae411378d97746af06ccb288c0b1c9cb4309e3fee40e74780c4311179a79bf00f6b7fb126257ce005b8af87e43d931f60632d22721d1e3498c9fbc6ae947c30734d084f84453e635547e5bebc044203a1cc12bc2172e65df8fe620674c618880d89f74ef0314a79dbc26c23d467b9ca1572275f4754ef03eba858c9a414fd10edee709bbef7658b17ff0bc3e0b458b34215d1686902106bbc421a05a6329d0ed9a0b49763e66615195f96dc779d075fe6ae2ce983bd9601bec0c76698c05c5c24568d1974ba3c6952a45de6d2e2c76fc99f33034cb18e3e7c27838549cc2be055620aedd31eed32bfba6e527850f651a3cf76df862e1776b4563f50582d7677a8e08f55fe003a370d26b859fdb4e4368aa768db0d247037b9602776a97bb25ca5eaa7ead148d40f9e7662f9bf8b7df7278593a374179abd9b6fbc3d7bc961d3794e332868f170d34c26812ae6188279e8bf1c8bdb08bffa0d9be8a99da8c8b4475ddb7eb307fa8a1899a8d6b13297390fa5c6fd1035752f83d380ffa57b57e872744c3c4bf1e14bc952103944a93500558ec182616e8f2c4c2d1611b069df2581d57fcfd6cc507a932778f9ec05c12aa78f9c4a7d17cfe0f4d300c145f38d78afa8fb3ad8afc97024efc5542503ff2ac4103eed2ae48782aa4dfdd4f942b77a7e7f50bd111f75de0c19691c13712749a6188f51817353f0ac2a52491f31a8450ab3e9696b474f91eeec671519f7d0e76a8a3e43e105388590f30b2a6903ccae9bf7324fc06f248564d5091637860e89d9aa3ea6d7f6feb842372e81da21999ad78b5b9b3f473d13d0760aa3cf0c787ec183c0f6f088cfa834cd2da425f95bad5efaf6a9224f73b066d8c474b5b9457ce5e59ccabf9a4f7a4f49aa227e4c23a7a48f56ec228d157ae7325b643c399bb84c9f96be596a257915c518bfcdc1daa84d5edd46c79fd1e57332ecd216f36c80f29391a141bc294878f62eecc0048dcfb39edd8d7cc891aba260f6d529ffbea3ebd707438fc8b3b5187cb869692314ed1934abfde48f709f81b611de8852f6f98f50e8b9c0228a3220271e0f4fb08001ea5ab0f238e7896d504306cae727908ef3379c6c2602480e51b653ffd67654f43ef8a4b3fe1e6f8a2aeedadd0c3073964dcefb7f004eaea0ade85a52e2636763ebe39812c5c529be72b18aa7d1d1723d694d6be1ca56bdf2690fc763d04684215e51d8bff72ac0dccfec272b590930e655c6d504ce92872d108d4f6df06716eb668dd06e1293aaeef0b1436aadfc444a2d3833ca03bc4bb0eaa46fd62e9e0d14067fc7feafca3d729f96efffd8503bc3676aeab84e8799df805cdc897bdea7b3decd1245a83b4741e221ccdf1e583e9d74799ceec2f1f7147f235f9c5081e830183713533470137d0729b6fd139e23697bdab60d6b74bcbdcc98c8c147687877cf0f1fbe86109c1e5a98200a1411db279086a52d0908c87d4151054cbd75a03f36ef71751cef726dfe160b7802d5a018047de5cf9885a01ad728c2d420c4abf1159d8c0c9e762cbbb916056dc40aad0d7c7a35198619b5d5e9c5fbaad87a167df152b7d6291ae7acdfd124e15ba02eeeac9d94bac52fb050cfda16902e25b7cbdd87169673f318eb0219a487f4fef0ef96a534a765114bed251f331d8b47961cd688d4721241d01b27f5473fe3a71cce97c776b8877e73723fcd3b15f834fd99bd5e140c08c237ffb744d09143c15b8d997a97d2dff7b5968b8c434b2c4200e22dca66be7bd86cdf46da879cd6eb3934cfaff66dbd59ea294220e884bfed4671c858207dac3d5930f0b96bdeb4b3e86a0b61b0607bb05915148885e10fa2e08fc66d1421f59bb46bdd38262e4c7c188b163e32003dcfa58beab780749b16c2b94db07aca5e092522d1e9064b2616bd3a41fd574c2e29a94de2d826541e450b97682d6c6e010f860619ef8fe2d168090ab48dbfddd97228396232d0fb58b0956de7505193d834bada3faab823c1a1bc059ad80717e52194c5d35d6c86eb5b62dcd32eb8fa6d8ed0be9eafc605effe84ff69416a9ec9cf343a2aef58188567c97b2070866ee3475b425e67f8941e291a53609362e29f90f0488d06b1c1f959adc21a69e9aa658ae5a648cef7f048708c2d1b60956a7bc7895683b5b1b63ae30040b497ada638fbcc8abf321fc0d4fab0aedbb2106f04461cd98ccc43e6bd5c67c7381ea6589cc2f23b36e168a43a4d3f5409625bd613edaf338e3dd577af34ac30c32a916671514dadb4a0b49412bf803d9403bde63e1bc6f1ba99aa4db39e8e8d4a61bcdd5dcb4803e603e33b65f96d9b1e0d5a7676c98cc7571e3c4c5772a83ff92603dccd4bdf26506dabd3d0f8c899ebcc1fe918794f9203017ed9e76c93d2a326e5a58e12dc4edcd8cb31909868df5609473e132264b98399599e7f067c7552211893b8b07b130b4fd1b4b9b4567518b52b4c9d93982a1d74f727bad5f4f8da7629d5d6b87bf361318da5c0ea4943674f114ebcb1770bc57bec8238df8d63b6efd3a7ab4ce2b04bcbf5945d56b297072b4f3525ab6d0c58fa4718f4d2936e0cf0bf19323c46d41e5d5e86a818ea0041cff0865051597dc87a2d94e63a306d1f6f21d7af7fccf60e16d9ab62e9697cdfba984fc05b7a8fcd9d25748159314995b5816a24974bb6ab25785f019c0999eefac1378eb6e05c8b6be4f2dd45893309332f50112a346aff7e4c88c970febf7e2c2740ab72d7caddd0e247ea92b2154a65967ef23d9b207b094da5f0a5a7d5cffa7314cf375fbe26032de9769c30d00cc377484e9a297da9137c2b078811310311fef106e1eade46dc4a29644e223dc66a480380586ed7d4d698b9c976db8fd1e18e0ff76a7d4f50ceb8780122c61d7120497edc8c7016bb8c80dc81bcdef7a5208d9d77e0860da0a4e37bfc27d1d3088e9a337d80eecb73518e65410f25f4016fd35ea92384d4dad01e57df55db056a2b7a561036f8a14cbf6a750573674bcdb5d99c9e38d54facbfcc138f62291e148d60d04a8ce63ac1ed5dfa6e32070dfca62586b14171d883ee0c35bc696341b895535dfa80f2163ef30f1e401d9a92966509433dc15ec2a7d4f5", 0x1000}, {&(0x7f0000002800)="a0c1ea10939892f91f8b6b9264f4066bd04719084cd59ab92f55ba265601437e33f1368bd8d1df173a45c2093e92e3e4384fde673aee11da61809be660d49dafc80b5706eecc3de6073a4cf1af1b222de80d09e653617cd0ea71d953af80265d487eb6b6871c21d4b85a281c00491169021d26b85e", 0x75}, {&(0x7f0000002880)="46f3b0152b00e2fe323118bdb4464ef2f4915d71589d2f529dea8833da38c615ab0b406a78483b3607006b2b45a9162516e6066876de42299843547b79360788", 0x40}], 0x4, &(0x7f0000002900)=[@op={0x18}, @iv={0xb8, 0x117, 0x2, 0xa1, "5d85e981e8211ba1542a6a42fa304a64c3867cb8983e34090652cd02a014fdbbbf58c3f8158f35e174b44ea669a511a81ba3af53febb906b88f658708ab901b73cb8c209b76cd8818058e526f2807c825f53f40d88ed289006e64e37b466fd9b72716de570db7b3285589d4d1822ecf8c36688c074c5b1a7fb1cd76c1741820eb74c19464561ffe86e29449b6e46377e479a3e14b0e50a2e389aadd4433373a065"}, @assoc={0x18, 0x117, 0x4, 0x1000}, @iv={0x40, 0x117, 0x2, 0x26, "cd32187829cb57538093de5d550677e5423a0ee19d01acf7cabdef072d403289f32f364316af"}, @assoc={0x18, 0x117, 0x4, 0x1}, @assoc={0x18, 0x117, 0x4, 0x238468df}, @op={0x18, 0x117, 0x3, 0x1}, @op={0x18}, @iv={0x58, 0x117, 0x2, 0x42, "bf16c5d8e2f93a3c13947567b5bee17701094609639df956c3779ffd4a9e15c45f33897b3ec83ed4656f8e89c5ff1c50513b1502bfe49740066a830c90c36e4862f2"}, @assoc={0x18, 0x117, 0x4, 0x2}], 0x1f8, 0xc000}, {0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000002b00)="29abd3d08bfe2bdaa7", 0x9}, {&(0x7f0000002b40)="fbe18d69c0bb586fdb54daf19859632ba49410bb0f44060edd53aae0da4749da868a75185544b00c222224b2debef3c9876741c1018ed1b73f56bde67ad7b2b9c1c53c3971ffaea78c51f40d7708ed36f4e42b9fe45d5857ca17d9935ea01b786f223f057e1c5d3bbf76ffffcf6dab8bd2283c1f59bf69a451fb", 0x7a}, {&(0x7f0000002bc0)="c655e79ce8e95b1d9119751b8b1387594b59d66701dee151fe873c31e2eca12f721d2b1ec3bdead45f994aa733b32c7ba7c7d391594a9f07947b8f6a165b11cbef9e83b508f3e103266cc2c2fa9b97096b4f12759ef8c29265a139f30f8cc75a01ecfa1e9c4ba3ee259e35991c5d56b276c477080caa7e69f362cdc97a308e912ed359d6327b7ea16cff4f4ac206", 0x8e}, {&(0x7f0000002c80)="1284bd9e36203fdef6facc613d5bd9b9740480cffe53b53f8e6ad163cf6279197b52e1d95777b96a426ccc7be51cc86ef3d53e3bb6e72ba69f79d2e30511e535681e41b71eacc42b0065e34514fec5e3e16eb74cca519165dadbb61e0ce71b4bc9ab7f5671", 0x65}, {&(0x7f0000002d00)="19f8ad30e3e570aae8dd112ac589387bab6167b7836be25478fce3b8bf56725f13282c67a459cdba4a414490457a5098360684cb210151157d4b64b871922e08d23aafeed2cb1de022eecc328017d2200da55ac16adca4aa4df4892ced351c11080ac46ff26555f9727c53a728ebf1c8a8b8e8ae36c498946f9495db889d33527a706cf5ad934332589d9b4bcbc14442d55b08068dc503f9e4923b4e3384c4abd09d48a1857d521ab0b09a81fe6aa9bb1cbe39a0c7adea637f7421d1203a69b8fe7301116a3ae685a93fc1293b4a6e5bee138635f62de9b8ce470f9344e092ff772a77fd", 0xe4}, {&(0x7f0000002e00)="30b064ffcf21", 0x6}, {&(0x7f0000002e40)="9adcbabe36ad58290f8502c708d9969873b72e60fee62e65264f36f46f", 0x1d}], 0x7, &(0x7f0000002f00)=[@op={0x18}], 0x18, 0x4000}, {0x0, 0x0, &(0x7f0000002f40)=[{&(0x7f0000005040)="ecc6170932eab7259efe43950d39c220f231552106a07921751c61baf13f26702f2ad8a8ef001d5e5e80a16d8dec6ea3bdefae8b4392b0aeeda239c86cf4160851d9d73bc45ea0062ff8a3f992e9dc73880bc635862396d7f64bb1aecfd97e328979ea7805d99bd54f6637b5c08d5753c65dfdcd9c22a32021283a0a06eaf7e5ead356bfd14071641759b4a27c999a2e2f37ab316e9298e4388fe9a22c254f924390cf4bf40fcdc66721aed65e9d106c750f6007ed988f5f671db0aafcb24b6ca7a53dd029b88db6c4885bbc12a57a8a11e64d924ec1ec7eb1da1319b46d0236ef61bd5e17673df81a1066cd2e8f55011bbd192402441bfec37800aab807298d6c2831fed6bdb7ffeeab309639b2abfb3a176db78205cebd378434abb34ff1e1ccb75c5687eae58e203b004228a98cf0c2c08fb283a61e29457acc6a180c43df1a78d3c783f1c294935e4c22a57e1edc928955839c2c162472124c1cf575a29bcafb6bda5db38b3b30c406fbef1469c3add912207f89a5bcd6a07bb4012446c8e5f465cf084b1076eb3e095cf8d21c77fdbcf464652c01dc41bb03019606c687634b48b33c32018a498e895c1f80cd777d35597804dcbe048a00b51e6bf478990aa861da78598e3df3ab4f084897fe172debe7132c32bf1a7cc881404e4df3ad0fd6921d30976372fc04f5c3c94eef01a0991cda1d500704a50473e6414f60763c8475189804568638a9fdaae97a3065d8db8420115df3ae2dd864ffde4845f0dccd16e4e2fa028c6a3db4e50fb31e12c035d4f73341a81b3b78640fc82b7194ca5858036ab2061d1073dff2ba4f01b2a6d6e2c4049ec3a65536c2c092ebd00aa2aa93876e5451b522b5a85a56b89595cd201c727ad7d50157927ef73b168499ee868202209ce8043d780d09a16fc704b8937fa861b9fafe18250675500fdb6e51d4f8b8c3063231d4e4b595eb72794e932a81cfd7d20af8d5fa3d58369db257f168ae5f529fb10d6ac2b576acc2473ef60776fefc1c79af652db656f23f7de8eb84abb8549e96d674306afed9e87b23e4bb0800afc87b9c01e5a621e918e0339270e410eaeb166f2554dbd18352bcd5859c8c63b12864bea3e953fa5d34e6d80a16acaed99e14b836899476a458d356d7296065a6ce78b4667e56685212e90d737e93ec5e703ac22ba146939f1e2c8c52e47d5b4885b1c995111d97fae4dd6edbd8d4b982bc9eb25286cdfb733de70b221061158c3c11883957605ba94799624c2a76a35c6065f53c57d5a6a1c707465a7e3906a83fc62d7e09e32616e44ee27c8c5b029a244d8e5c6547acf46feb6ef7a65894e4da2aa4432101aa0b8e0e4449fe05de83630d3abcdcf62d6da061603003882de9f75c88ade676b69af28b2c325cd77f4a0c9265ee6e8aae280eb77aa5dfe810e4557ad79278320004a070df6e2d6f4433b053c52a8a42c6a2b6905e68ebe8e8eda8efa16fdb7346c5fbebc77ee77604bd3f655769f2f19b925b4c14c4f12ad8e098b99080b8c9e3c49806e32d694690fd094174b85b4220b742138aa79058b13d6674e0c79f8887e200946810c8fd15609e0bea7392bb06122b49b5495ff8e517766acb8ab685ab44b82ec3d839f443108fc87cc6ee3c700ec75a59972121a9e5057ca06ea1679ed1125bd19fb281a3b8af5cd6a05dfc9d761796f5b85f5160a05dcba3c41e26da97c47a8d188a2ec6e8368f4d5aeb7b5763a123db64657080b6586465cd3ad33143f23950e6b205a9cad1fc9900bbef172662f743c0b1053938440aab8bf4e4dbbe047d084f9e98ab1717864fbc470e1e737eef030af0fd47173da929c067e37864550d81c7174b3b889eb55a6325511f090d3ae2cff5e6732037efcb842048e4db0f4437996faa7e77766f2dc1ebb6a3cc3fbbeb9f356af55978a5425a5f7d2b399875a5fa8ca0429c54d59a35a3710bd99fd619059c2bae3dc45daed3c68c193bf80454cbf60ed2842b2ea1541f2d2903180f05ec389f9b1289442efa1d568f82f8d5ced72b0e801a1fc8a742b53406bcfe9eaeb61c0eca296a79f1e8bef5f682538671cd8d19d31c3f0f1d29911a99187ed09d9e7aa0ba02fabfc9a4bb47249efc047005db09cce01b4ea1bca3e175f84a3993ce1fb8aee990fe7aa2e3e205fb744573d01cb49f5d86d26711d2a1d84aa97274aea7327c8541bcca70bdf21aac81c238010fcf80aa25786505b6945118c5b53e8550453433e4266340dadbec1295396d3ea6753080b39cdd390fcf71f3938aea1681808fd3f14e02a6f4ecba433c1f2a180e799da6ac3ed0cd9c261fe2c9f6de91e3758deb8bf64575a8ea3607c56654017ba1e8eea31bc7a1c5621f75870dc846f5ceee6b3dbbaf591d02f1c209fc3c6f32c99ca553fefd8a3c3e0ed195827d5e30dc4ce78f008f47ca3c17065066af76b3316e693554ec84a4c50822cc08d0d1c673304a860a9ad3ae3d5f524641a9d693bdb14aca7686b7e12b56ecf9559c922785eed25cbcbd422442b287541cd84650c2715d45679fd89e81581d9169fdd2217c55fd2829978537ad389dc5378bffdc6d1bb3158e17b6eb1455bbd05c279e729085d90f8a46a0d9e8d74351159bf18afa10062f7d261f2ff1014f09d9fa1f43dfad758b5f28d21eea8d76709bd988ae2d97a759400a4ab4125f39323f291a165591da4fd5fe37b1158a74f04bbef5dc1efd2ca0e65a6ac7c8f34341a7354ae7efc21fdd6ea0e7eaa93e2eb9bfa637f0734665da6b7d9b10c0ce317df49b71d92822154b96585c086778a6463b7d09fe7279a0bc293533b8d516b6dc6a6b4ca1626f32c6e427b311bd00012620d3c6df98f75b79285eb901d84177614c2ee2752ed03a8ff970a40e70ad4fc1c72dc8a1a79f0d9a04fe72772affb12602d2f4541aecdbd6374f5dce9403aca303378bebf498940c4552299fd1c5b76e62d505a0976f1573df33d2fd0fb352c0406202a73f70a128b047e9814ee1217ce5e4baaa39e3a004a91f0a0135ec76947da916d3e33d3448f270fb73f73536e9e54981bb2bb2d96324b1c83dcebfe0fb6b4139e99600b653b5dab5cc022d4f2a2ed00e3b1151e15304263446b4db897dafe5dcbf176f75bcbba8afb65c9cd1b8a4d628b87f4737b4dd117187cb040a50a80daaeb77cece531b64f582284a419d24cd607e8c5d0597019fde1defdddb1d316ce7ed8a50124e8d85ec153032880eee66c995ce03341729827cbbf39a4b749dbc60ab11d324388c84ace21c4143d13f255da5ed8e2e0d2a4cc9af8f305018d6788626c3832130c3bbf323d6b7cfb473d4fdfe1b3f1f9ea7190167fe230cf8173868c351e23a8bf99614fd54fbada75cd389879611cd5de5f36b2c34d6363e542b347d1c962908a481bd8b5a527ee0924fca9329e0665ddf77a8a8ac95fa6d74e426eed6dfc8687ada9cdd93898f3d220ab3c96f700f419955b39da4457f65c5205b084b17815f7a2356254803e56278ce29bb6d8dfbd5e58dc69a43d20c6c922c85555026a178bf27c584e604374a7ac223007c521ea45153150a0c9d3a8d5b1aaa7f7cb9feebf16c67a611331f82527c53d7afaa2e80ef757096545eec47b526563cdb34dea094c4923d8a2418400f0f9689cd261eba91e88c145ac3887f4e4824d01e8d4b58435d049fc5450dba83221ae896f64a055876cdb123d7ddf08839b496f576b847fd601bdaa876845827f9ae97948c7134fc9da585aba3bd74d524743127a3abd25c576b962be5fc381049804e69f76d60570250528f06f582171d3bbf2bbdedabb00917796d63045c427a85bd5eec52a79b4dd8ac91e54ad09f25b2f23a1098c08982d7027ec6c264497fca94ebec1c2a7e84258c12be97620b8ea10df9a1d5ed46e001becf7abbf1b613e8b008298ac52987649343c700a38cb3acba0033a5d37f061f17385cc7695d6955bbd15d0c021225b21b829ab1ce682e3b6b472566e9289e2ccc322517901eddded68413e8bcb1054b5e429575c04dbafb0d589c7a3a1f876bb55f9c60ac4cafc7b12e23254df7217bf47ca1623f266b0fa439a844d88b448bfde3ace6cb5651ce83992a8de1c97a1c0e74f3ea221487a5c06ab8c5fdb8a980c1c6ef75fc9a33ca61c056b1d61e2507fac77bfdd3b1977043d28a28301c4b25260a5ebb6957141b56fe4b5c94c5b270169c795c1b95ab3ed7a099784c3db04a2ca83e8da6a329ac4803076d7eb3f4af0bd8b50417907efde62b15f4c0ac3c0f80de919f2ab2d521caed5fffb565ee88ad54c9e730d6dc02be90d091059fc665f71dd20423ae3f7c1b2b0f743e2933a3c35db8c28c8ab971a0d352bd8625684bfa1e67fd299c92eaa9f842fb4b76ef39709f3e92a9bda3322ffd258ba7e4778a316379e0ef8371ba77607641cb8d34927852992abbc6f62f436a2c0e16b95ec88d279b24b5bb7a43bf4e6729334dfcdadf5cd0f49bf2ad8eaab778ca22a55cb7a6338d33fa32aa1173e7897256e645bddb844e6ec445be03e8ef0caef53323c4cc3fd43681f5cc8006391c9080a7eafc49fee74f43a30caa10cdb79359f5e18c188c21d283154342d26411cd74e9e335f5d065b262cb185bd4ecafdac9d61e8bdaf1d5ee156010cd66de98764bc3fc8f9e87d414b647ed954d88db0bb0be7c68f61158262aaa5c9a60abe2772d527872f6dd68a3a4486032b62bc3cffdc10035228a1f1d0c0c544d5d8cf07d3b0a4bf45eb9b6ca08b73da0e34acd30412c78ae08ea5a3048bca5543b5888eab52f490bcdf8631d6ca22f2cbaaa054ac0d1ac4ccad5190387251cb200a1762f203c6c794a28d8698de3f6e58ae5b55152d27ac80d0573601279d18412bd9f357c28f1baf93ca84e81b42db8691061c392dd52fa1d77e5fbba730c6f310c145aa516af17416ea2135ded0570b9af7df41cc532e7e0f5e4b3a594718f443b5b985cd311ef010c7744e70bba04ad8a290e851d6aa4fce445624c9596791c2a9e85f9efdd185255efa89facd1549ff106c99397e82399fd423d6bcb63449399e46fd0622e9305706e74bbd5e9333afa232eb5dd9da41a346a0f46cef5a936be994283f2700b0ed78e36ad8a093b797281b129781acbd3f058e07cded9088d424a82952fb42503d2d28b0625be64e40be98d8a7c944029a0fd87cbac1f4a57ca1f4473f37570a98397a68d4196bd85525efc5589886698b22502051fcea0ddcce001c8420bea674c971d1db5ac008237494719f4b2221e731c97d1f36ea518df512c51c66fca4cb6a1a1c2b1a34fd95e1b2b1304de3c3fdc9257cfd730c4bf21d8b14218a01244b0e97fa553231c46bd067e3eb98bb8228f3f7176911c2eeb37fd7ff4cadb45294b5309a80b997e6928d893b91cb3aa58268c709e6c2cd78dbc8287707d933121814c85e0777674124a2c3e64b2ee471f2642f189ff17bb974cc798189813937580e7ccda5f29c996e5986318a27d4bfde3c5a397be586f1a12e8cc742608b952a8040f286a732791684dfa411298ab375bf8fc3663c01f0fc68317e002ee8a1d9143a1cf2cded5761b9a1c06732998fac8a0a4b2e28ff44a75cf9a07a07ee61f4e7c2eba43bfb2eaabfc212d40f014d5c27cdfd9c209e7580a22ff7662ff7f1b8190893a002029501e2a11fefd123aa066ba29c6de63a3f1508e3b67807e296418461f3bc6bcbaa974722b83bce1ad18b711fbf876d835d9e6f282a62f7385f4cbddc125a44a853e4cfa8f5d46c5f8bd0f470d7db47bcb8a7e827eaa6934f518fb3ae95ea3dc", 0x1000}, {&(0x7f0000006040)="b19e4ca36474270535f21a5206bbaf6ee3881276a1f053966b29fd4403c545c05a4db6823d0f78bae3346270d945f3346b9152f5bad0a0ec8c654f6812f86121db7b635d49a2b694e56fdb8baf07c075d81e5c70a59d1ba5cfb4d21f96fa1933f538f47da709bf88a08a70c4d61494105d1d0f767f377089ff4e2fbc1d0866cb26f912216b52d6782ff90c934c4df4342e9251e266f3e6a74d83059826edf24298ad7b0aa3281f19085c355a4b78f36f639e05736ebcbe380d476b5d9ce9f64f4ce3c5efe616db8a1a4b3f0a669a878a763a6d8fa649f9afd42eb0a4775a6d222d0c76585291f81163aeb49349626590794c55cd1111af5eb009bf20045529a5a9968389a573d1aa5209c08f679c075fbcf3b7ecb6a8241085da463d6e4d78b5ec22429e2ec47f9308e1bb1a72effc42404f1892c8675bcbc48c40fbef426ecbc824ae069f13f72d5d2ad27b40a0b4e3a84cf8f78f6b24031ac6e751ffc152edb43dd04bb7c5c45e9759b3eada2e46e0cc0ed107101c8aa6547be99a8e6cfa2d7376c08dc27c1b352c960d872c381a4f989b1f1bdbbdfadb87576380bbddb6422e70a5e98d9d4fdea484e6c5b736b4755979b06a95c1ba63bbd8891430c2948e8c69112e0c69855edcbf29fa51e65fc6e9548344d6066558b8d48fffbc504684aba37a5ea37b0c768faef1ba8ccf659022a36e76d76e13899a9eafd5bc998190a1774a6808b178698876e822c4f5a5b7e1111601b20a8b17ca8ecf7d4a11117a8b40af9899ce60350c7e511e7348346b389251b52323905c552d8505a0b13bf7d29e96dd8b8576a2d94140bbc67ac1f04a728ee2fbb70e3116bbcdaf61c7ab6582f4ef5d6bb67059f63419ee0caf303575c6b3723b0b5c2f88959eb7af1fefa12e82910e1788d76edbb6ecc2df81a165bfc56b7a5d6268a79b7cff1f7f8d59f6cbfcf869bd9252e04b62e313887c528f618be04b86a8431f9276a37dc0d16aaaae4ef7577454495aed2b9c5f29c4d2f1ab9be091657cf284ad0b7c4702b8b185c0fb76ee97ac7f9551c568db4db1857517fc85e052892359f9944618a77e12fd3d9dae129ef7871ce6d0f8fa4db008e42ea7ebb824c6e985b1f3d4840bbb45f29ba700fd188e95a6630a983518d19b87b4f8cf56e2937e3564bd23c979e06b6278afeaa4471c35f30a0ac1cf680541b543276ba8ef3ae426ab98624510f0206b87cdfc3356cd62613bd74a354b6927685939e0a60690c7f5343c72883c85651c57b864e237bb9f641143af10a6ab622ff14615597672549bfa1bb2dc054e4d698a6dcc0a8e5490c5d16df83fc033710142c4f387d4e1956ca632b4e3d4da6907cc32d698104a06da7846607dab07b136b87f550774fefb9ed5d6c52acb23f145686b28a20e80b21e1bba92a87f1d084a20e01751ac918807ecb54623b904f3b4e5bce6137ea168c7dee05afe4f5cf46c77ed0843d3595a42f46fe428bde13e954d40d5f721aa25c645daed256a6a812e471eecd6047ee64d7af20954865f56472a2f5772d2ee090de35677af99de718d06e725c2135ba5d091b9df7d68ea95e32c8d90745a67a46c9d93bb263bb6a8027c9eceae3ee2e42def0b5594475ce3b2a809d27a7467c6d374865be5d070f19dafa96d8805c718f49197494fc2e2a234ce8823a0dfec142ddc3bd67856c63f97dc1850c7c29d85a6819f1c59066b99f3f632225f3d453a8ca1c021c1920510dfce7fa412a36d7a8e6f17fd109d9aa9e0b94a8e6d904b6cd655c299a5ac6d89b00bd3e6850576284e9a1ada1136d813d3461949d4e3fe71d369d0c8ce9f0c93553fc5076cbbc1c1fa3e815d1acfb906a2ba6e457c971db3486e91ce0dec8fd3ea302ed13b73142ed3d1c122f0de1cf0422abd0d838383133813e2ce56050cd46d44b010a9fcf64803a22a6f1f2eabdcae2ab4f9c4ba9b788ca089b42c2e71cec38a1845b53b44ed55607117c7e180a943a97c9be73dd388483787416e66e3e398ab7760b50df39c2b91974fd4c63cd2694d9a4eb5a43abb23fe5366b2550397e55c3a3012dbc313bfc63e80e7697631c665d94ca69525fec17ecbd568c32ed3f32cd6d828ef053a6ec813485d46f72168973261dcce42d18bd21f27a3bb00ca9a26cea304dfe5e667f2079e9ef3f9d7141ed8de75d9953cfabb93599b45a7da55983aa01eb6796b18061eb39da808135f87165d18b7c29c3a419ffe092181f0bf221076ba7b93bb891f33bc9a31ded53b5659d0dfbc2633498e646aa10de6661122410eb9140c8a00ee5905875bf9c0b92a2ac38f4b64bd26e3fc28bf7c2218539c33f7cd1d15de6dfb85b1710d6c061c036010675f600a32304e97823263aff06196539f652421023b40dcc8cdbc2a0ec702ea32a3160080820846e8b237c9d851725d62114a0a4cddddd0cf9ceae7c473ecae8a7a7f30b1538165bc9e1178ad6534888b887a52edcdd3601cc4a6e07cfcff514d8fb6d8aff423f819ce3895d11105bb67a3e63763231c6eea865e349822496e82f0f312c3a2c980f4643291b42d6ea0a1125f3cbd99d8ec6006df9ad088ba99de63f1050cd827df45a2b8e7e1df2c29018532510c513eaf9ca4ca61a909b07d0605e86a104bb8d96907bb8ee10e3ddfd556e474ce636976a07a21baad2a6c15f2b886dff4d0b627a593ee4e007f31977f500c5ffba74117f87883c5d2c1e2af8fead15d4cfec9939e01e056374ad59c847c8e33dcf4523e769e23a5d9ad6e19d723785c34e40a97e2d4a22a6ebfd8abe629ec19a3abf12874948ee6f48c4a3717fd89d6abd6910aff406bae71dcb9a2e9cf67d590236b48473d4755222a001bc55f10c289750e41c7ffa83e8cf45cb45e402ce16a4644f8bf55a0a2e26b60ba5fa25f0936b689cec3ee1d4491d3535b494604b3d80223b1e96b95f9f68d7a1435c61021ba896f40b08edad2c7a660e389e39e60ce202185263dc4217f144108f74457be232b79e26b9c6e658778adb45cebec4f5c17ea56cc63decfadb9edb2b96b93df2f61bd04bc48547753e7cb8acc6b249fe5128354d0ada64ed617dd4a4e41ec46a09aa64a38796942e7e3379c2a23a55a7d80bb64c47cd61cac911ab558aaafd7c2405ef44c5d0534c81abc282ee3ad784a8dea91f2db955c54988367f74ae612fd9fd3b0a497ace282278417552cdbf6d1308803176b4787b2d2ec21014ad99906dfbaed7aabec37b7b87da081e98113fdca51d60f832ab7068ede8f587541ac63728c2caaf61f79f355c8c2cca9adabe61387596baed5e1b77e81ddd6c976b5065a67df4ffbe4435e2a15059daf19feee8dea8b05566e56cfc7f8ae7240bc4d54f2183a535fd2953284cfa8acdd7bbae140996368cad10787d1e630a550feaff12597dfbafff493fc1b598ec518a75079084e1d0a9be324ff0d81a9edbd7130780df2c9f78995882d0240decf8193f898de4a43ee03da124c98603ea1128db6a63559246c800bb82aea70f00b3d1e7d3b2bb6ff6e6e17b25f3430aee1b4c2a14901b58f25e12a96db863002b803a9e2ba3eb6cc29275c7ea365d71402268a28f59bc32605f8c27fd2886e709d8f7eb58e591d318c9d51c5e525d155c3f946b5f8076234abb1ae9976df3ac4b8448ee457559b01c039dc13063e8ddfc0557f5881781e8699d75d47be71206bad3d9f07d871a2af1d9750066d5f46da65ae71a374fccfb18bae95fa4a2b7c56ee9e21269399ead890f301b501933f2e4b0be6b1716a0e5d51860e63dbdb2d3076a903d7b114d7814a50f8eb2077308e55d63a61dae849feabe56eabcb60f00a8c8b1d405099921807bbaa149c6f0b3723263fb72411c1b5e05d68628bf94cbd2a8e61eace908c25874b4fb871189c295b9e1d4edef92f7248c2e56a992abefc1a0554a8b4cc55853dcc2f01adb9d07f44a44a497d6188ef45926a4461da010137a88108a8b1ff88a3db146f10ed3dc71b4c6740f6ed4d6a8e91d219e0a14e003871729143e2995510410d0332f946310f9f578c842b063f986c1b5f3b8a56e20c9b4c5189097b36f2e15f1019ab9222b586d7a5e6935e1d5a09ce07bfeb00c7c4e6c26f6dc6d3de35b6659c8929bbd4cb304b859920c595ceaf6cf50bc9560bd8f8b7cdc5f8c47a0c2767c6e15cb903faec5f093119f4267d2e935716357ccd3e6ed428efc4744f551a3c3d72c30e634b48d9723269d4e677da51dd996b18b7149fe120f7be75297fb265f0337129f20d283d5310656f46257cde4cd4cba7614202ef96562c163a0e2be6e4781ad4acb98b36ccb6a6964c0ed3545d03ed989f00d79de328c7a477f320a5b6ddc219a314c55e283d01d56b08af943f5980de490539caa36bacedbbd8a544324d10502fb5fb12bb92f872bf373ad8e98962fcfe35b98211ca3af72f67f5ebbec4129f580997c341ec4d30802eb5603198881c2fb2333c65fe04c4ebbbabcfb42d9140c4c10b9cba77d0fa7f8fe34fdc7bc3ee74185a14a3db342186ceabc3723398a9166158513945e37f5d516a6e263802c8664099f3377ad3c911bdcd3501b65c10e27cb0114925be75fffdeb158669ee1afd026c6e6c0b1d4165da798f5370d89a63c3fb50528b061bc6af8e1540cb60a29f9b1000ef67e7e7ba971d67fec3045afc377c64ca7ea02bc21f7cd6b24569256137d7cb876649bf9d08b8e8f1cc0e25bbc63f8ec2f4e97d85d45b8230b02a7f433175af2cb9c9275db658680658f6aa39e82287a89c9a1f357dbd10dd5d0b0c6a3509a4c688e87eaf8b663c85a25ae140a38003ff72522a3dc2d13a4d99c613d7018a9f6cf3ecd5d35c4324701fd64f377c1a7332524b6e527c8ec4af567c917935349cdf9c11250ac19ce682d6c1f5fd136fe698cee174baf2ea0bfefd897ab6b2ada9da42c11a713fb07a87d2ca257dec173fdacbd9f1231b8cd5f5ecb724d5c83e1f7f0ff99cabb663879fb024c2e62d4df2078dd0b21014466e9a1dc7e3735b7ac9164a4f8028ee1755f79d84639c8cfb1931095c0d64e92a747e3440d2986b0ca5538ef2ef80dd5bba487554cd70a91149fef03b2f37785a96815de4c63a5aa75f85806913fd37394cb6a2d91c8c6c6fc8bf9228104cda95a43cd1ff57ed3cd7b9ded5b3d52e6064a289f831b7c6f66bd65a6d1f358d83e0c43f733afae11741632bc717c91d5e6888170fb269289d5fb2dd6dc858de82f1837ef1fd1f557146bedfdf400747f8c0c012bfa6ac467448f02fd80fd05d45998570e4d2c02bb79681b1d3c611dcafdea9cf109de2834e76ef9627734248269fe21310eefad8b1287d3ede8fc4accfea4003862d7be5e064f9975009792c8e063f02639e99db4142f1cd3cae5681bcd7b9a133c7dd44cbadb30ffacaadd2925c3e8df965eaa33680329405d26dcb321f2b2bda44224f487d55ca1104f2ed6bf3e223378f51cfdd187e541b32a009b007ad0759f7488935abf9ea8b9b30c38c4c7a17164479b89c6c5e30a67ae3a76a419368402bfc8f6aa0a2377f0076f4aa3616e8f31e92ef9dc2f23ca42dbd3e466bd1914e99f5c020a6035815459c9e78e09938418ef69b9e4c8c6ba794260f36ebf7db749c360878f8ef5a7aff758505099e1d1ecc11e150180f781856bf5cc3811f28cac51364acba95f403fd03d3adea2b43962475e30eeee2e282fd479f8c4b1001ea602676f2255bd08a4ce2413a9499977f18a6b1197d4495a976143ac9758816c4589cad4b28dabfaeb168496cc7d5b72bad7e90f27587f6d0143bec830ce41058", 0x1000}], 0x2, &(0x7f0000007040)=[@op={0x18}, @op={0x18}, @iv={0x28, 0x117, 0x2, 0x14, "18e3ff1aeb8d68fd64c4aeafa950f3929248fa76"}, @op={0x18}], 0x70, 0x800}], 0xa, 0x4000000) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) sendmsg$nfc_llcp(r1, &(0x7f00000077c0)={&(0x7f0000007300)={0x27, 0x1, 0x2, 0x1, 0x9, 0x6, "f3312a6f815350647f8c3cc08f3c01e7c0e378d3643598dcec2e7614d34f68802b83c22942d3d8c5973b115e1b620a670c1e94b7e100a4db27c8dacb8973e0", 0x27}, 0x60, &(0x7f0000007740)=[{&(0x7f0000007380)="4fd593074c26737c984de3423c88c19362c4a72ba510e55d0bcd1a613c36023bf6ff4c1243c1cb4fabdbdbca900fc902ff0ab597bdb0043a109194db02fba6593d2b5f1bf909ad1ca57ad359d44fe66ce985845343ccd9ad86bf8d18271597e6550d31cc06e10baf69135d628c6620f4ff52f7940038b4398d33a3c673980a9b455ee4fb4f86004d6e3ddb3eaf90f5f531e1d6b7c10e9d", 0x97}, {&(0x7f0000007440)="50ff8c0ac1d692ac813651b60ebc0ee7de567b19703d7c871e1886e64ba33afa8011ebfe0a9b0ccb620ce5f0da05361d5cec463388b71c8e906c547f3cdc1618dd153d46e34526be9d09fa626bb71ff3eccf2052ddae808b16b7cf6897b399785f4b42374468f4d75bf313826956c58443d80c009086b5e1c531ca3f", 0x7c}, {&(0x7f00000074c0)="558c29ad0e190f2c5785c8d1a968fba2a86c9342d56e44caec9aea5fcf2c72e4d2ea12b587eb3d9e35122e90ac0b7e3a851799e5a118c5264f0caf330982c67364d696dbf477b032fce9300dd9c0ddab8a933b0353582d0acaf140bae8c48dacb0b2e9ae9d680a5525c9e9b95b083f857075de5b0d308ab3ec10fe78941ca9c38278a5b437a7ba4ecd8e21df9cce4c0e22c5bcc762c2ec83103c73abd9added04ad362625f2ac85d5f5e", 0xaa}, {&(0x7f0000007580)="e4b9993183d8180016ee9a26b6f075e2559eb4e5c6addfd8c6d0b2920dad3c758a61aa59cd2e34e011b1829162a108bca6a5c3e312c8b1646979286291ca6e6cd024687744312a02ffed7bb83ef60207b393c646d7943d8c8ccc46451ec6188b22dbeb0e8b24069a3d8f24ffa7ed48fd2d2b24e57c4458da1180a2e54fa4516beec12ac6d28eeddc50c60928a9f25f687119cd675b00417838679bb95759d5a7861a1457a6131f9c88da75d9288f40f336ccabc5ebcf71058e4e2d57dd340186387068887a42f9779f67140bbd869abd9619d11a4b77d902666db612070a0826b0", 0xe1}, {&(0x7f0000007680)="dc4cf49aa49040d220d1eeb849540c9b3bedd25e4818fab5dc4355b68816f22dad60c883542a1a54f35e12431a72ed3df8f670239b5c4d7f210677752fc4db9024753ed5cef7b18849cfbcdad243ddfb595939f6b6a35e03c8b4581678b58ca2398de221a2e601467a18b0b90f0b1ee888302f359d0bb8dec423e7dd0de9b022331ec7c543a85ad6b27245546738f3c923c86ae9df64", 0x96}], 0x5, &(0x7f0000002f80)={0x20, 0x10a, 0x1ff, "b99d1e0de91e8739891115"}, 0x20}, 0x20000000) 09:17:19 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630d}], 0x0, 0x0, 0x0}) [ 694.668914] binder: 9584:9589 transaction failed 29189/-3, size 0-0 line 2973 [ 694.682266] binder: BINDER_SET_CONTEXT_MGR already set [ 694.687596] binder: 9578:9591 ioctl 40046207 0 returned -16 [ 694.710218] binder: undelivered TRANSACTION_ERROR: 29189 09:17:19 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0xfffffdfd, 0x0}) 09:17:19 executing program 2: r0 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000280)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$restrict_keyring(0x1d, r0, &(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000040)='syz') r1 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x5, 0x40200) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000140)) [ 694.756256] binder: 9580:9596 transaction failed 29189/-22, size 0-0 line 2834 [ 694.777879] binder: undelivered TRANSACTION_ERROR: 29189 [ 694.783853] binder: undelivered TRANSACTION_ERROR: 29189 [ 694.811167] binder: 9599:9601 Acquire 1 refcount change on invalid ref 0 ret -22 [ 694.851437] binder: 9604:9607 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 694.860941] binder: 9599:9601 unknown command 1074553613 09:17:19 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046304}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:19 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f0000000140)=""/191) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {0x400000000000000}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:19 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2080, 0x0) sendmsg$nl_crypto(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=@delrng={0x10, 0x14, 0x4, 0x70bd26, 0x7, "", ["", "", "", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x44004}, 0x1) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000200)=@assoc_value={0x0, 0x6}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000280)={r3, 0xe9, "9812b8ea1ed165a5ad03948875f9329add3ddf720b2679b27550d5522011fb5eda0c24c23f9c3cdae3c8b327cde0318d7cc2c9535076f48a5e478a74792084185d281dfa3c3701a115521cba7eefb15f812bba610cbffb9a2ef08243bc4f9405bcacffd2e443953b119a1cc2311de2ea35debf99010488177c11d1a9dc46dfe4c07e7cc43d56a399b322bfe97dc82dfb69cdb936b763e9be75d757d4476ed8f922534589edf9d9f4bae637c5626ed35020d95a6e826bd34172834387818501ae6bc25f9a01d57f7974ebb169c6904b4bf03bc3ff07c34e86370735e612d3faf84f955bef51511acf80"}, &(0x7f0000000380)=0xf1) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 694.883454] binder: BINDER_SET_CONTEXT_MGR already set [ 694.886804] binder: 9599:9601 ioctl c0306201 20000140 returned -22 09:17:19 executing program 2: r0 = perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext={0x0, 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) exit(0x0) r1 = perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r0) r2 = inotify_init() r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000680)='/dev/vcs\x00', 0x40, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f00000006c0)={0x0}) getsockname$inet(r3, &(0x7f0000000740)={0x2, 0x0, @empty}, &(0x7f0000000780)=0x10) ioctl$DRM_IOCTL_NEW_CTX(r3, 0x40086425, &(0x7f0000000700)={r4, 0x3}) r5 = syz_open_dev$radio(&(0x7f0000000600)='/dev/radio#\x00', 0x3, 0x2) setsockopt$inet6_tcp_int(r5, 0x6, 0x18, &(0x7f0000000640)=0x200, 0x4) r6 = inotify_add_watch(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) kexec_load(0x8, 0x5, &(0x7f00000004c0)=[{&(0x7f0000000140)="e69c9662001a48d04a809af4082e054bd8c0e81eaf3504e24955a4c66b96d29ce974475438da5f9b7502052859e559f32a5033bfceda17de18bcf39ca8f144651ce476d5905b7f330a3a947c153bf40e01e98e1ffec39d8c2db2abd147ecc419b5d850f4320104198fb90ccd5b16286605e85d0233cefbb816df9e5ec6adceddac9c08dc1f362c909200b331a1b32f8b2d9cdd980a0b1935c755a6d1964701f7b2497672bd4f4e44d4934e761d5aa0beabd5fdc6432eaa59145490edd51de55a46bbbe14a45f72dc37f348", 0xcb, 0x80000000, 0x4}, {&(0x7f0000000040)="b1695762bfc0c5d81de94bf7321359214fc41269da66929138ce2d92ebb9bf1aca", 0x21, 0x3, 0x1}, {&(0x7f0000000240)="1b151fb06dd10d0928c7ea93226d6d14560eeb38affacd33e1ee2936458f786e1e52bd7265d14a141ab83da4d1cb714b81d8bc068b198863b27bad817f6524ca46556642dae35428d71a42f94858a8dc07b816c63da7f6fa7f33b5c85d910e7e7a2323d50e67860d1a5b94077fcc1e5d9d5f832264eee676b92864ba87a95faa474a4456609daba3a9c9c9db72037b7940aa9c2b0e8bacaed82e6023c7444f245a48bd8d65316a5df07fdce8b5534cb3afdacf681dcd936bdce0ec69288a4b7583ef8b122c7f6dc2483f", 0xca, 0x48, 0x8}, {&(0x7f0000000340)="61e55d3e35bbbee8bea8dc6b967c9d0841063b7738f474bc2ad6193da81397b9fedf02f1e3db1962322c363b68455715836b31396616cf3a1cbdedfecdc4bf6755962e2750e802e87da1e035c40af2b9e2e39903b4320926b239ba679cdddb07f96503f6bbf4c1af7dd0ec06b9262f27fc51de8368e57f36e7c9fe79c6370e5029f4bdb6d85b4973f0ad5238b0bb46d5fb4558f49de60dc71360c478c79b79fe58aa03cfdb5bb8a67ef91362884bbdd44069e479977955", 0xb7, 0x0, 0x5}, {&(0x7f0000000400)="3fb1025efbac4be430a823c6a0bdda18ef42c507ecb188fa695fac1e2f76a6582ddce85550cc3e94db3679e3bcd2e2c9496b5b59472d99ce2a70f22d3b9ff4dcb78fbddef3a33ea416ee8020e7ed12fa1ccec6ca01f46f31126713e50a39b985edabb2c30a6fabac8c1f31f259bc8ad8efaa1e480d8c418bcc551a74fbdeb1ecf87abb2eadf8f4e0465eb9ea38c3f32493adcb003d9e52498c27c9b27fbb01824eab641d80d3897f7906b7429a", 0xad, 0x800, 0x2bb}], 0x3f0000) inotify_rm_watch(r2, r6) perf_event_open(&(0x7f00000000c0)={0x8, 0x70, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r7 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x200, 0x0) ioctl$VIDIOC_S_MODULATOR(r7, 0x40445637, &(0x7f0000000580)={0x8, "8879b7ea6f8e392c5e7ce6651e36dd99e58e1810e8a8a1a6cc032757b519eda2", 0x4, 0x1, 0x4, 0x1e, 0x1}) 09:17:19 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x5, 0x1) ioctl$TIOCGETD(r1, 0x5424, &(0x7f0000000140)) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 694.955115] binder: 9604:9610 ioctl 40046207 0 returned -16 09:17:19 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c634b}], 0x0, 0x0, 0x0}) 09:17:19 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x600000000000000, 0x0}) [ 695.023954] binder: 9622:9623 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 695.061804] binder: 9622:9623 IncRefs 0 refcount change on invalid ref 0 ret -22 09:17:19 executing program 3: r0 = socket$inet6(0xa, 0x0, 0xfffffffffffffffd) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x8000000000d, &(0x7f0000000000)=0x5f37, 0x2) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 695.074431] binder: 9629:9632 Acquire 1 refcount change on invalid ref 0 ret -22 [ 695.089340] QAT: Invalid ioctl [ 695.099052] binder: 9629:9632 unknown command 1074553675 [ 695.105219] binder: 9622:9623 unknown command 0 [ 695.111639] binder: 9631:9633 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:19 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)={0x5, 0x0, 0x0, {0x77359400}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) fsync(r0) [ 695.117957] binder: 9622:9623 ioctl c0306201 20000140 returned -22 [ 695.141049] binder: 9622:9641 unknown command 0 [ 695.145778] binder: 9622:9641 ioctl c0306201 20000140 returned -22 [ 695.152729] binder: 9629:9632 ioctl c0306201 20000140 returned -22 [ 695.165900] binder: BINDER_SET_CONTEXT_MGR already set 09:17:19 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x80003, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x2, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 695.184229] binder: 9631:9642 ioctl 40046207 0 returned -16 [ 695.199126] binder: 9631:9633 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:19 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40086303}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:19 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40106309}], 0x0, 0x0, 0x0}) 09:17:20 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x48000000, 0x0}) 09:17:20 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x480) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bcsh0\x00', r1}) connect(r0, &(0x7f0000000200)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x80) [ 695.301521] binder: 9654:9656 BC_FREE_BUFFER u4004630400000000 no match [ 695.316302] binder: 9657:9660 BC_ACQUIRE_DONE u0000000000000000 no match [ 695.323519] binder: 9654:9656 unknown command 0 [ 695.344406] binder: 9654:9656 ioctl c0306201 20000140 returned -22 [ 695.358923] binder: 9659:9664 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 695.367391] binder: 9657:9660 unknown command 0 [ 695.377651] binder: 9654:9667 BC_FREE_BUFFER u4004630400000000 no match [ 695.379462] binder: 9657:9660 ioctl c0306201 20000140 returned -22 [ 695.400901] binder: 9654:9667 unknown command 0 09:17:20 executing program 3: setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000000)=0x4, 0xffffffffffffff41) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 695.405751] binder: 9654:9667 ioctl c0306201 20000140 returned -22 [ 695.415322] binder: BINDER_SET_CONTEXT_MGR already set [ 695.442682] binder: 9659:9673 ioctl 40046207 0 returned -16 [ 695.477183] binder: 9659:9664 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 695.812520] QAT: Invalid ioctl 09:17:20 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x6) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e23, 0x1, @remote, 0xffffffff}, {0xa, 0x4e24, 0xcf802b3, @dev={0xfe, 0x80, [], 0x20}, 0x9}, 0x0, [0xb36e, 0x8001, 0x3, 0x1ff, 0x2, 0xffffffff, 0x6, 0x3ff]}, 0x5c) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000040)='hugetlb.2MB.max_usage_in_bytes\x00', 0x2, 0x0) sendfile(r2, r2, 0x0, 0xf9f4) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000100)={0x1}, 0x4) 09:17:20 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40086310}], 0x0, 0x0, 0x0}) 09:17:20 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x400c630f}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:20 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x400, 0x0) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:20 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x2000, 0x0}) 09:17:20 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = syz_open_dev$vivid(&(0x7f00000001c0)='/dev/video#\x00', 0x1, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000200)={0x8001000, 0x100000000, 0x1}) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) fgetxattr(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='syPtem.\x00'], &(0x7f0000000100)=""/190, 0xbe) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 695.918799] binder: 9696:9704 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 695.943237] binder: 9698:9706 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 695.951394] binder: 9696:9704 unknown command 0 [ 695.952430] binder: 9702:9705 BC_DEAD_BINDER_DONE 0000000000000000 not found 09:17:20 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000180)={'syzkaller1\x00', {0x2, 0x4e20, @local}}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="08fa9473a93da1c0a131462337316fce0000f2cdc2b64a2899680000000000000000000000000000"], 0x48}}, 0x0) r2 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0xd6, 0x400000) fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f0000000280)=[0xee01]) write$FUSE_ENTRY(r2, &(0x7f0000000300)={0x90, 0x0, 0x6, {0x4, 0x0, 0x9c, 0xb9c7, 0x5, 0x4, {0x1, 0x2, 0x3, 0xa65, 0x6, 0x33, 0xfffffffffffffffd, 0xfb, 0xb34b, 0x9, 0x4, r3, r4, 0x10001, 0x3}}}, 0x90) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="010000001000000000000000000000002edaf4556a0e64614f6786c04b56428923a029725176d0efe41198e1b5df337ba191897e0414ddef8fdecc2b151be777aec0cc1f4236055338be334c140760e6359831c5cca270b6537646af35015651f3ec0ee9c5030000000000000013940deb1a314f5f1ef965be64bb28d7abe51b69bebb88a3e7b1f86eb634c59aea2c6e88afea71b5d1d89fc1ff43fcd1110da8b2936d423736f81de5da6d59", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:20 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1040000000001a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 695.966493] binder: 9696:9704 ioctl c0306201 20000140 returned -22 [ 695.967470] binder: 9702:9705 unknown command 0 [ 695.973613] binder: BINDER_SET_CONTEXT_MGR already set [ 695.990595] binder: 9702:9705 ioctl c0306201 20000140 returned -22 [ 696.001676] binder: 9696:9713 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 696.003888] binder: 9698:9711 ioctl 40046207 0 returned -16 09:17:20 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = syz_open_dev$vivid(&(0x7f00000001c0)='/dev/video#\x00', 0x1, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000200)={0x8001000, 0x100000000, 0x1}) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) fgetxattr(r0, &(0x7f0000000000)=ANY=[@ANYBLOB='syPtem.\x00'], &(0x7f0000000100)=""/190, 0xbe) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:20 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x4c00, 0x0}) [ 696.026041] binder: 9702:9714 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 696.050418] binder: 9696:9713 unknown command 0 [ 696.069744] binder: 9696:9713 ioctl c0306201 20000140 returned -22 [ 696.108696] binder: 9702:9714 unknown command 0 09:17:20 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) ptrace$getregset(0x4204, r2, 0x6, &(0x7f00000001c0)={&(0x7f0000000140)=""/121, 0x79}) 09:17:20 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046306}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 696.130855] binder: 9702:9714 ioctl c0306201 20000140 returned -22 09:17:20 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80, 0x0) getsockopt$XDP_STATISTICS(r2, 0x11b, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x18) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:20 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6303}], 0x0, 0x0, 0x0}) 09:17:20 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) read$eventfd(r2, &(0x7f00000000c0), 0x8) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000003c0)={r2}) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xd4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000200)=[@in6={0xa, 0x4e21, 0x0, @empty, 0x1ff}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xb}}, @in6={0xa, 0x4e21, 0xffffffffffffffc1, @ipv4={[], [], @rand_addr=0x6bff9d3d}, 0xfffffffffffffc00}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xe}}, @in6={0xa, 0x4e23, 0x40, @local}], 0x74) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) write$FUSE_POLL(r2, &(0x7f0000000080)={0x18}, 0x18) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)={&(0x7f0000000180)='./file0\x00', 0x0, 0x10}, 0x10) getsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000100), &(0x7f0000000140)=0x4) [ 696.212717] binder: 9730:9733 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 696.268845] binder: 9734:9738 unknown command 0 [ 696.271658] binder: BINDER_SET_CONTEXT_MGR already set [ 696.278860] binder: 9730:9742 ioctl 40046207 0 returned -16 [ 696.304317] binder: 9734:9738 ioctl c0306201 20000140 returned -22 09:17:21 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x800, 0x0) ioctl$DRM_IOCTL_AGP_RELEASE(r2, 0x6431) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x1, 0x2) write$cgroup_type(r3, &(0x7f0000000140)='threaded\x00', 0x9) ioctl$sock_SIOCGSKNS(r3, 0x894c, &(0x7f0000000180)=0xf5) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 696.321991] binder: 9746:9747 unknown command 1074553603 [ 696.340524] binder: 9746:9747 ioctl c0306201 20000140 returned -22 09:17:21 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x7a00, 0x0}) 09:17:21 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) eventfd(0x2c60) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000100)={{{@in6=@loopback, @in6=@loopback}}, {{@in=@broadcast}, 0x0, @in=@multicast1}}, &(0x7f0000000000)=0xe8) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x80000001, 0x460000) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000280)=""/4) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000200)={'bridge_slave_1\x00', {0x2, 0x4e21, @empty}}) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 696.362881] binder: tried to use weak ref as strong ref [ 696.390481] binder: 9734:9751 unknown command 0 [ 696.404705] binder: 9734:9751 ioctl c0306201 20000140 returned -22 09:17:21 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6333}], 0x0, 0x0, 0x0}) 09:17:21 executing program 0: getresuid(&(0x7f0000000280), &(0x7f0000000300), &(0x7f0000000340)=0x0) ioprio_set$uid(0x3, r0, 0x9) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0xfffffffffffffe19) r2 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x3, 0x2) write$P9_RAUTH(r1, &(0x7f0000000180)={0x14, 0x67, 0x1, {0x71}}, 0x14) inotify_add_watch(r2, &(0x7f0000000140)='./file0\x00', 0x11000000) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000240)={&(0x7f00000001c0)={0x1d, r3}, 0x10, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0100000001000000000000c01003000012bb4676aabdd351dfd2b40a57f7c9e52709e5704be38c8e0abee03195ed03476dfa05817792e18578c6fdadec87e84eceb5e9c301899cd2731bebce34ed11dace2748aa86cc99f479e249862836e270e44c091265840f904ccf3251a23ca759c02179e1b4c502cc8678673fee81a315143964e0e2e27ecba049437ae28712433db057cd256208443f7e3ee043ba6c14b7aeeb494b022faadc7dd8bab435339dc2b76488439823a2"], 0x80}}, 0xffffffffffffffff) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x400000, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5387, &(0x7f00000000c0)) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000007000000c2000000005a34a59932ac27b742"], 0x48}}, 0x0) 09:17:21 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046333}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:21 executing program 2: syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x7fff, 0x880) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[], 0x0, 0x680}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x400000000000000) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000200)={0x0, {0x2, 0x4e22, @remote}, {0x2, 0x81, @empty}, {0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, 0x0, 0xffff, &(0x7f0000000100)='ip_vti0\x00', 0x9, 0x1, 0x80000000}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) write$cgroup_int(r2, &(0x7f0000000080)=0x80000000000000, 0x297ef) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x100, 0x0) [ 696.485012] binder: BINDER_SET_CONTEXT_MGR already set [ 696.548625] binder: 9760:9764 ioctl 40046207 0 returned -16 [ 696.566047] binder: 9765:9766 unknown command 1074553651 09:17:21 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) ioctl$int_in(r0, 0x5421, &(0x7f0000000000)=0x7ff) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:21 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6000, 0x0}) [ 696.597325] binder: 9772:9777 unknown command 1074029363 [ 696.600730] binder: 9765:9766 ioctl c0306201 20000140 returned -22 [ 696.627394] binder: 9765:9780 unknown command 1074553651 [ 696.634358] binder: 9772:9777 ioctl c0306201 20000140 returned -22 09:17:21 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000140)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000b21ca0b29932ac27b75cadcd43b7bc015752a3f73fb1b01c24c49e97c8cda30e662f368daf5c0b58e5588ff763ecc16bd794f4dd546261f0cddada540cb345ee6fa7ad9414f11d44e768ff6a8e3ee6590a8b9cd02ae86ec67c70ea881f9acbce2f1027b184e3417116f88b0edfce4f"], 0x48}}, 0x0) [ 696.687952] binder: 9765:9780 ioctl c0306201 20000140 returned -22 [ 696.720986] binder: 9772:9791 unknown command 1074029363 [ 696.745581] binder: BINDER_SET_CONTEXT_MGR already set 09:17:21 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6309}], 0x0, 0x0, 0x0}) 09:17:21 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) pipe(&(0x7f0000000100)={0xffffffffffffffff}) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f0000000140)) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 696.776896] binder: 9772:9791 ioctl c0306201 20000140 returned -22 [ 696.790170] binder: 9786:9793 ioctl 40046207 0 returned -16 09:17:21 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r1}) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000100)=0xfd, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:21 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40106308}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 696.880606] binder_thread_write: 6 callbacks suppressed [ 696.880636] binder: 9798:9802 Acquire 1 refcount change on invalid ref 0 ret -22 [ 696.903054] binder: 9805:9807 BC_INCREFS_DONE u4004630400000000 no match [ 696.920839] binder: 9805:9807 unknown command 0 09:17:21 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x3, 0x0}) 09:17:21 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r0, &(0x7f0000002b80)=[{{&(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x0, 0x3, 0x2, 0x4, {0xa, 0x4e22, 0x7fff, @loopback, 0x13d3600000000000}}}, 0x80, &(0x7f0000000440)=[{&(0x7f00000000c0)="77a4bec8cce91a720a4eed41fd9a8cf129b93c796a89f9811271e56632db54a54e53e62a6273ce3456fa09e1404f04e5826500fe7f9ed4b183a8143b6fcd135618537e169241e22f16e25e224ae6c35a137c61dc8ef8583eb310f80360d352", 0x5f}, {&(0x7f0000000140)="e5216051b9b63ce8eb1d47f8c085a254c7b79fd444a1ade0f62b4661ce5fccabfe738e8486ed39b9ebb469479e58984b0037b6556df670b25880811ed7e6119b67a18e866ab4736e946df0c951f3007906d0c9c8c57f88e9d44cb6b88c7b33ae7599289c807e83d8b082bf3fb674f6ee4590f9b5d095", 0x76}, {&(0x7f00000001c0)="d6be030454f0815ee21e69db2e64601e454f488a58ef31d0003bb00a56347a6a", 0x20}, {&(0x7f0000000200)="dfd90f76e74d27bd37a518490df64d574cd86f0128072b7130a20f04d1bc7f62d6e6d63249dcf4a98f0c5abe2784c48c5cb37465fa5e6df17367de3a335feee0ecb68f04b7190462095721967e7d765ca2409390dbe6212fed274a7325c0243162a49d92a0f824c0aad259fd543672cf84550e00d2b85e22b785f90192641cc3a9d7cb969d47ec11ee3a144e20ca284f", 0x90}, {&(0x7f00000002c0)="c4521a0b0b9ed1088a93fbeeadb9df787d7586aab5f4b494c1765c99f3cb4d513d66ec5e2d6f9c54cdd9cff2e8071a1a754a00c40fc4e5c19d156685145b582710b351060ced733f07363f65e59e8ab1c515a564def5f0dc405c1c112794f27ee2fd3ca700d9fafb48365cba144eee947aad9286bf8381848297741601", 0x7d}, {&(0x7f00000003c0)="7a5a842371e37a7a369fef5bd32a7ad9acea2836f435ad0945e3e1a5ccb0bae26207dea4c59eaf0ed53ffea9ddfc430b411bc1a07d7015e1a3669e1b06ca485ed1e0e898bd0886fc6a48732b86bc19e55158a7cf3ca1f87537b5235ab0228c5eda0c0a821e42bc443e648711c774d3a8f52a342b", 0x74}], 0x6, &(0x7f00000004c0)=ANY=[@ANYBLOB="50000000000000000301000001000000cc951ce5c1c271e3298990983ba55cb3fcdbe55bed3ab4b367acdde1b108cd5cd95a037f03f3a8c58cc5d72fec0f6bc3375ec63d18e4ac843fea20c7b2000000d8000000000000000001000000000100b7c95bc753732803258441d68cfa272d2bbb9f86043d36d6b1fdcbfad2d466a334c0dd3ae80da68de5838cc312b54c698fb527250b084f679a4b765b4b3e0c6a59cf4e2da27cc802ea148220a3ef67522bb85f2f114720691f3de4de068ab43e291ca1e5aa20a13c414526477ff4030f2d1a8e473336eb74db415672aad4a48f4cd4042efadfdabf461f07a5d06221d00a6096ca785e2c1b0d588419ffdfb1fc47f434863097f9bea7b600b4112b9c7b6bc228136d7ae939a35398259f953448b362d0b3a00000001010000000000000110100000100008061a600ed3a7c38ec8ee2fd1449148528d928d10f4456a660fcd27ec429d54ca519c338a6b4411d6b95efbde9f59dddad17a306e4718a39400b2919fbc343c5c1e681f1ab0bb4f1ed56408f4c745e02b1c026aa4d40e3b5b44b37a881ef8769271a915ad105365fe3f4d1e2b932ae091a425fa80f2d2522c5b19b0f852030ffaa7fc0546289faa4d9b53b1a8f0e172f6e896a1e44cd9cf9e57ec4a2c3d3f766f49b4529c9799d9e83397eec262079f04b4689d5a39521ca65226ec815f52b592727c0eb05c34e545419cb4278894add576ffabb6af5f238d906358f784eade8f6e0289a0136eb7a5cc6865ac553c03972ba6a6b060fb1852a5464f31595b476d8ae517dd77ee9350910dc7f568776154e50d4d287a954618a4436b239b6428abddefc828231d1b4806c07549d07e5198b0aa0d4ff1b87ea1296c91beb3f021de090eb57268e9dc805d6280edabd3526ee4b76192d506767edc83b9b7c8729126a5e9e085b560e408f0e4fb7ab74974cf6edf1c046e071f99642bb0ffb9dde33490463275b7dd79404f29b71183692f6b773db87a8d5b1feca5ef611a78935445a2a28f022820472aae24abf7497399a9bb5788016d7202b8407c641fedc6de380016dafe0abe58965b198c913540296b3f676ee8e828c503e689cece668f09d0810ce29cdb1155c5716eb13960202eb1212810e4522d827bba1eccddaba56cf668d49b19f3cfa26616babd79dea3a44c2adb37f78b758a87c2818824fb9a8461faee79f4ae5d56f6ee2c94fb119673fd1b21382b3192b8f5c366cbb65c8a361854d33b4427a04c08d652eefba80734bd143619ef7fdc7cdbceb6fa7fef3a13d88954b6354a98954f6cfc650e5900d51eb922fad4db2fc6e3c618d13e080c13d66b926987487fddd8e86ffa404987b8c4aed0b4899e5b618a02d0c96345cfc54dc386586925cc69e550aed4385068ce70581d476310637b9bde28acbaffb0061b42c0f49854c37031f55e98074ade68725dfa97cdc06ceab3b01c11ee94453ac15734bd8778926660679832cfafe985f26722f13f769aafada1cb8aee68d69f78657404b88e2c15b613a8e13ed54aaa215f062ec47c1076048cf34c1cdc943626b8398b843c60badc2476b900c9a9600b6196a51943d1eaf76a471419d5f015e1ffa4d14b99f948756e291320e2601161befb939c3f3ff2e15f25944856ff64cf922c1381de133d1de996bc62f7408ef8e5d67d20da80b13992c81ff06271bcb30e815b1de1e677cdb43b52a1ac6994d48078d26b4fc71107458a1eae407b65c1c354532d736adbceec83ce7546a83eb9f525292d7fac4b46790a669caaf18f745a38930cc4046c6c70c9936404748f64fa6ed552af745cd46db65e41e53e02f8c890704fab49ad39dd672d9557c3b0a1ff1faf3ae2988f1c4fc8b2ab63042f2894f635195fbdb55dd24dc2d46202804acffd85623a80d4562287c8cef5b372aa3839f42982c4a6d12e1984815cf5ff658e172263bd01749155f3352f9fc379f1085433703a99a75c561b70844a04a1470a108923692c6502943b06bec65f668a364a05875be19619ac0c9f62ec0b3b9f9aca239ef768aaffaf61bba80d7bb289d76fdb2b8e21779f5627c33196e67ed7e436bc8cb0aaec4b348ff1bf3be271e9a7bbbcfa0b8bdff76a2475b6a5852879f7ed43d309e046aa85e703bdaf6a80c81eab6a63b604eba842de08cfad801048a7550d6e2c8af832855207ab60185aeb0753f62dd27d4d4534580697d99df2b1d97d1a0eab1cd3b00a96da73652d0174384778d4f75c7ddfbb2401130421747745dc59458cdb5983868ef8b284681dc31bb495ea35aac2d9b4ca8f03ad5e25d0a4d007c4966d7856ed3ff828d687b7569a3bae9b062361dc3988b2e50915c5e113f993aa0aea474917e0f9e95ad97d16bb1ed9074f8ed288ab7569ebf97080c590651e7197d1f6130ce8196c072221f3d9165e600fa234cf76587285417d8724107c791f0d6918e1d67a41a921bcc86e7cb5824675f9204a7447a0d42f4d4420e53b47ec2a0e7d2f1cfe7cccb61a44caa61b6f21e636fe20313259fb0e3e53669e8bdc34e4773e7e7062de7b416a331ec9f272ff54a458ac6de803b41504ecdb53d9bf35f4f38482cf530647034f5fc6162caa8d6986ebb033d90c211ba3d6f6a96174e87142a2e6da21b0ac0493a5deafe8e91d49f937da5d19e30d2713dd0831f117355e828f2090031c7431a056ee61252fa31e339755ce1ad55fec8739b66649769133853fb1a4fc3415e9383e5ad74912e367c0382996dab55bebdb243d144071039823d5051064446f9f6c2ac8ff849e91464ea3142c917976520687b00afb8a0b6184439ac2ab880248cb6e9f8853fca3b8a4b57efd56fe8badd2f3d28f05e8eb62eafbb4757b06773385d78a7aeac2a3ddb018293bac6168d7e1a9df94c9aa668a81369d91fcea5776c0b83ac669b75a666c0684a633946551b0321745768f239a30ef8d2c6fa73f9686fe948700c3cac1c4faeeb74519abcc3bc957a369ffa47db02161a74796bb8b9c6be5a203c53afd6ceae5b4e2e16e3c14dc4d23bd5715a8322bcd2c54c5532571fed46c282ef9b2abd7b37896aae6023452206b8b23cacfe1f3a1eca88e3a7cedfb620def1e7dfda154fad5a60f48476daf8437309eafbeb153beb89f9d49c409ae4ff1aa2aa6ae5b0d89dfaf67e1bdb53cdf990759250ecea5904424ba4ffe196d21ebb996803ed3608d13758081181ebc82991bfe079e0ffddd5ff73059652af9bee1580d387a45739729df56ffe7b44b67ff896c6a75c3d315114518688af9d582f5e329ba18cf50acf604723bc4fde4d8b74f88c4b38f4ded0ee7dcc6121a1eaedcc7ccf51cba7b53d4cd33c68ceab7d3dfdefcfdc93ee407dd2411cfc600f66f63128be5db6be062a3f13294e9ef02fa717e48b9a22beb6b48936e22c86f23963f96acabb9f0ee99a52008ea58125d52be2b5e13fd372e97068eddae3561fa785d06089d41ab92278af8d9a9de53e494c372d79fb090983f1c965203dbed4c5f6d104de898f68ba0d8ab9cc45da111d03108ef79392d8b9d9cec13a99214a3adf4b8aa6768a61463ab1974a6c737cfc36b524aca056e850579579b79b9566983cbabff65c7c62994b815532c2489580dff625ba55c4f5a940b7e3ee66c127d4afc8e2ab2b928d80fb68abb7a7f02a9e08e7ffe9b3e5c5a13487e16cb07338d7d2cb3f33179790e4b440d638aa905ec9da4b5b33fe0187ef0dedb44774c547532cea272cabdd1582fb43e9ce9a17fe08b391d7916670209725f8e48b955a229d96438c8af15b8b081aeecf8bfd2fa86790cbeca36dca98e0af94c5faf6146a6d46381e61fe8e825e5ec103aa9e9feb9add25caa764d630d497f11b455464a3986a898adc50cab765d11fdf48e28a82a600cc425f61ac4b3b805adfeb2365c857e085002a21510e1042437c215ddf4351f2918737a495c48011c3953f184c2a9ddb289d0387b6a595abb889fe2e768daa0b46a5bbe172b84e234455f1735d2c959b81a1909f059d92a33735ffcaba8e2164245a329815eb92c2460cab983dc34959a15002d6eaee97d98d90f2ed9b3b616891abb814177465e328456d8a592b4ddf5b1ee2d7563bfa8d035cb3c2b97cc64bc3b0cf89e80f66974cca717e376f2d67e62c781d5c7beff86d1ca1da74a7ad128ecfd8c3e63a5bf698ba31ad9f1a96340c9b3e6f1580d52d83d12ec8a292a86a3507faf5edce00319fdeff0aad05e1cc05e3285e23dd5b13aa1b69e444934baf4e1524fe0e806bee08020ccfd4c3e6a06a96feff6f96e68d81e8856c483af33995673ffe943a7f78301e60787d86c921531b5c515eb73d309e5d3224579677d409a2980c9039965e11d9c6bc023b847b10242f4a4a2dc6d8dc109bcc847a30a62979342278be76606471cf2015f46d6cefcbd0bcfa5c26435a91791f153af9ff7e4ef059be3b452c53452c875434781c2787083577b0c0e7385a08b620da0b43041574a7cdff7bb171f1c374ea8d2c8e2e6edb6116680acf43047262a8d6771466cfe05ee3fdb077d9dacc14124b797951c2e76f53caee9bcdd165c20c69f4e190409a3ff6058dc2e1ca45f410f6be929262b3d80a6fca431a6d781608b5b973a4974a997eba0354f735b1c306e22a8e3cd9077f8a169b59be94003b783c54b18c0e04c89750457b537bdf9ad7b6802c58f765cd80f298417bdabcff631863eeecfa803382324e2f4be4b196c8ef00005ee5f262c3f50bb63e5abb503fa93c50be7085db9685ad20b8c8340094db5bb6a6549b85318801b9dd85cfae6466e6fff4267065817a6de9d899a9c549b216229c82d5a6fe54e6fdb55174a215fe40bec1e3697aedc5d3053c2acd65e2b5758de494b57a445fa2b2e770bc7d020bf251e86006f14da82b51dbee9daf25f22f196469a5ca4c7ad73e08ccc8675074b30b2409d6fee4b9ae16e13a5bbeee594850007317f07bf092901f948dff70d642814361eb9ce77106170e8bebb086361d9f9f1cb5a6146eb370709910256bb4f4b85e159dedb9e50d3314ef41a0550e70614dca7e1a486c7dc94c8244822c7f21b53353ec529c8023381f7be5690545e468d21559a310dd46f94ab5c8f62a139f4f1682e400e32fe413b94a2990142549a6e7bc6ff5717d132f093e347d3a8815f01de5522fc0b00031d83dfe4d342e88391b5077cf1dbeab0b460bbd015bc0871fc4348e66e095b3f8d67c0e76de9a7a50e2f02db3a7b39eb016d7f752e0135c9f0619b72d39bbc00624b691d1726f77e11cb91c004d73ec85e2550eb2ea1ff1ae6855c2640592a72a8334541c9bc990db932c3e4dafa4a0e771e9f07c98f99d4d65741ae5eff6a20382e208788d9c6570f01fc30104f240491b80ed9486fe4a836f807b98a4c4e68c4b3cae2371e42d467b4585f1b8a781da0479b14e094af000a1e70a741fd52e5f9392765478eb12b418e72bf7c166c43da59791ee1fbeb889001daed85e13313d2ffc79cfd954a2dc291d026f177e88a2a7b986a2cc68d7d6b5ec850646b7f867aae8d90c34bab46de883b3d32159f17b0b943d6266971d75349b84f9026ceef7f0f8a285f05cc1e505b697525beb4cf15292cc4e1f1aeb38c168ccc43955d456784bd78c2d3bc902f3a19fe9b53a759d8cf464f638596f6c078d1f9d7bba5dc51e8c1a576500418d303dfcc1b9ec905c7cf7d7691bdb8752bffca62c1283aadd123f4ed3320e8681e21bef5f4492a989743e600a837fed4ed0f71010b7b8441c38b8301286b617afed154ac8137b02ee5813a4fe9725f0514f514469aa66be621560389fa8529af073b9d88565b1664df32192e62bba6d551503831369c87dd3c9914818243c5e58a5b5c4c2471284a2d63f22e483cd0d00f1c70abc5425b29c91e959dcb13dc925a13306cd73c38045e9ef6a068b5670e8c1d5d54f53459211f6f0fe42a74b00ef8a8e3f94d7486639acb8efcd9990acd768eab77a823ffe053c7c22e17469c1d2f5305e3e414d84dd95adc81214422ce7e846d05f9ab56b4ddb8a419824c1928abc7f5c3c5c27c6a4d0dc8d7618ec2006c2bfa4dc566ce467d88a6eb504952c6a43edb04de0b033c0b509912ee78ead8d9a9a49281a0598ce400610d27afb600a07edf85d8497b62671466b1b3277647f04b079505abaa68623ac3040c72801837e8e9ff30e4b4e2f4b06dcd19945a000658e9ec77c07b5e830fc991f83912a5d68000000000000000000000007000000b625ce166ec0cdd8214d68872d9ecfdf846393c9b114884677b8c264d600b71643386326a13e6b0daca825a3a12214d86044e3f19d0a88d0eccc97b5188337a888de1e0160d4000d38669ea8098695352688c8220000000020000000000000000e01000001000000e2a6bfc31eef494b4076000000000000"], 0x11c0}, 0x5}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001680)="b9fdcdc9b0146a9b19f2b98c3177e218eca72f4136c72641795fa94b1eb69c73617ed3d9d225bc5912ffc7a35e36f9a5d88ed0efceeed20fb1eaa2b507ac0b8d95bf6ab090a12e3984fe628fa225c2a4fc492be9676897268b7418e15cd4b38c9dd11b730594bd0171323cea17227efa164b1c4f7ac07f24bbb176b829606f9ada0edf1fc7831b55ede35a26912a2790071d9e71dffb5485eaafb84ac6495185c9ac852e1eaee223e960e48a1cf7e38383fab9b90263da8ae06329223915184ee2e0b6c192b224e5320dd709ef16366a47709d5ef3208c5300365f33eb4cc9f1a1035a5fb879b5d1fbadb02cab5dd5570a0b96303b5e9dff26aef4aca77390189fcf2c1371e2a9c548aa6776809e1e307444533eb271e940eb6c384b9d2868e05b94f22f31c05665d550a70f84cb6f8c40fa0e7fb13a0f74d4943fc6a89bb21b864cf891c2c31e304df33727929c59d49faa02969779e7ff991eb4cedd7eb0043d200abe7424e8f463e79bde852db14103b6bd3b79c85461ddc89f2152efacecb01be049b9bdad30729c62aa79df6a00c8c19d8dac611e647d07e8f2f5d13038628119ff7ce7e84ce36e476e713890bda0fb24e9ad235e5c74431b8a103fa413c44b23bb3c81f2797defaf7852841cf51f7c2657c1f840c2acae158cf22012d089ca01c8bc68f991db07e071cc4002efc0b7711b2d919b023982db4ffc8ae238ebd4bcaab981d655c28a84f464bdb6c87cc6706b7e7e8e51eaec4c8a8b58ff621366e25dc6825eb6d8a085bb8346b147ff5cf5c6303ef8bc037e5a2da5b9f2f75562367b56a6a56943ce9e216c675ed10bd0983807813e56d4432eec55580b12d16d74b2aa021500f253aae645bf979dab6c6140869a6662530c32ba9522a012bfd6908f6136226661a56bfd584b95857b800aae378bcd5f1a15516a56846c00bf32722e2edb9ba263df978b18b7762c818d6b8168130e73c0fb4fa34324c42e8ebc6f297e6b24d08fb12e32ad8f3abb5ee19b9d7cbca5ae2bf4a8d8d8c11ef704ff9beddadd4d2ea507d5a7b61ab019ed283ce0c310ede3419351a6bb1ec5cc9b45e590ca0fb584631e0df746df0e6533a58dbf0e930cb6b8ecadbd0a7c0c99a93387031da363c05fc1f53ca0c2c246d2b1c4d57e53d55fec37d470074d37524a5abbad40e50ff36ab3aa058a7b11fc03eb9271daf3a5cc17377a4595fc80fda037e3091ab14687003cbaae8b74897f5724ab26249442006d2a9f470faea0f2319e9c9200dcff3bb3fb1cb78605aee00dce5641ca71abf6faa16b13980a671bd27312cc7256bc1b53523ce307af580cabc1c90aa716da34c018ae7409c8bcb34d8c4cdfa65008715b5cd9d5d0f465c8e44bf8e9f2d3cc02982ed280225a7cead63e2a545b2aec184a8e9e21b743c1e7b8a18c484ff842ca358ef9ca78e752139b0627b8c7ac5dd0528802c2de4bdb65c8bf2f93b3286c29c77ea91e36ebf2d3b15760ca40010d89a66864ff4226712b16d08a49fb5e65106f744ee85cb3924b11d37a813d77e4b166cda9a1b10a3cf70abc75e83fdbe849764503a7906db4fcd1c0964cf3b04968579c2cdf034cc5fdc311a26288a90330734dc746068ad69de53a8272a9824a1aa1f2e5238dc0f59f4e2665ccd1f99903b90d29c27078fd0343434aace86fdaefc598c3d87bf6dc72ec6aab1a4db1ac915f813e923c12c229791f74730cbc16cd886bfff333a0656820afccd2790cb25c7e8d176ff77007259e74db592014392ea7032c2acbb7dff76be1ec61e02989072d9bf8f4a52443811a2acfbb24ea9ba5aacd191282ef13d4a106878fccd51f1ecca12b46e7a379692137e9aefed8f8fbdaf6b056ad70a750b44cf5dc86e6af387d4e403dc0611d752bb2bd6526488c0b17441b05020ccd7f744db43d922b5b2544b77364bf76d6d83cef4c3ff8f45f4b67843d4a869ed2e8a15e80a5df00670154045a365b0fe66e304b15c005eb6962f269896708c8d0a94faa0f00c57fe237527563ed70c4133ff90ad4a5b2e0ed03b76412b43d817501efd6b525a08d3bf22740de58d5fcf47daad074c6cb9438adcd1a2fc906c6921a4e254699074fbd84f727b20ea2d4939706bd42cdae794765589b449d75a55115f3f5b6a5cbcb0a33cf1317c43533d3b16b7dad5fb89c44dc596a7f00a3fe30ee43e33576d2ff1f5bbe584123da3ea26160ede62ee0d5477a7ba676fc3a4c6b5db51a21db81cbda912aac76d2b0295b7d8fdea1500673fefac71c70f8808249d616b8fa0d5e6813c299110f94ec541f68869b057be9effcadad477a52af9bdb9e986b82ff68641d27ca10a273357972843f0228c1a7ec890e6ab8039d5dcd3bfc3ebb94101e6bfcd9d74151e61b9a14e17dc92b4d78a9304804fc1614f7adbc1dfb6ff214819a2a6449ba0ba321f17e46c18522a9d6e9f5928f531fe2a59af9b88e4c32fc6fcfc4acfa94603554dd637854d197f01c52695e77dd4b40cf9773e1bd6b8a13c7477c0173815db51572a895593ea29e15a6bbcfcc92eb93bb11a5bf1c1797fb10642ea45d98fcbb136627aa0eb8574133e9cca7c6bd4c75c340a6c3102dbf5f3a9331c50892156d6c42720ad1917341f0baf9829556d7428a9021c75e7c40817a907a2c95c010151cc3046301e6741ff8f90ebd8fb32392840029c16f0e2bd251090ec84fd98d61f62804fdd6811a81d86160f71d7b6750e4dcc926d134deafa85725075daaf5c4fe7b4266aefc21ba59aa77131ef34754f3e81a882f3107bd79d4cf75ff7760d68bcd85f80d48aeeb08e0e691e886049242f4d920a4422b02a93eeb4a96e98a7af18b092a03a40d38e8d931b71584fc68fe2487b32264d25c6ffe89bcd4dbcabb05e2d76ceb92113cf4b44b336685369a378a73986b0f63422c5098e20fabebc090b08e4f8f90dd638f4811fbbe8d620381a58076cf54515e90f06dc4cf79ccee4957d7ad8152fa6ed882f989614d2f8a13be57650088373f0dfaedc895ad1b0c755d428c450cdbf81ebe6cd49614c0b4144cb24846365c461e1754cc15d0d6fed0276289ae553c0ba79884896ec6d5c8ae6186ba17f75d9b4cb2f28aa4944e177a405a59057285e523a651ed24cda275474752591fa90a7f236c6c11242d8833a91351a12434adf0ad75817cbc7aca0f71666c1d64904817502608b1a28bfa390bb4781922cd03d2ef334c55029a87e7472c8847e697b42ba4e4b209f9676b18031206047c4eb14a069f468db8ebf0c269c100d3dcdea692d71e1895ed7228578cb6d0351e8eb8392c21e327352f8d905b89681d9cc28d4d3254f50c901ec2b6e0e51ed44867446db0fa4fe5a11ab99b85bc3895190b66c1b555836c0bbe0345fdbc53b1a3a3264ce5c8caba5b8041d71e1b1d5ea3dd08eb5d4c63ca6c93d0d41a3cf7c0009d78902febbf1b8a61459a3e77ea72b66db5769fd85e8c1b8334420a206c584c8b384e55463488e07cd7d9a89b07b8d546f3ff759ed3e6ad34e3bf394cab533f93c802783129fbc448bf0c34d2d4c0af4f07fefabc3dd1564adcc0387664429f7e112078b01e262c0adbdf16d5db494d017dab29153baafff85f85638a93364407520dd61bf7d0fc40bb5e011d9b3536830c2b1ed514460519c17b90efba0d1b8bc9af73bdb0011cf1046b4c66d7757749906277176b7911bfa97f1c64b46bc1a9fb7626640c0a918d87c0db679941381ac4b46b3ab723c06cd6bf7e5c2924272a485a760188e9f241593acf7054bfc007e5529c7daada654741d187ad6aadef814098346f482157ce9652799bb2c61552fc08819caf8f94564f8ef115256bc5b1dc8ef89862bfda4b0e470062866ce083ca4648430fc935fb884c37ea284cc5b03f12bee1726afb6ee8f70ceb94f28a9cd9e719cdfe3ecc9b469033965b8216ec5bae967e45ac972b128a22bf317c39fd1a5ed26b3ac2ba7b21551f702ee0bcd2e6a0527a025f77a26ea7cdb5e3b2e04e867679422d1cfe8474657152bec06ae374b9a0a052d1c0d02933e2fc0d1f9d63a219d57c6e538c162b101fc47ff9437b1c8095c46c6e1498a7f1aca5ab9b0376d49f5ad96e0572fca68ad3e16c158fea64ca53b2c7700fb02e40807e300502cebd1f788f96765c1b98e6f1a0a6724d784012747fa5e00af3d79c5befcb06707dce73ed297cd93f1a847737986ffa2e59c0ad03d08251aa4ef1d54b29aa3e772b7392e37c046d7edd900b0354132a0f06cfb00f13fe6a4a76d2a7675448cc29cd9c9c5f21acdffdcb42033303ac9590022c09d2d9e988a0113584081d0912f0cb62fa87f50b6130cb6d1dab8f177d08724b6fa407f31a3e9154c9f127290427b0d25b3e2661af935b62a7f378092246a950ffa7a33ef165bd91a83745136e0f71e16f75de71a81c9d9061a9463fac9eaf831bcaf3a29b5d68f642e6fa0eccfbc0264595d16e6c66741e0a7c3fdcf0a25684aabb52aa6b452e5ba7a76f17a2999c1683a068f8cd89d12bbf2f3b8c4b90cc7d30dc2890b3686086e44cc8161dbbdedbb829e0f9b7a0b472f4000f5b8db06bf3f5d8f9340d67c6db60dfd1d9a815f20e2be7bbf442bd800d6f32744ed269bf86e9936c66f6aed718607c5813d431f5596c2db9ee64b18b475a55d202384d6a66d10ba84204ad941dbc9ee6cac1e78c0bada681687ddeefa0269a2d89cfc3cc5a5b92e9b4e5ac3e136e7f31fbf800d3b994b3b3d12916c7de8bb31974eeb466c2903db1905d1d7c526e93876b93bf20906acda5e10a8dab4ec43f93c8295a6b2078edbb8a09d42e27b321dac379aab80d568604b65d167fbd16b315dbca9fe26079c09730e60fd41becc05ff2bc3f29ccfeede96fa8efb993ccf9662f81860e56b724f33ab99db2040dbb3c5a2aaf32e652ad4a7c1dc99471a5a9cbc25999d85f707d954e0e5047a51e99acab5e03850b4dcf46fea70a0d50af424be669937abc61deaf2b03f2ecc18eee627951a026defe782ae2c21147bd090022ca614c7107cdecd39af8578927a34921d972b51cde53fb8781821e320b55540ee1f81ba73a0f7e28d212cccfc5eb50456b00fb365e3ed8975732c23d4a17c2935b0bfecf83c8a8b11e1ba0e96f46e0fce69ebc510222b2ea908e285f808672401dfb96eb296244b62d821cc23056e249a5b8f5bd65a86df81dbad5424cd3423857cbecf628b15e7a1ff5ef6a49af3ddc19027a713e9f9f2246c441717c0e65c9823965902974a12cdbd4668162ca120cd43ff3687dcc95969c56562e14ae54fbe9f9d9324db0454fe5d985bfd657a0b898bd1ac01df441ec02b5826f52225e769c4db58830c7a079b244d566b4f81e59ee8005aafd5dcad77cb4d51eabf0c97aad0a1d1d57ba2708dd4b23972b09d117408640272a31ade68b3aacca7e28b2a5ae89dea812b74c2f95e948f992ea262db7f6ea29d322ca736a9093da3ff7609f17d4c0811ff2aa3e8d050adb9dc66fd5678c01573cb1829716cfa7e843c418e234330922220ecaf4ee3d23461b1f6d3c010488a299cfe4ad340b71bde9ca846c1869854f19f89222decaf9e8b0cc053e30589fa58bdc652fa335bccdf5fdc8b1cbce683d027c50307f644194df1096d05d4159f5faf6198337687fb445a15eda352eaa14e16b8720a070847ee23588187494b1e689d4b5fcacfc5843d68a6c7b83379f7a39de8b72d2118a9e5b13815132dc7781861db00f21a2fd6833ae5e4edb758f5b61225004911a66d92c672c24a45d3d04700405a326a7df943dd5d59370d9", 0x1000}], 0x1, &(0x7f0000002680)=[{0x28, 0x110, 0x5, "d45d04b20eeaf6e1fe4bd6a0f699a9d5360d964b70a78bb2"}, {0x90, 0x113, 0xffffffff, "981c8d019f4dc7e49ee83a37b4fe092528851d906d59cf8b8de5f155e94fe7751d954c770d702e9c702e4e351dacc2b118f7b7bf00db36a93a0fef6c139fe48df18fe955a1074300735f604a2f28226e348e834b431f2c13d6f9ae50881f6a5fb466e0bfa8c3c21b5250b3cbf42d83583fac4705532aaf0b28ea03932beb10bc"}, {0x38, 0x103, 0x3, "6ee0e4608ada98e74ed4f19b66a1f21367857dfea9dd1ad900d236148306adc1dd048a97"}, {0xd0, 0x117, 0x16, "328ecfdd0c27f6b8ec5ae8487b878162161d7d908bb5b653eb7dab67b5ebdd8d6d518a997c93da93c9b1784ad574478e71abb93a3eb2965ab090ac06ab92c82e258e9bf56e0455894eaa4c7b284532a807e40ed55359a7a1fad8243779d1b5b529c177dc293ad20f10573d37d7f73e32947b3492629ec24d2b35c0070319c39de644204680e47c8b614753db1a2e09d926c42d94bfd638301def5f7ca50a6f49c7ed4b8764d3f1cba453f22c63f12cb82ee259aa417929a9551e"}, {0xd8, 0x117, 0x6, "523cece053771114798f94026c187a04094e71416fd55e639d57639f38830616b6fd17f20aae695c9ebbc53253e63bab596a097f3677a9631743913a46e48d67970fab81f4633c68019120f06138e3be77af17585ddf662ab01099d7aacf64195f6ab200e7d5ef3d3f575911a5f005d35a1f4c66db3b16a6e8f699c04d233bc05c63a67b528e143959f1160a9a1df7569055591a681125a89072574d64221246575e4bc7a1b8b8744ea74926021f1675d101ce04ebda9021f0cc9c36468a1f88439d0e23cb2c59"}, {0xc8, 0x29, 0x7ff, "7103bfc4a8444887e4c9dec0cb1458f3c631bd3c276043f3aa807cec55ac8d580e5c11acc1b7f0d71e0e183240205e0f7520628e118b4f0fd7c46f651649df4af3ace12eaeba4f897f01160cfd08f69937c6e276185ed7fdb7adce60a5744a458062362ada7d32986915ba72519b5fc04bc927fa3ac4b567f75d2f7467e5a64456b0d51f134790ec95b41b4d499f0ddb54f3ce10b0b94f1ff07d3735a9fd01ae3fa39c4e77e150a6ddd60f4ece20ac5af2837a5e42c3"}, {0xf8, 0x10d, 0x6, "a6ef8a0375ee487f1423a4d9782a1e4d4942b402b18cad29f38875cbf4adc8fcab4ac973096ea452dc159ab19b9caa4f65cb807c36af04687e3d47ef81c8d11e9d4d9ecfd2d8ec7807755fd02723cc27bb051c4f3aedee76f08fc9d7b41324bcf9ed9f56f4b5f816f91c6bf858158f7e9c6965994984b9f5226b9942aa94dfe2ac3aabe069912b4eedf51ce4b5e5fbc56bac3bffbc49dcc428af442eaacbd34126b627255f1b22ce20c4a5f956c5796516e9d455628dcba9ebc64c6f65b4cac5081569ab16da1b4d44b9b0b1c63bba229225aa27e6338dd625ef01cd965252ee7e1dc3c82c744d10"}, {0x18, 0x11b, 0x0, "aa159c16d9"}, {0x38, 0x1, 0x5, "fb23c15907f9004208e6205b409327e3ed3fdef0da9f0485ddbc36a2ce65a29f9369db3dbdc2ca33"}, {0x58, 0x113, 0x100000000, "aefbabedbb8bb66ff6ca9bcba6bc92dd97fb023f8b6b2a422434c5199f2de40b31dd8f11107dc77eb42281d66d2d75e37e60ce3ef4ebeafa6b8308c08f570e6904a05f1f1e8b"}], 0x500}}], 0x2, 0x4041) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2000000000002, 0x0) connect$inet6(r1, &(0x7f0000000380)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x7ffffff7) socket$inet6(0xa, 0x4, 0x81) [ 696.925552] binder: 9805:9807 ioctl c0306201 20000140 returned -22 [ 696.932397] binder: 9798:9802 unknown command 1074553609 [ 696.943963] binder: 9798:9802 ioctl c0306201 20000140 returned -22 09:17:21 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x0, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 696.995463] binder: 9805:9818 BC_INCREFS_DONE u4004630400000000 no match [ 697.034934] binder: BINDER_SET_CONTEXT_MGR already set 09:17:21 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) clock_gettime(0x0, &(0x7f0000002600)={0x0, 0x0}) r3 = syz_open_dev$amidi(&(0x7f0000002640)='/dev/amidi#\x00', 0x0, 0x7ffc) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000002680)={0x6, 0x7, 0x4, 0xe000, {r1, r2/1000+10000}, {0x5, 0x8, 0x9, 0x0, 0x5, 0x7, "4579a761"}, 0x401, 0x0, @fd=r3, 0x4}) getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f00000027c0), &(0x7f0000002800)=0x4) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000100)={{0xa, 0x4e25, 0x5, @loopback, 0x401}, {0xa, 0x4e24, 0xf1, @empty, 0x4}, 0x5, [0x4, 0x70000000, 0x886f, 0x8, 0x4a3021ab, 0x38a6ad92, 0x1, 0x4]}, 0x5c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20, 0xaf1f}, 0xffffff31) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000002700)={0x0, 0x7}, &(0x7f0000002740)=0x8) ioctl$VIDIOC_S_AUDOUT(r3, 0x40345632, &(0x7f0000000000)={0x0, "068de407ee0e2339653c8e9fae595e309fd854e1cb21a4a67f6951e1e278c47e", 0x2, 0x1}) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000002780)={r4, 0x81}, 0x8) sendmmsg(0xffffffffffffffff, &(0x7f00000025c0)=[{{&(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @broadcast}, 0x2, 0x4, 0x1}}, 0x80, &(0x7f0000002300)=[{}, {&(0x7f0000000200)="01fc3c810577a0a43222a35e7c9d4cbe947007be17dc9e39df477076e021bdaa5b3c7d4981ec24955cfd7e3f5c93c64fd5a59a71fb604e2bcab0ff356f324bf2c847e880413bbf405acde8f5e8c18f71036bd4a77d3631a3155c328d576c9b03a268c66dc8792ac961f9ce739886ac018675f8fc1f2afb5bf06e2e7c3e2fdd89a4c40ba9024b0341fa12e2947593729ce247aa29f3925ffd581ad2f40a22f92993e5ec58efea24562c9ddfd122918cbfb60de6627d3a77ee7fb28b563e0bb40fac928ef8ee8d3b890571a160a70a636fef7255dd5cceb1b7b8d96e9551ccc9c609190810f6c99cfef4ece6dbbf0183ac73", 0xf1}, {&(0x7f0000000300)="468b36e0529f71a7738042e6a8083adf859e6cf864b13ab70eba876298ad0f539d70b841518f8e87cad0c9766a57b113c9e54a921a20122ca7f4c6a520ec1201256bb3d0463ab3c2b6c6e1de6ab619177d32383548bc2aff84119eeb3ef8fc45516572470fdc4bba1ed033f124acb48b4803d836ed16219ac1b44dcddb69199cb1c024e86bb66a1e21d2297457fda7c720df2f4e5a7b6e9a833c0bcdbe0a703e61999ce7064fc925b793cec7cb4d4c865c4ad044ae04a7c1c5bf0db19e512b857753ab116e35e55bc8848bf0baf511b90e6f285baa268ebc8171bdd80f18b0ff674186b7397228d48b3944e6db21e88c1f5ca20d7b0ebc2199cef4b890372d908ebf616c8152c4db2da073c9f72b84b537951e8b2b30094d633d24c3c22d3ffd8fe27be4b72dcbc844124968c4c9471b44ad95e01ac44f683f8644cffb859d5ef215253bca83e362ea86722dec307ebf047aca652e60dffb53791f6bb9839f51e20fa217504cc078f8ca02a0e87b7a02bdf109a569b23ac7576a8fc8612c6acc67e63db87d5e8d02bc7e5ea80959b39a89d65681e6eaf5c7b2e722fe1af16fa2276f0afaff5ab1decccf2fd315a78bb27a20d9f6b5ee44b1e74704d2329ff5c9bc8deee6a1e192fe2e61c2b01965bff4ffa11c0c0b3ca97ee275851265b3f230e40acb18c9d8a2cceb5efb629d1ac1b34a6a8281c91c069d67fed5262e854bdb1f7e59fa284d03c64393f8879d7d901c7ab3158d096024e66dba5f29d6dd8e01efae839d3eb7874859174dd15551252e8aca6b8056588e72d3a88138db1aa6a4eaf6644eb98859a034084d4de8039594278f131a28b05ea2646e33e6843f82c54a3b5a1d059f07527b9560c874f46324f04f0806c98b04ce327f2d9b4df7ce177276335b34f73a049821e0f920123f34b1b27958d88f8b34f682247e951c5ad9063ca79cbb99acac8d94c68cb53309edd45fa453b62a5935ef6bbb6ecc11eddc17ed67e9d201a963811b38297ee72b3dcd94c3dcfcc27b53b27b2e9d1a330271b4248a88c2765bcb510beadd100c7a13101359259438732609f62bba6c0e59224ce75289d09242be3135c5a1747a0ba726efc307ffd00fc985514496d9c903077026c584c3efbced6bf8aa1a1fe7979d7017092dc4cc7408b917ef5ce906508d6f1181a5f27e2c19ac178e5c5ac3a6c5008d04e05d75aaf36f28c0de851694245489fb946dec8c8c43d7372a1208f4b95a68c7864d0eec6b909f5923f5b4f1f3076b33bf33955348e07be8f164951313c508564d20845f798bdcf0dc7ebe713149d7ed43dbbcf275bb69b010af13db5f53d0a1d5fc9b94ff26adff80105485ecfc7777f59f76a25100f10ba3e94613aace2192d19c0dc901cd10e39a55e9b393240b4d413b89c438d2112438f6cece8b480ba57072b73d0db2740904cf80aea1821a0d587f46163ff639ca4161f8c0d34326dd0878144329063607f7416a44c83515d564e891ce3d2a48015efb98bd02a98d32d1c06d6e9e62f10a10cd11187ba73c30d30667995f66b5798c77abb99bf8f2924bc1f91c9317823ebde2a59fc54459882c2e613ced8667b05e5b16320fd7691604f591d3f947a2010d08a00ae467de06053ed5574682dd70ae741be27cbd72ec8a17c10826f162b4c30c0b39fe09295710d679259481d82ad8e0145299c05df215f43a5f56e3ef4f344f31d8269baeeea67504ee1095867573747379763b057d4080a345d4d12d8d599bb85e8621017dc7c9d6126122ae0a04ad951d65459d6325d0c6bebbbaf690b95551a7d4c8f0a7610a1f64cba17901bf38d86d8301276ec483d97c06aab1a796534fd4d8c1ab10b0092177c5443e6086de6ca8125cf9f1d22764e581b859e61c92fe0a72273416f4471b38bfa94dce1b1d4824288e0161c50c798ea356926fe59bd0ce06824a7c62dd04b74ec9dc23b237ee4cc5b5076188fd3d2ac23fcbfe89285e1da3359deddaf4b27e3ef2f1bd21f59f3e7afc700ccad2b2de105d72395ab4c4a9528e3f18de0944dbb43d7fbf0e87b2d1398b0d0ab486806c94bd42b6b0ee7438a622bbf25f0280c6a22e1b1a613d44eb338f62343bb5616f7eb0eea96b28666680e26fc5b1d5d4ec2650b91ff1eeaecb238e774f9d4b294f9d3e128a89c21ec7673c32e03fe2c33c79246b063fcd31b1faa56ac5a4fd9f1f8a78a1fa1113bec56afa791d0d3b252a7df8b65591dd67faa2fa537dacbdd22245d628d9b6709200cc1da93a2c5beb9cb893dc91ddea6089527dcda489ac8529eb34b3529e9bcbeaa7439c59e10c22b984dc20d3d1dd5ba4112d6052f477212dbd84d1d4651d7bb682db8b6b491acb7a540b412afa22e561c731676eae486250e12ffd028a320e1ae5b72c4312316c1245c6d6feb0056e60a145208adad725d7f2367c3ca2b326781593133a3815c26ef3fc6da112c621840f1039c0e7f0d57a0d453028220247295211966873110ca8f25c219d1e860ae324f3cef9dc73ddfadd89047c2bfd27acd44de588261770bed17668eb6b9d14b788c42f48d579411a2069739f5671a5574ca893113aa9ebb0b511ee146f858d34006f78b99db181f9fbaa850ff0493ced1ba4781b4682cf3345f4e02c864b8ef7456a81cf0bf319a757ae2396e62f91355242252fafa81051ca6535728a77084febcfb161dcba8829643684b72720b23465bd3d105c16efe672fce458b3d1c58e137bcd5d92aeff4d33adf15dbcf82d5888fb475bb6ca8122fa2efe181fd35737a9e618f24f8cc00f68d735bc9981d374e2ecc28368de8f74a1cf5a2f749000ec2e1cf49b37754084aebefbf7c970e4c5b9acfe13b59a6f146cff02511ec140c225c31d603a26ef1d0664967b52e22f5d72640bad03214e92385d481203dece6137e2579a0ea684057b142d18d9e0d5bbd944b68e4a5640e3483b83d5dc9b5cd8e7aeddcfc69c196a61a3bb593dd6ec0d167034298f719da74ab4ca77fd9e155f7c92f3166670d26d72577e69eea512f534784bc0b2ce2f93cbc2b5636318e18bdabc08ca2c4fc89bca6b5f4686493c724a64ecbf9c02e505211a8b15948e1a552eb93ae9cd2e3934bc9bd69ac845d192abbdb6fab87e4bb7e1103fcf471c827fd556a0d0083bf36d56ae819db3ebbdff7a4640fafe724644ec89ab069af526e4a1423eb6fa890c4df873a3bf4cf04782c7b9873eb503f0958fefe8f51aafd2abf6201bac5c18eb50446a028d842cdc267952073092a63834e4dc634781c043d1a392eee68528f841c9b499eac62a57e4f44a1c90b0d0157802e9b63fdffb64e5cb12049e7f20d04e297964a5d724c4afea7d1650e0d3450bc78241d9e047b91000e56a119c6d6c7b314e31f674254aeaad621a1a2dd72ea4e3da43ea06035c9ab963c0203af3e850fc3e620cd4096f2d346ecd437318ff7dadb880cecb137d3de2c21e8a701dfce1b0a6297b5fd07b35faa7d4816c9d627e289dc85ce6563c17fc2c8dc1edd225a36604a626ffd852d4c2fa854f79198dbdd28c210b14bc3aa9cf2ca71db5879baa7a7040d2274c298ba1de539bcde9707e4addcb5691127e5bfd94171aedb5512342814ca5ee47075aa63d7cd176dd3be57f42822160dc63850d924457bd52b6a00c1999fdc9543425bd651656c4149d9a1023e30e7bc6168500e9e65406f055c336fde07fb0c3c01d92c926ba38ee343d4e2bcb826717e7ea7208de5176d0f14b6f5dfe93bc10a52c740c926d32eaffa4d8796135d5438682cc05fc29c0b2ddaab811f31ccadcbe36de6ff10b767bd7318b80143fa831e257dc113e94e08d8260216812bda4b72194ae16ebaefb0ec546957b1d271a7430f7c8eebd3bf13f0ad4d5a706b701f94c708f47ed3f901d66f0651b680a3ee0642d90cbc4b29e42b4572931d2a754512e850ebbec431f9a8dbdc40686d56042a25845dcc820c9061e2d1a2078949c63a52918b48ed098386d3234825194c171c7ddb1460e850d6a4a929300e0350c1edbdecb4d8c42ca0397a229b82033f2ef39d668fc1c10e0d162950db3e330fec249de3f88289c57f686e5b31ff3fb2f826fb63ead7683d3233f78a750b850af433d603c7a3871f8af05d528d3a57f53ffe149bf63f218962b2bc9597264285f2c277bcde995adf9d62adf936e51d2182ec18a49e30e712c46c900abef25eb636ce0ccd4f3621f6825994ae36241f2055ec821791828871b678af695c771924d655edd5ae308ea1320e3eeaf18910dba5e9405d350682733786d622fc8283c13ae0d989b5d0e38ca9ebf620fa9009ebbd28f10472c455d611c7b3d63ee82e5a5dc789cff1a5d35bd2c8447cae27c5febd87aa156a6757ca2bddbd336dba8506d13458ad73696889e9a281d1eb40cf4f147c7aa0b736b41ca66ad12136a8b48801c7bdbb4bb97e9fa5050ac73d90a74427c1d477257a31551a91ac967ffc4e14337dd16f4bb7fed610e09bfbb2a72192c12c94af380d1f6c4ae4f11efc2d06ed488259eafd5bab72d33c53cec3d80e0ee76b22865b33d9b9e4f9a61dc74ee0296d84c5354709e47606084182c77728d024a5653d5b344d9ef597108a8e2f6fe03ab8a3d2e0c855b721b0c6270f6fc46d5d4e72be3570dc89df0ca9cffa3355ce979957375c55bdea30aaaf8e24307d06ef605eaa9daf2eec54dffe0ca2267a456dc673d2733db416b266211b881169c59d6d4418abd564f74c80159eed1997e58374909e943e5059909ae41ef9ee5e731d140d6559ce835ca52f1514ef15c614620cdd566f7b68bdc57237218993feb8a2275c0b77ddc60ef187e6accec6da6d7e7a636fb01273b4dbedb4f4bb89486520b148e5d03408c57aba09dbf9b607e3708f195987fc39bf95b5179c910f5c35d0d5e8e9acbe69a898fc9d3efd06e7fa33754f2b18e4f959224344d80cf6f1e84058f8a00cbf3716a9fd92c69e4c721d03fab92cd0e253d88f42f9adc4d624afde5f449a021241c869ee466d5d41e5c73fd4fb5147804069fc7cf5e0b51754e8aab04df57843688256d0b55e8082e6b3d4fc2dadd0cf95a145e97e2430c146c031ffee05550bbf6a9f51cf7d82a136302b8b32e2492a8697058b6b17280df54dded3d1d59516b187e066bde0917dbf9953e69dc3463d5b3d38ab401fb4f901734d5311402ac5417a7579586609b7ee5c802be75da15b29a8d7360484d494b597f5289fddc707dcaf92991122af409019a9895ecc5f38cde277fc9bf52cc9051c6feb3fc0803c18d01a76e64e4545876e0d8e9134a32b4e0ebd93b3dacfa44b1fcc07ec64955a3a13eaded9c4d45b1b356621c84467fb85480745e9556dbfef434998a9e139f04e9ecd7061f5cacbc36d22384a31e5ad8514f4cdad1a456b40dd22526b5695114a2563929acd2fa530c26d7fe584ff5cb96e9a98537cc5a9531b693a3988e22e5e8b485673fc5390a18188e5c2ceddbab2e12b6588ceed571e837eae39785315b455a3af5b654a8dcc9ce7360b2e2b5300e2328ff4e2111e74aef9b2913b626529a00d36a7f2362f4e7f39b135948ddedc03e09694e077638d8bb9c444932306427628fcd4e1ae6c7a490c95b7340c27616d3a86a81b10fdb3ad2da6eea88ae29563119d117b0ae2dd77293d419f4bf8f9ee5251987fd2340e2985599a0902692a4f9694307291aa11c99a3f77ac87090f15f19fc3955e1cb03be6af07987860c100021111e31b65935fc252f221ed63afe453d51cf2f516f1a4431b11f6f04f461e0181fcaa112d557452617d843", 0x1000}, {&(0x7f0000001300)="c78b87a97c4219d812b661fe2343673536c2d6ee1c947c6671622671a6b35f6ddde320438d278407fd0dd7fd4d11f732ccf71c2d610d31e4e6879ff7108a38fa0d2a990107caf76774d252b736193e557b2e7ee857507c2499b2750620af8066f998b6ae8b38cff706f27b69a903d497b65a0141781bd93a906fcb69dbda9ad580194040cff93ba591cde6b5c5abdbf41d3f8673988d0871793cb7a34e5d61fde1e61bcc6741c661ada4a8d7c549d736f57aab7a227b0809e557cb73b643c1201759b190517574216e22a0d4ea453a8a1af12b262d5ee2659b5356b66c14653490c9e063eac2082034af223726e0643ca5b3a1352487c850f22d45fb5124e5df3a1c55ccc5e6c3d218c4ed602de75a2454b527d4ee2df56f3a2e3aa87edc98e7aa95582cc91a88b000fb003a10aa9c4b45e3037cf0495e572b81b1f6572663477ea7c9c184161a04090d3c0849242c8f3436d66bfc5bd61d3e722ba2ad01b027ff00664b42ed8233b83c4a0328059834ec61d87be89650e785631e68445532e74d0ee7ef17e90311247406509b3620f41075d094e9acc20918f280c96bf5bafe1d1c8da8857fd7f70ca2506ec9a0f862d04c653e2f5b28bafcc0fdf0b4b30915405fc8b3f05a54c4a529a0fea41b6a24afe5a8cc77181a05eaca96e096605b0d328472dc360999b5400a3edf65956b964e61e1911218997ab409c816f6b57e4961bf3a9f59656a60a68cced622e3c8de497e247fe766025c75103eb5d1bed8ba3d51ee7cb5b931b3da2ba7c22e8bec9908bbb389e3235084d52f1e1f104ba8e18996b332ce6063a288dca020fb4c8744609e716bd45a6e602a21e580c22fccf41abbe053ae1533e9d4a0714fe61437e6ead5ef82e0bf54f395dfaef0b7887275180ca565a36c9e4ef45d606b7a3c87fede6a3c49fc48cdea98c46c16dad3312d1ea977d85ee01436dc6ba9b7e2a94b352d9c05e5f902a471aa82a9701d4a07f2fa86faf177fe532eac7829a7f4894ac07041a141ceca94e43370927cd93ef0ea3eef2577c6b3beacd2d0805b8c7155794cb9f80b6a3e7b13f2f7ad8c3dc6924c7c692d49d2d87a471e5ce08e60cdec74c30d395c1b626e4fb871008419e304e038fb0f75f55b87717f15e429fb0b49f2ab69781cdb971fcd0731e114d693c07c63e91f9e4ceb448534f76744ff74884e952bccd8b996b056d0cdd7f144e02cc260b56b3651982c8724188213671c5421a9418fce81a3856d170f48f02b7ffce27c4202b89d686f54ef9619be9a53d4b8591b8896af01c3c9cfa553b891de8305a5a72bc05f174dd7f8d4cdb53b07636664f515733334fe53a9080e56b893d14a3693e748d37b355caef486d276b67ff454d202e287c7e6d991cae16efc267097ce5831b82bd2dbb95939c12db3f93300600e830e2489bdd69e5399eb5147707295da627d8b413687b64265772d36296398e2a75ca4fb9376071c4d944269e32cd38cc12ab76f261479596fa49f8407b3c5e0c7878e0f60713b16f67b8956197b771e46ae25754c5fd7451046aa412a0ede457b32b6e666f88efc0e5dfa7ebde90dd0ca263d24f656e39ea4f9d50cbf75418535539d54f5a19763ce53d13fd6927297be4488b2576098bfd2777b1818059e2fcce5dceded44840db6290943355d4f0c4e57f613a44ca570c64f041922e3a41712001bce7778f8dd548fe507fb7d214448c389671dd2f31a57f46bf07abc1f2516c707276fcb3c5ce43d5ae82c9700f938a54e2516db36f1365caa84254f020ba12d01f9bd737ec6509c01e42651a9d7e6e2ef38c09942470a7c959c7c9d0e9bc05b7f2fb2e00a5fb383c2342823e992d31e5bf8293fef30c3421e8c29536d74cd8ff44c5359850cd548e38f6e45a3ea588d3b4cbb3342bb7283ecdfcf66357029b0eda0883f5785d24e0d3d8da6770b8e4e0b302d85546e8b6e2be6f381f7472ce588ac73afc8e322bdddd9ecf77051fa2aaf24c574b77c8cc95f1a3281fbeab399dca87f5f917ad3a80b3b957ceebdce18d12073213ceb52b69e9291cb881be407eda76a741a7c610a2f31dc83990f4e649847559c907af1bcab3928a5bfb113c9670fd435e23c0a837367d2f6fe21deb330767c5e62551a7f912ea185b3898fe8a612eee5818aa9c83a2e8acbf62dcc01454ed0b5484b7b8ba3644b8a46be4b1a16ed8b69a2509ec31067e7b331f6e393d7b58c60d59031293a41287cf6eb755be641d1bb0ad09ec0698e24f8ab9f2df862d005ad93473988421690cf5427f97c16f8235a87dca7c3ca5d51654197edb4f223283f81bcfdff8436a026881f6833499ea734a2a203cdd80e12c60db871e454aec0ed083887c241e48db2d838d9883a1096018aaef716207996aaa04299d90e290757a5a2c17dea354973c169f084fe3818011e4a494d345c7b9f9b5242222be4fd4d12be763717eea71e08cf62ebb88de9ed005fcec3fb82cb9b3d7df69c7cbe6f6df4b4b4869b8c6c7026cb07baa11dba006c187f24c3c78bf09201e086fc4a5e945647d9aee25c122ee2092de7cfbdc6c9939dda61929fe26ccf8f81d48134c07f84f94409b48a2307d847beeabb4681c8bcbace8c1266d929762f90c380fd1d08ad412d49448edd26044ccc2ef11f448373e3e33b6d686739a63a09e9b5d79265a291593d6047fa600002f36de4a504339e3540bf34ad5a89b85c3ec42b73dd966466e5225a0261803bda486630a80746f9dd806a51b02a319d30c614d5f643d9bcfd32e4f5f0dfcc1ac9f3867a97685edd77f0ceba78dcc17f4fb8fbb52bbd6d70a9b9743327dd73e6c838cace9f93c630357b531104e6186f03f911107e02a06a8c282dde2d04c786f116d244fb1e00e8c85dbfc130095b2ef4e4d8db143ef7ecbfce1eb65592140c7709ce2d67be7911b85109e0bfe0ab3d306ec62f255957448459869abb45a11ee259e9e4566aa2bc8e7cb87187812228b7fbee6037a5e31ed73960bab3ec8cb3061837d66fe39e9257096777ce59d454d14e127cc2d48dcfef6e87a0b8f3aef8f25520d6404034b5405569a448fa2c56e495cb237005d9c4d05f7b015d2a51752db72506fc2ee76703264eb07efb0d1f68d3aa3635559b8d3265c281e27f7e5897addd0cf850cbb564c1fc4247562164087ee5a9a3d6ea1bda7775055a9e65e0e78301995d6060107477918246eeea2b58ac8c788f8c9bfeb8f7bd389fb6be50488c3421a77f8d4f62a349a675d7a4091fca25fc4b53c3a2a94548f50ba4cac51e79e310f3165c42350d037a32f42d674e9a35b22bb4d13787ef69f787dde87ba01c265318135ab6124855086656821e147ed5a753c35f5770151845def7a8ed30729c0c1b3812fc9dfcfc2746a47f8e948c1482350339e56b06ecc489fd3cde82b91dcf438c682baa5001278224c33e7ac6d65497c0c42df94a09f4c74fd37415ce5011a439c293925c71e1da87a18006f138222304db29944d6bdc8ea5ff59ec96c5c97bb9c97e706ed22be81b26b9618062b49e5df25d0fa121443ca757235876628aaed6751f5c9aab2360e457c11eacae7476f3c5c6f596d194e4c72ac573bedc3580d586797f23496e63d053ef165c612b65803b8a814799398641f26efca545bd64aa303a937800c0d1cc231a7d1a2f0fce618606fba9412b58a5dbf69f1869d445f1e506b3db006ede9f4deb75b22ca556b87de6df4026830c2ddc7335e7c2d1c554ac27b430d7494e39269cd2084db04a1224d1cabbb251b95ab0f79763ba7b41ae14f13774e6aba4353b6d4c48e843299ad0ec8530ebbc6c2343a59763ab2cbf3a7c53aab2bb9076ea788b6f042e88b787579acdf21725ce673ba7983ec8a705c1973232fcc43a3662fad1a7ff13889e0888b8edf70e8a1f9714190e8157a3f4d21233b279456a3f69fe3bb92399d390889a467fd79b094eb15a857843b2aba35e5bc8ed4347508ff1e792981ef5128b1c63b9de42a42bede229ea9df369597b30369f4b7e89e090a8a6faece24fe8944ec60bb1097e5b5f36ad0b9d7fb38c6f2e71fb7d8d2c871942d134a22c91f861e1ef9dfd71149f259df09678a9d3d324e308df8a28e69b5bb137fb3e5ae30e2488f7566dfd25e2ed19ff4516b61941c7a75459dece35e546e7c2ff91cc15e53012e69ce0a06c6e898cb0db89739c00568350e334da395112ee4157246c0bfef01e91ed68c3f79a881ed8a8fd0c1049c0c983f496ca195dca4df5cf34acc0fdaa3ea603391fc04e3773417c8ac5ce561406343309ee1e90afe2d58ee0e5d6ee63b9000c7dbc6e0db913dd13090a353d0c521c2ca2f1b97590ef316177b065d5b07e87f0155820d5f58f4bd4295ee771cc549ad327b16d8d47149c8a6bffa707b76e8d45416dc2c687e7ccfe704e6cfdbe096e22a55d2dde40b7f7cbb74cf32a8034f566914e21114f430844f37f6112cee75a6ec046df7770798d06f3d9d43953606d892723626ddd4d1f33a0831848b955c38ace6ebdf7af10347d6045c5e7a24ead500320f98d8a22dd6117faa15bd715199977e10f4b0dd678258db518f2b9d36a30235b5d457eef62773fe73dd0529d45461d3f0c45d4afbbaab04bbd5b5ce49b4eb0481bd3b87a458c32ee2802abbf2fdd781fcb648472e08ec57209f7f1e5f3b963f4ab8bb4f2886df18b129629df0dabbe394de4f7319e4d173792ecc563ede91fba1687dccb96ca9f3f586a9747b1baecda935738ef60f3d33de6867a550d87cb363c8d245b2dab0cc2a39cdac9a240be86d7022f852285210922fc855850edfa40677b8f9a3c700f6af79689dbfde2aad99eb10337d6a162e892ed2e31a139b06472cd5a99632afa5c33506a8a00b907b003f21583470b15ef6bac977f6075944dc91d2d5c1bd2fc13d1351614492ade30a713d05c56808ea9f3033dc7b3160a8c8134e9fe6df0cf61893dd6c1b3f4590af7b8f7b5eaa1d223f6625949f3b3434322f95fd3f5d160ca8c8403b13e7a1de52d62ba7b79d65948d45815915b107ee58d54f1344e6a0262735f7b42c828939d45bd7af64aadd9fc8903b4bacc756eb5d3d603cfd99b59288153b6495883b33918e1d5d29bca76603c02a93d4beadaac29caca796ceab9a293fb8dae881676eac6eb70fae90e90e3b00655dbd51ffc2d9490150d992c9056472e4fa285f3deb3b6f76ac1fcb4217440a81511cc133acbae94404f0b00ff4a5a5e42c805c8ea1ef2b9e1f624cf2aa164eabff8d04126c9768bdae182b85a82ed2ab605a105d2c12b09d42528d31eef3e516a0c7bdb790042f757d9a14900f0bbc1eb9736735de904f1ad760460caa49add9d434ada18bb77d50616e98b24ea6bafb71dd4c121013ad20a9350551726b22fd2b001429a1673b88498dc91d1fba3ac6d2e2bd2f18d309b2b695adc201a552c33e572ec84f1e3c4addc6d8a9417cddca0fa01eab57bfba785be7a8ae71684dd37519708cccf0cd15b1a5fceb99f62e8c2d81bc30aa511ad3dab08325dc29a84e08168ec0a21757bdef967db99a379dae5628794594a118cc2b35ab16423430c923c8ba4adf53b93c3018b9bf37adfd7f0c7ccb8eece22e684a042df3de6d1d4b34f50d0fe27ac16140fa13191cd3d3eb361388fc8fdcba511fc67a3c27c7f738206f39c46393cbba41196373d1686c72d67ee25b418b1452e2d7a033292ddeaf38cd1e7d8cfb65e8a11a1febcfdf404679dfc518b1cae8d594e21ff7b9096022e1792690fea1f682f26654c69e85bc8431bdbe073422a4415da19", 0x1000}], 0x4, &(0x7f0000002340)=[{0x68, 0x11d, 0x7f, "2bede7dacbf67baada7a977d3fad8a79272693ad452dd7745b7b7b90db54739a878e76cbb5eefa31c74cd5f1b8168df7777a1de99aa897f902e28b150a94d02115c7a9aafc8950dff07129a641d822a72e94b2d8f54a2d20"}, {0x20, 0x13f, 0x9, "655fcc02fb307d88153bb2a6651798ed"}, {0xd8, 0x0, 0x44c, "bbc5131d11fe1d321542d3931a898135bc5c8ee0b3aa28f7fa09aace1508f9d24ffc31a77ca0c5b8ac7dbe9cd9f97b29f162adf1943a2d7a4e8cf11fb3f855bc05cb889855afe0cba020e7b4fc37df231b01a7886edb067c8168bb4d08d01d652a3af4f38d57fa833ca73ac5d5bff755e0b539811db623195bf686ea78a994a21f63646f909ef824ced887f66e38c1f2876e50b1f06323a22a183a3144fa55ce4668a97feecbd0a70106a36d3890b966cc62b2b5602967c2b4ba3965a5a5f0da28d933256c3d67"}, {0x40, 0x113, 0x7, "ed6c148cccdeb43b59a5ff4728969c8d7146d5a6d3d62636ca5dc3ae4aedf38c0feb96322bc42d85a15e193f6130"}, {0xd8, 0x117, 0xfffffffffffffe01, "e0eb2770e83040f21679d9b7d68f1cb9f6a11ddb7fcde950940d5b8d1a3d163d0ba1ada6c78a8ff5a8073cb9328b54ae64a5b269f713493292d71a6b602061a56e04c953e3b2e29da8f7e07199de5f9b1635c7a721e7a7b885d67fc9f800dc3d53fb6c639f67f69905248f379ac36f682dc3e5ab6d91fb68af98ba55ac38e17a7649906d72d6c1ef80329db522c3ddef936b894c0e36fba9ff11629e33c11a6848d76464b965d0d8a5541839905ccfe68814712ca8f6a6c8907a94a287b29bad86"}], 0x278}, 0x7}], 0x1, 0x20000010) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 697.043696] binder: 9805:9818 unknown command 0 09:17:21 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x4008630a}], 0x0, 0x0, 0x0}) 09:17:21 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = add_key(&(0x7f0000000100)='rxrpc_s\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="dcfbfeacff9fc5b0cc5cccac4e67462b46fb136f45c3405307050168f767fa9c03953138d96e897c8ece53bf922564c5e9d3db8661874a479a927aba5c2ce6033263c8bfd4d943cf8e7863cb796ba10b7c2933caa4d4a33aae8e17cbdcf97db9cb3c669c9973ac1d7116d1852361528f81d6d4085953226f25e6116a86eb2b388339e443f91e172a46152aa9521bd4f1", 0x90, 0xfffffffffffffffa) keyctl$invalidate(0x15, r1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="0100000006000000000000000000000e", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) getrandom(&(0x7f0000000300)=""/238, 0xee, 0x1) [ 697.078411] binder: 9814:9824 ioctl 40046207 0 returned -16 [ 697.101674] binder: 9805:9818 ioctl c0306201 20000140 returned -22 09:17:21 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x4, 0x0}) [ 697.154518] binder: 9831:9835 Acquire 1 refcount change on invalid ref 0 ret -22 [ 697.192791] binder: BC_ATTEMPT_ACQUIRE not supported 09:17:21 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x630d}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:22 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {r2, r3/1000+10000}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) [ 697.212218] binder: 9831:9835 ioctl c0306201 20000140 returned -22 [ 697.281510] binder: BINDER_SET_CONTEXT_MGR already set 09:17:22 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x40046307}], 0x0, 0x0, 0x0}) 09:17:22 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x40, 0xa9, 0x5, 0x1, 0x1}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0xd, 0x2000000, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x59a42cc591c40ae8, 0xffffffffffffff9c}, 0x2c) r1 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_S_FBUF(r1, 0x4030560b, &(0x7f0000000200)={0x80, 0x4, &(0x7f00000000c0)="4e0252d27372fb80171a7da3c8f9de7eaf8513d93a2878f8bca1292b24082815c70f1b04163e06d9d6a182165526050dca9e48eb25450039e08b4b4bc8608d89a6b296a57b7bd7742c82ddae062c94a30ee659e9d67f012335e876c1fe562fb670ccc7a09744fc0201866fdc6f5420d2265c447d225871b044222b5cad400168ee2c10ba7252488016449755d982fc095ad6", {0x7, 0x1f, 0x34343459, 0x0, 0x40, 0x6, 0x3, 0x2}}) socket$kcm(0x29, 0x0, 0x0) syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x7, 0x454000) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f000000a480)={&(0x7f0000000180), 0xc, &(0x7f000000a440)={&(0x7f000000a080)={0x14}, 0x14}}, 0x0) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000340), &(0x7f0000000440)=""/4096}, 0x18) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000180), &(0x7f0000001440)}, 0x20) [ 697.303173] binder: 9846:9851 ioctl 40046207 0 returned -16 [ 697.318294] binder: 9850:9854 unknown command 0 [ 697.340429] binder: 9850:9854 ioctl c0306201 20000140 returned -22 09:17:22 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0xa47e, 0x2000) ioctl$VT_DISALLOCATE(r2, 0x5608) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 697.357210] binder: 9850:9857 unknown command 0 09:17:22 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6, 0x0}) 09:17:22 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x10000, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000140)={'icmp\x00'}, &(0x7f0000000180)=0x1e) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 697.400429] binder: 9850:9857 ioctl c0306201 20000140 returned -22 [ 697.437930] binder: 9861:9864 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:22 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40406301}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 697.490879] binder: 9861:9864 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 697.502988] binder: BINDER_SET_CONTEXT_MGR already set [ 697.505238] binder: 9861:9864 unknown command 0 [ 697.530084] binder: 9861:9864 ioctl c0306201 20000140 returned -22 09:17:22 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)={'syz0', "5600b9d51dd554ed90cff81457d9c5e648085c08aede46b51c121a8b93363f81591a58ef7603d1c7b981f9"}, 0x2f) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:22 executing program 2: ioctl$DRM_IOCTL_MODESET_CTL(0xffffffffffffffff, 0x40086408, 0x0) socketpair$unix(0x1, 0x400000000000003, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x1, 0x2) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)={0x18, 0x18, 0xfffffffffffffffd, 0x0, 0x0, {0x7592da19}, [@nested={0x4, 0x6}]}, 0x18}}, 0x0) [ 697.544977] binder: 9877:9878 got reply transaction with no transaction stack [ 697.547395] binder: 9869:9874 ioctl 40046207 0 returned -16 09:17:22 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$BLKIOMIN(0xffffffffffffffff, 0x1278, &(0x7f0000000140)) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:22 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0xfdfdffff00000000, 0x0}) [ 697.590252] binder: 9877:9878 transaction failed 29201/-71, size 0-0 line 2741 [ 697.622073] binder: 9877:9886 got reply transaction with no transaction stack [ 697.629401] binder: 9877:9886 transaction failed 29201/-71, size 0-0 line 2741 09:17:22 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630a}], 0x0, 0x0, 0x0}) 09:17:22 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_mount_image$bfs(&(0x7f0000000080)='bfs\x00', &(0x7f0000000100)='./file0/file0\x00', 0x4, 0x8, &(0x7f0000001500)=[{&(0x7f0000000140)="613c88138f68bf14e609e18ae7ef", 0xe, 0x8}, {&(0x7f0000000180)="d586b0513ec322b266abc69954b0d99de06fa24d6a5f5503596c0f6d59e34f1f17ac8e4fd13901f82bc874529bf958d8ab61fe402b17fd5035ba7aaf07f6f22aee59c5416ce3358e5d94cb7021b624784ac29ae5209d249233de1bd7403fb44e27295bbda44d2a2be0ad2e0a3f47038261d22be4196ac6585d3e5d392f7e658b9cbff2073c5cf30b072a4a8611a6bf49b431a104c842fbf7dfce3b1c8839f7a5e5a6c3007097de73ae68ce708587291e83b8170489b069872ad5334e4474761168168e", 0xc3, 0x2}, {&(0x7f0000000500)="8201fcb8cdaa9b30aa248032896cf746c0e75eb53d83a284de44febdd21de53679506fa8678f6fcf90901a35b07a56a1fac1859ebbea0c598f1abd43fcf4630e374812986513750cf51b51e7c4b4160f9e559e4d6ffd64e8c716b1b71fb519d20d5100a7e6a2f28b1e8ad0e8537f9bf3c153d14b7f6bb1e58a7638e8b8267c5ac2a3c4cf050d2e0498cb1a4284b8a5b2bad17eeb556d6470089b1f012870ddfb3ea861e7f14af4a3a53231d1cf08dae7dac3ae4d2d5c6c38512c084e523d1a5c948cf09f4a2c2b3303ef093de263e8767e6b59380303c7d68a12b40d6526538d0e3d857666076058f90b8086db76c887eacb7adf5e456f40d75d098807aee421fccb9374d0a1dc8c65aa7fd8b16e2705566c8aa39e99a8ff6583433a5595dee089cad0f667359a705512dcc4708ffe9b304a0b976284dbcd9cae1c0964836e197a43f572d10c60d6ea2ff26d6a8f66548d2997071114e62c60b3c13f7d3c370a826998b66ceb1a198f757fcafcf60e4cb6a6eba88568912d652acfd6b96320aa55fedce5dae82bc5cc9358c2cfa73d9d9aaf81bf92da94df55d78f3df4eb646b4c0e81588935dc06bd72fa750582dced69978cb00609f683f2766c33c9fbd04e3a75bd0625d8be6b787d43059f88f7940b9c83e2c93986f07570d23ecc3ff7b4e7a0217eb14dc662bcabb0d99f98046e644f7c39c58d30bb169d58abb2bb24f7912a137e62c0179b25f1c7d0e165ed415b2b49f8006c60cf93a20673e4b999728c681349ed52cb4a042ec63f3134641afc1203c89c4ddb5d71c6a9bb371ff7cd0cb6d235b6e63df2d1265e85908e59a168bfb76c833a23ee41a7b4d74f6eb1e8568ae165b1ac449051e0e64bac7482f8f2e01ed6390e6ff95d8d3352e8e22c879d264f5237f53722be7f5f7f500f041b6cdb9c97d0e742bbe08ad754b733b675e6ac48e6d207e78afaa7be54f10bfa03c0ea5cf156ee1da31c6e2a1a2b1f54e93e693f7252f995140dc35ebfb365ef92a10bc13d72d7be49e1b065fc2c1be2ba37d06b88f0f83d1ebc8fb257f771f2b185668b76eb15bdcefddcadd9497c944217c5366e84b930d5ee476f28b38ca2feba3f7740dbcff969c72d401a0dfbc182ce4bca94242b9f64bf9ce0e9d6cc2f17dde5a0164cb429565cb83b2b6585c17357828869cffca6d468f14c843200a7e2988796317a26261450dbaf653475b0566cfb34880e60c68999c07f664577730755e02e80ff5aacaa14951b3be08a550cc2c2d7860bd37fc50b3951a3e1e77e5dd1a8beb1d712c3d4d0da89c303bf297f5e614e6da430be2cead3f741e31d88449e7eb45afbb933473dbce73b9028157d6c59a0c9dc7007ac199c382710396b0b902911c5dbe427fa3edd991723d40f45907df09b259e9d8add3a7335a469b87c6ab88ffe6385d793f54ccda7435cdd3fc007be15acc71b7b40f851b25b2569fddaa3753d777a3d234c5a7b382484dbdc7478469d19993a71e60b32dfa20590cd1e512d94cdab1c14d492dbac29cd8117b7ff6352641217e5010d92dac46af325c2d4bb4df7ffb8bc72c19dfe4056f7380cab05f9f192c14b0618ac90cb21b70b81b6f334f46f30592ba034641fdee90070692a1bd3caa4b0d8dad44c6f44a5521fc58a74d4e630f08cb5f589c3d9b48b14a4dd7497140594fb2f601a525d60913f16ced2a7c71effd39eaa47af9506dece80e36506404a8428230793b01320075d8a2fdad84c69643a4cee210a3cc10931df7c49bb1306e57a9e5dea2727ef7b202c15c08367597e14b48f2b685adf9f29b39f62054b0fd23bb3a0beb23d5f9d2a1df81403ca6a37e96b127cd2b00fa7671a16c8360d8f4be7aa1a2f9d13167de835b5b875d8e31c224b085ffb85c0c89d8ada1d8d0bc9d9a487e9d31e1c7f067d43764f6722e014c1aee6db5759ad0bebf9433f0727d5a704e1e9518be355b27884ece0c8ebfb89784632ba8c8ca385564c4b186093d3eff60c890a314ff6c7e6118076d0fc200169140639d131b7fdd4a72f5a707abb98e2d83a27896abb4d12aad5589abd295570aa95948f02b4cd8c739edc326e50b7c05305f0be239d5bbffc00e2c0b2ea5e19435fe81e0620e3ca35103aad5712759e8cf0d008889a93b1ef91535c7ee7d7c0036161a950a74edd6e9ab9f0419343510cf57349f09f7d1ddd0d9b1b39934d8e22ef31e7c8bbcbf6cbe6d4850b7783d3229222b63ebba0d179dff1ac5e07cd2880c23d03ad59a6fbd9d1da571363c0569580acc8b4012b812d883ea2649fbf26712e2c2ffb5c400e3c592216829d210c13614201c05687ae6036bbba454b210180190ed666c0c92bbf22067a025ce195ab25d5bf1c5ac1d784e119c37ca8a881d1b8b3d8b266aec74a63e488e7e2220efbefcba3c5577ad18ff5265a29372d5a80d77b7e81a3c8f917a4c7ea5b092f6d1c3b60b6460d358480a8934b63c77c58f4b724cea8230dc5e918d4ad6463c338ee8fce2dc4583fa955a9e421de479e2b9415b3aabd13ae378f6329676113e206211eb4bf0ae1e665ac4142810f4066e2fc54a4084fcf6efd004313dc65bebb7196b6a04508cf185526a5be21ef70b1d0c2439c5f7747ed804dc29b04b243826c866be965f3297ad3109a5541b0917774e6c1e807a8532bde20908d8ab237da73c630e16a8e99865d06505ded81ba868c1f9033f21068bea1c5286dc8499032cc1cafb722ece3a9ffe07897de5d1e7e2d9d0a205a80e5f84cb2a26e258d564d2f6ba4d7d058b9e4f23d99ca0669fca4d0f5d7462450d0427314cffd4e2fd03b0e44d1625fd3341b4de6f76cb2e6e581759fd6c7ed59cc6482d09808261f52bd88e2ffe973c570091e4560e9d0ce66cdd83e276100e5c12ce7d8af1a5fdc762a7765bc9f1d660a26590ce8fee691b6848d9bb5adb673d86e5a038873b0d2c701b9e7ec12c7a5ab8e6bfee303c6c7c4d8fed07fd5a665eb994e6660521633650e3dc0934c24f90bf9dc11a01e1aec890485cee7153a0c4107e96dca8b96d5f3e38469590ad9a6257009ebbcabc71dffc6fd63f817a92559905144dbd66864058ea91e414672aeb13a3781b7d5cbcf17b9b38f5ab3657b93de82d1bacfab411d7514ad49d3d55cac6626d4f145d3c44d7cbe5e98d3d32c98c7204b60af4da38b08b73237d8077bd87fa2aacf89429951d2bb2852a7c81f9d5fdb6fec716f0ec87a2d9b7596e4471ba4e863e95c85cfc7d48f4195d79bda7437548229e8d0b3f075c8c70acb26575f92bcdcfe09439609d1aa4ee03a20c02e043dfdd3d35af0c024a0c8fc6bf4c4a85dee0296d4d7784f1ff5710cbbbbebb3707884d291682a8afcc68e9fac99fea594eef74b81315ed290a353743d0938a84288403a08802dcf9025a382a6201bf3a6b32ab04c9ad73bd6dfd90e625aa81523714cff981185d8705cb3033d20793eafb6f603fcc6d816d551ecbaa1beb99b3187fa1cbc870f51833f1e78c0a68ef567ee1d26fc7f3cb9925bd596507b28878a87b6627bf70a9ec043ee3f03626cb2f6ce71a94d31082a172847662ae970397a44cb1797d3d2cc1eef6be07494abc99c3f5307cacf8d8df51738bccf17ca4067568ad10ee9dc1cf7403318652f55be6674ed4c3052cd58c16aa00d2e1cf699d3a78bd94d3914d218157cb0400d55dc7bea346985b93f7236c47690e9c5c1292b2d860bbdf32936d701f55a80802bf5d2b6d86da35fcef7623beeef9f915a2a8d6d9e11aa5ea88849f55ff291a3145e014e703f219937b15d2cdb51391af8894eaa3b9d601e62d8f5becbebd508063781215550c65fd55dd741db88a9a30c128d16164919302be75496e439df9bc9b27843271936a81113d7512634b2cce895ded4b9a8bcd173203efbb5e06ff7a198907643622998f7d09c233b06e929bbfc043aa94711b13696d3366a8ed8d89aaa71fcfba0e267ea8b7fad491e45f028894b6efa22b20cec03a1a3600b912bc330663b48cfa4d23658db55d807eb92c81cdeb2d49d9ad4ddd60ff4a27815a9f5753c7d77151ce68be68d406724795faab4b7ebd7a6d99481b99fd2390d7531e065118e16e2908dbbfec51996ccf65af4624954e0c13e575044c02a45b916f6f1ede7696ca7554167793398d6991352d2189cfe224399115a5b5225284746fdc2557750411074d96d81ce67ca86a7c1bb76af05f4e6b8f0ead22366e08821a849a1018461987b7702bb8aa70b214218430b3bb97e30996478a2397bd4cd54cec08e4808850543940d4aff1709173a180dc40add75dc73ae71672d4f26782662676bb2fb3da60deac80ce8c0f10b4c9274cb316b19b728f1b96eca9e2609c5d3e58f786994f6a2efc57e5e7739b187b9b34eb71c9dc3c7ae71f69cc995db695844beea505b21cea2fef5fe575acd6185e36fba07950fe9eeb3a9d6f920dcb9242847f40bf2a275662176d1d78e08243f7148bc9c5f25cc6da9b23ef931fcfc4b195bd736a110130baf12ae603874d60d8fc4947343b9e069137f8eb04816a6682f4e03d168a8fdd8839120c9b6110c0726ed83fe5cff039e0f4582c4c24a07d2b68d2d8772974587e74d0e11567f197cd3d60e9f960cf623004cb1ea999cc55777445aacf89fcad016d5ce14cd0de74d580e3984a6e523a56d0308cb03df1f404f8ee65f2d3b3b490b49a808d8d01c3375f481c94557d638d21ca2ccf9d1a61544ec0e598450603a0591c0f1d2d9d6ad68c464311151c8160f037a1357a9a9285243c4fb7ec65cbe7e0d1ad7d07f04255449f994986cd30439d12c68e632a6fb2f546bb5a87877d47a32571f1765cce1ae74b5ee2ea4ae6269c21932e31f33e870d783046b03f803c5850717011d8ec468f80dabd33be4f1e1be0651d84d1ecb82cc420c8960a06c50a1c0f6d4c276511ce639da77413c7e92236359d62c43ed6d387c99e1ed8cbe9dd55e1991b8a5fc35ffe10d48b1ee96cba87753cb6c760b69ba3f7a47ec4d5e9c33e48883acef977013437cf091b1252c68fbf65b130baaa3d05f7a941bbf91273c6ad351aaa1dbb7fe93da45e52c261b2faf8991f97965d47779e362c0ced9f45dc3adee3ce9ea2180a58c891db4d9dc3e0d94bf27a8973cb1cde93655e5d5600e1b842b92c1b6ed5d213ad7f275ce26ab5d4150f7e16c910744363aa5579c1022911e7332c41ac761bf856dd06a304245d17e29dd39b27027dd49e5d09373e1c83953e36ad9e63628f421c833b26afa614e9df26b76d383534868cda2dee3e7df16611e3ad2013b3cd3d81c724e5316269ae0d28de79f9811f22b7ceda85ef563faf162fb6cb43529d4dbbfad5a3671dbce90168d03bf570c36821d5cbd9ea87a08afc8a27906cffe2d8333285660dd2ae32d9f2a151ee573e4ac25ed6a35b64c31b208681b319826cfbb7a98baced7a9002c1e597c5768e48606728b6d147329410509aa764c3be21610ef59e3ce26a5475d4ab393612f7b2c9e2c54eecbaeaa52daa2a77500a5753574cf5afb53d868d91e644ad31045d3bc4e76133b8117ceb435116c2a566113d18a8d11de29b8b3ee8bef1a480907d6ba44d5ce0b6fc20337a457ff8aa177d459ef9aaee7a2775cdc91fc8d932c2afb2373e824f1317814391e1cf791ca1d7ce7e0d5a1a618b51348fc93c4360256a7f27c509346c9866d46b2469f6f95134dff20cf2b5012210e96dd1195e3dc8cb92e40dfb7b020bb79f2d0aea5526cb764b80abe024e9e5cafcbe1fde66dfcd2120ab6e3d394a6029d20b8ef157b32051e4e", 0x1000, 0x6}, {&(0x7f0000000280)="a508de4b56886a14c0b0a9075757a335c391e4c455b1574af1", 0x19, 0x7c5820a4}, {&(0x7f00000002c0)="b5df077b5d5efc3cb77f010b2dcb0a3a4b047472f81d2fde791a33a9a1aeeead5218d105f0ca908eec228f433c2bc805268b0fd8ad0234a23957b0c658452f8bd2fecddaf6344a5cead3867c61ddc7d904698aac6344628aa7e7aecf97f7cb0096c75344be9045808347b193e00723bd4480894c35fb655df217dcd5558a16", 0x7f, 0x100000000}, {&(0x7f0000000340)="3db73a4731bb2f58dffd63162c604dbac4890e57ec6f8f7f51dfbdf197e5f1639e31db5b617948eb7c1a0480", 0x2c, 0x98}, {&(0x7f0000000380)="e53b2478d6bf00cd85ac9ce6357e7310ea1bcfe8a939", 0x16, 0x8}, {&(0x7f00000003c0)="cd9c7ef345d7b41443f749cb4997bf6161540b07034b008cb23ef07f5e033dc83372c6d91fe883adbe8dcd0f2c74ffc9b2c59a45aeec8585de34ff9086529d95aae538cdf61f583077581f1d0a9a142f67655caa170adeea3ea0c16b634a5dc3cc8f6f5a85445c8e6f96df208da1b6ad81f2cc61f0a5d70de1e4eae58d2d2b1179ced9ac905b3a33e5b74a90985055559100aa399e40003c3d88b98deb40d35cb08bb14552f6ce895346", 0xaa, 0xffffffff}], 0x61000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) statfs(&(0x7f00000000c0)='./file0\x00', &(0x7f00000015c0)=""/4096) syz_mount_image$jfs(&(0x7f0000000000)='jfs\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="646973636172643d3078303030303030303030303030737572652c180000000000000000"]) [ 697.697290] binder: undelivered TRANSACTION_ERROR: 29201 [ 697.703020] binder: undelivered TRANSACTION_ERROR: 29201 09:17:22 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000100)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:22 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x630c}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:22 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) r2 = open(&(0x7f0000000000)='./file0\x00', 0x10000, 0xa0) getsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000100), &(0x7f0000000140)=0x2) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 697.792844] binder: 9899:9904 unknown command 1074553610 [ 697.801733] binder: BINDER_SET_CONTEXT_MGR already set [ 697.810205] binder: 9899:9904 ioctl c0306201 20000140 returned -22 [ 697.835871] binder: 9908:9910 unknown command 0 [ 697.842212] binder: 9896:9906 ioctl 40046207 0 returned -16 [ 697.860512] binder: 9908:9910 ioctl c0306201 20000140 returned -22 09:17:22 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x700, 0x0}) 09:17:22 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c6346}], 0x0, 0x0, 0x0}) 09:17:22 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000100)={0x4, 0x20000010, 0x0, {}, {0x0, 0x2710}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x934ea3e511ae0c2c}, 0x0) [ 697.929730] binder: 9908:9924 unknown command 0 [ 697.941573] binder: 9908:9924 ioctl c0306201 20000140 returned -22 09:17:22 executing program 2: socket$inet6(0x10, 0x3, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x800) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f00000001c0)) r1 = syz_open_dev$sndtimer(&(0x7f0000000240)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000000180)=0x1) r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/video2\x00', 0x2, 0x0) ioctl$VIDIOC_G_PARM(r2, 0xc0cc5615, &(0x7f0000000740)={0x7, @raw_data="6ffcad18134fc592b46cc861431819f699aae170f7311d9de7278d45e17fd0360f23f9422642747e71553a1276978b127a135c787ea6982c1ce85898e9ebe3641bf9a033ca9d28e271515e4fc6b40e7f77976d490c6e3af66d9349ffff506a72baa200f98f20541edbf6b4d861659781aeda7398fefe3fe0a685df893e43e72244ad2c1ca799e3e6dc5faea6ddd47a6e116b89ff33af99e6f059d1422d53491cd76363a0ecb7794a7882de620149cf4e49f88fd03ed73af2c93f22a02cd8369d1e38dd72cd069afa"}) epoll_create(0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0xfb) r4 = dup(r3) setsockopt$inet_udp_int(r4, 0x11, 0x6f, &(0x7f0000000080)=0x81, 0x4) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@dev, @in=@local}}, {{@in6=@mcast2}}}, &(0x7f00000002c0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000500)={{{@in, @in=@multicast2}}, {{@in6}, 0x0, @in=@remote}}, &(0x7f0000000600)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000640)={{{@in=@dev={0xac, 0x14, 0x14, 0x10}, @in6=@loopback, 0x4e22, 0x100, 0x4e22, 0xfffffffffffffffd}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, 0xe8) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000000), 0x4) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000340)={0x6, {0x2, 0x4e24, @multicast2}}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) exit(0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) utime(&(0x7f0000000280)='./file0\x00', &(0x7f00000004c0)={0xf3, 0x7fffffff}) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) bind$inet(r3, &(0x7f0000738ff0)={0x2, 0x4e21, @multicast1}, 0x10) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e21}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000300)={0x0, 0x7fff, 0x400082000001}, 0x14) shutdown(r3, 0x1) 09:17:22 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0xa, &(0x7f0000000180)=0xdf8, 0xd2) openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x800, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:22 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x4008630a}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 698.035774] binder: 9929:9934 Acquire 1 refcount change on invalid ref 0 ret -22 [ 698.088308] binder: BINDER_SET_CONTEXT_MGR already set 09:17:22 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001002ca50000000000000000f2cdc2b64e289968"], 0x48}}, 0x0) r2 = dup(r0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000000280)={0x10000000}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x141000, 0x0) r4 = syz_open_dev$amidi(&(0x7f0000000340)='/dev/amidi#\x00', 0x400, 0x52003) bind$inet(r4, &(0x7f0000000240)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$DRM_IOCTL_SET_UNIQUE(r3, 0x40106410, &(0x7f00000001c0)={0x4c, &(0x7f0000000140)="f0fe0c1b0a254d1d68e02b4d787e814fca6e289fe634f57f3cc8ec4b1be5573f8899b7d2c165c9e40f7ec4a38342ac2b6717558fcb25e743525a98cc32120906a4875407b959e1afbb3bbafc"}) write$P9_RMKNOD(r2, &(0x7f0000000300)={0x14, 0x13, 0x2, {0x0, 0x2, 0x8}}, 0x14) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 698.112344] binder: 9929:9934 unknown command 1074553670 [ 698.131351] binder: 9933:9942 ioctl 40046207 0 returned -16 [ 698.133300] binder: 9929:9934 ioctl c0306201 20000140 returned -22 [ 698.146680] binder: BC_ATTEMPT_ACQUIRE not supported [ 698.155657] binder: 9945:9948 ioctl c0306201 20000140 returned -22 [ 698.181258] binder: BC_ATTEMPT_ACQUIRE not supported [ 698.190213] binder: 9945:9954 ioctl c0306201 20000140 returned -22 09:17:22 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x42000, 0x0) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000140)={0x4, &(0x7f0000000100)=[{}, {}, {}, {}]}) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:22 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x68, 0x0}) 09:17:23 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x40046304}], 0x0, 0x0, 0x0}) 09:17:23 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) accept$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000240)={@remote}, &(0x7f0000000280)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000003c0)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', r1}) r3 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x1, 0x10000) ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f0000000140)={0x18, 0x33, 0x17, 0x8, 0x8, 0x400, 0x4, 0xf4, 0xffffffffffffffff}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000000000acd5993f1ccf0355b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0xfe61, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {0x0, 0x0, 0x20}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0xffffffffffffffff}, 0x8000) 09:17:23 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x400c630e}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 698.348020] binder: 9964:9969 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1074029316 [ 698.348388] binder: BINDER_SET_CONTEXT_MGR already set [ 698.364621] binder: 9968:9972 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 698.375844] binder: 9961:9971 ioctl 40046207 0 returned -16 [ 698.384199] binder: 9964:9969 unknown command 0 09:17:23 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x4c, 0x0}) 09:17:23 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x9) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180)='/dev/snapshot\x00', 0x10000, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) openat$random(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/urandom\x00', 0x214402, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x9, @mcast2, 0x9}, 0x1c) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x3, 0x42842) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f0000000100)={0x7, 0x4, 0x0, {0x0, 0x989680}, 0x1, 0x9}) ioctl$LOOP_GET_STATUS64(r2, 0x4c05, &(0x7f0000000200)) 09:17:23 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) accept$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000140)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 698.396251] binder: 9968:9972 unknown command 0 [ 698.403748] binder: 9964:9969 ioctl c0306201 20000140 returned -22 [ 698.413019] binder: 9968:9972 ioctl c0306201 20000140 returned -22 [ 698.452827] binder: 9968:9981 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 698.477517] binder: 9968:9981 unknown command 0 [ 698.491801] binder: 9968:9981 ioctl c0306201 20000140 returned -22 [ 698.523946] binder: BINDER_SET_CONTEXT_MGR already set [ 698.537218] binder: 9983:9988 ioctl 40046207 0 returned -16 09:17:23 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000500)='/dev/vcs\x00', 0x511202, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000540)={0xaa, 0x40}) socketpair$unix(0x1, 0xd, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x10400) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f0000000080)) ioctl$VIDIOC_DBG_G_REGISTER(r2, 0xc0385650, &(0x7f00000004c0)={{0x4, @name="4688f07eae6eaf83d673bf69403da188b541a671910b80778d383344ad2b662b"}, 0x8, 0x6, 0x80000001}) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000480)={0x4, 0x7, 0x4, 0x5c}, 0x8) r3 = userfaultfd(0x800) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x1e, &(0x7f0000013e95), 0x4) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0x23, 0x0, 0x0) close(r4) close(r3) socket$inet6_sctp(0xa, 0x5, 0x84) 09:17:23 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xf630c4000000000}], 0x0, 0x0, 0x0}) 09:17:23 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046346}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:23 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6000000000000000, 0x0}) 09:17:23 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhci\x00', 0x4200, 0x0) openat$cgroup_procs(r2, &(0x7f0000000200)='tasks\x00', 0x2, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x80000) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000140)={0x7d, 0x0, [0x10000, 0x3, 0x5, 0x9]}) 09:17:23 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x6, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 698.994789] binder: 10001:10010 Acquire 1 refcount change on invalid ref 0 ret -22 [ 698.998958] binder: 10002:10007 unknown command 1074029382 [ 699.019740] binder: 10001:10010 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 699.028803] binder: 10001:10010 unknown command 0 [ 699.033605] binder: 10002:10007 ioctl c0306201 20000140 returned -22 09:17:23 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) lsetxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='security.evm\x00', &(0x7f0000000140)=@sha1={0x1, "33ec4029f4ae7aee5508a7737e6034e2e41b2b85"}, 0x15, 0x2) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) ioctl$sock_proto_private(r1, 0x89ec, &(0x7f0000000180)="249b63c038df180e34de387587048eaecb257a711e605450d2f30f7ea229b4d572aeec6128ad0408") setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:23 executing program 0: clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) utimes(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={{0x77359400}, {r0, r1/1000+10000}}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r2, &(0x7f00000001c0)=@ax25={0x3, {"04a59240c10bb1"}, 0x1}, 0xfffffffffffffdac) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in6, @in6=@mcast2}}, {{@in=@multicast1}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000000)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in6=@dev}}, {{@in=@multicast2}, 0x0, @in6=@dev}}, &(0x7f0000000440)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000600)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000640)={{{@in=@multicast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast1}}, &(0x7f0000000740)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vcan0\x00', r3}) sendmsg$can_bcm(r2, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r4}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r4}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="0100000010000097b0d895331b3a0000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) [ 699.034238] binder: 10001:10010 ioctl c0306201 20000140 returned -22 [ 699.054277] binder: BINDER_SET_CONTEXT_MGR already set [ 699.059861] binder: 10002:10018 unknown command 1074029382 [ 699.067270] binder: 10001:10019 unknown command 0 [ 699.072802] binder: 10006:10017 ioctl 40046207 0 returned -16 [ 699.078807] binder: 10002:10018 ioctl c0306201 20000140 returned -22 [ 699.094898] binder: 10001:10019 ioctl c0306201 20000140 returned -22 09:17:23 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046309}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:23 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x7a000000, 0x0}) 09:17:23 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x1263484000000000}], 0x0, 0x0, 0x0}) 09:17:23 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhci\x00', 0x4200, 0x0) openat$cgroup_procs(r2, &(0x7f0000000200)='tasks\x00', 0x2, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x80000) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000140)={0x7d, 0x0, [0x10000, 0x3, 0x5, 0x9]}) 09:17:23 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', r1}) r3 = accept4(r0, &(0x7f0000000100)=@ax25, &(0x7f0000000200)=0x80, 0x800) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}}}, {{@in6=@mcast2}, 0x0, @in=@loopback}}, &(0x7f0000000240)=0xe8) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="0000000000b26ac35d9ea99d3d1d1c0000d77ee3f051f71e2e5ac6cdcd67b5d4a7553f7b37db9902fc408a3f85e3053ee41f1aac61de6e95bfa66d499e7156c0583a745bec0b3e3fd7812fc9e28e015919d117b20d9b957c8c6273", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r3, 0x111, 0x2, 0x1, 0x4) 09:17:23 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) getsockopt$netlink(r2, 0x10e, 0x7, &(0x7f0000000100)=""/79, &(0x7f0000000180)=0x4f) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x84000}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x198, r3, 0x702, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x74, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'gretap0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6gretap0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'erspan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffffffffffffff62}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x51}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x24, 0x20}}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3b}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x27, 0x14}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xff}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}]}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'yam0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5f}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x7f}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x1}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8}]}]}, 0x198}, 0x1, 0x0, 0x0, 0x40010}, 0x10) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @remote}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 699.216052] binder: 10033:10034 unknown command 1074029321 [ 699.236547] binder: 10033:10034 ioctl c0306201 20000140 returned -22 [ 699.267184] binder: 10033:10037 unknown command 1074029321 [ 699.291465] binder_thread_write: 20 callbacks suppressed [ 699.291474] binder: 10035:10036 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 699.320404] binder: 10033:10037 ioctl c0306201 20000140 returned -22 [ 699.327904] binder: 10041:10043 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 699.350139] binder: 10041:10043 unknown command 0 [ 699.360646] binder: 10041:10043 ioctl c0306201 20000140 returned -22 09:17:24 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046307}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 699.371066] binder: BINDER_SET_CONTEXT_MGR already set 09:17:24 executing program 0: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000140)={{0xa, 0x4e21, 0x7fffffff, @mcast1}, {0xa, 0x4e20, 0xffff, @local, 0x3f}, 0x8, [0x3, 0x53c9, 0xeb, 0x7b, 0x2, 0x0, 0x3f, 0x1000]}, 0x5c) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a74a59932ac27b7"], 0x48}}, 0x0) 09:17:24 executing program 2: mkdir(&(0x7f0000000640)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.advise\x00', &(0x7f0000000140)='bpf\x00', 0x4, 0x309de34b83a9ff65) syz_mount_image$ext4(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x20, &(0x7f00000004c0)={[{@nodiscard='nodiscard'}, {@stripe={'stripe', 0x3d, 0xfffffffffffffffc}}, {@stripe={'stripe'}}, {@auto_da_alloc='auto_da_alloc'}, {@abort='abort'}, {@journal_checksum='journal_checksum'}]}) 09:17:24 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x500000000000000}], 0x0, 0x0, 0x0}) [ 699.400095] binder: 10035:10050 ioctl 40046207 0 returned -16 [ 699.408714] binder: 10035:10036 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 699.439545] binder: 10053:10055 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 699.475257] binder: 10053:10055 IncRefs 0 refcount change on invalid ref 0 ret -22 09:17:24 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e21, 0x3e, @ipv4={[], [], @local}}, 0x18) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:24 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x600, 0x0}) 09:17:24 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000300)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000140)={0x0, 0xfb, 0x106, 0x5, 0x79, "2d432418c19d1c3600", "df57f463e2aca34247aaca4cdb17cd2a8893561dccd22c9a42c2aed14dc7ac6942be034e002f2096048411d4bd92480a7958b072817b32ef0354ce8728da12e3c2f24b0ee19077c2633f8f2a3af27d7028acaf9215d99b7f35d7f8e4dcbee2b2d78c3412ea4a1af709c3f9816602f567ae78373326426c526bdd587282e0735ff009bc52b68da20b7dd572b15ddcbf9011bf6f912411f96c893726a8af3c6317694bcc0b25428d3fbcbb0ae93682ced52056d884c51d616c10289933aa2d7c269de1ef631f125398339d45df772e01d52d8d67da61264a4108634b03e10dbf41bda61d6bcd2982b240ca153ab50dc5a131"}, 0x106, 0x3) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000090000000000000000000019f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = memfd_create(&(0x7f0000000000)='\x00', 0x2) r3 = syz_open_dev$vcsa(&(0x7f0000000280)='/dev/vcsa#\x00', 0x3, 0x101000) renameat2(r2, &(0x7f0000000040)='./file0\x00', r3, &(0x7f0000000380)='./file0\x00', 0x2) [ 699.518007] binder: 10053:10055 unknown command 0 [ 699.536586] binder: 10062:10064 Acquire 1 refcount change on invalid ref 0 ret -22 [ 699.556861] binder: 10053:10055 ioctl c0306201 20000140 returned -22 [ 699.575765] binder: 10062:10064 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 699.601386] binder: 10053:10072 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 699.619203] binder: 10062:10064 unknown command 0 09:17:24 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bond_sLave_1\x00', r2}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000001500010000000000000000000a000000", @ANYRES32=r3, @ANYBLOB="7f000000a3844c798f7780dc806d0000008000f1bc92a9c5fdb533e8b192dc9a2bd831840c1fdcf00cdfcb70ca13bec44dff6c34e532600d22af7d5601549e5c9dbad47b56acf08adf5d"], 0x2c}}, 0x0) 09:17:24 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20, 0xb, @mcast2, 0x400080000000}, 0x1c) socketpair(0x5, 0x4, 0x5, &(0x7f0000000000)={0xffffffffffffffff}) accept4$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14, 0x800) [ 699.636492] binder: 10062:10064 ioctl c0306201 20000140 returned -22 [ 699.641024] binder: 10071:10078 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 699.657677] binder: 10053:10072 unknown command 0 [ 699.679060] binder: 10053:10072 ioctl c0306201 20000140 returned -22 09:17:24 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x400000000000000}], 0x0, 0x0, 0x0}) [ 699.712953] binder: BINDER_SET_CONTEXT_MGR already set 09:17:24 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40106309}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:24 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000280)={@remote, 0x0}, &(0x7f0000000800)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/vcs\x00', 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r3, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x4e24, 0x3, @loopback, 0x61}, {0xa, 0x4e24, 0x421, @empty, 0x100000000}, 0x100000001, [0x20, 0x3, 0x2, 0x7, 0x100000000, 0x1, 0x9b3e, 0x2]}, 0x5c) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="0700393a1686409f199c0000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) r4 = getuid() syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f0000000140)='./file0\x00', 0x7, 0x3, &(0x7f00000004c0)=[{&(0x7f0000000180)="abd74ee29656a2fa20c1ce7852115dfaeca9efec330a97511b7d1cfdaf68a541c24e17397fc28154152505e1499787b6325f862d8c91bc60b29c73ccea861cdd5c95778c95313fda21178f0d4902d99a513b0da506f37da668f9adb79d016ed541bc17a664b09fbf0b92bee8e34e22047591f42180f9b590f9eec76679da66e1877850d65cddac9bc3090968509efec8086de33b9465800b0d0259b3a6893cba55703cd732e860c4aa2a5dabfc397bd413090b7aeb8269bd3d42938d3d60da3033a25eccbcf1cd06edb960e7", 0xcc, 0x100000000}, {&(0x7f0000000300)="4875e86468c9cdecb9ff8ba32c958e683354de48c33109d621674c597b4a97b17c8b1c7f85a678858362dc156dd644366071c7bac84efb93b56256d0ffa6d50b716985bd130ddd59e3891f5e2c38192725880879c72dae12880325769947fc153da5332ca15918cc94b27fbff55808938e86240f2bd3a7f32cf26f4839ede90f75a49f", 0x83, 0x5}, {&(0x7f00000003c0)="e41826aebe03e3b30eb727683edbaefadb5e78e3c056a013b729565fca0d25db61c0309bdd5703c78ab04fc64c2c973cd2f1af1184818959d238a4f96c8763f297fba5b2c3b3c36756389b6a3415cdd47ec3b8bb40b840a8a2815048c87826bc2e15dd1f452ff9470bef80f0318e12e061cc9d50ccc1d773cd525ec6b5df3db987e90441eed6c05a47c6bb7684d3a11e504ebef69e63abe449cdd6b4710c728e874458efa8", 0xa5, 0xfffffffffffffffa}], 0x80000, &(0x7f0000000540)=ANY=[@ANYBLOB='quota_quantum=0x0000000000000007,lockproto=lock_nolock,statfs_quantum=0x0000000000000008,quota=account,uid=', @ANYRESDEC=r4, @ANYBLOB="2c736d61636b66737472616e736d7574653d75826572776c616e313a70726f63766d6e6574302a74727573746564626465762c00"]) r5 = add_key$keyring(&(0x7f0000000680)='keyring\x00', &(0x7f00000006c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r6 = request_key(&(0x7f0000000700)='syzkaller\x00', &(0x7f0000000740)={'syz', 0x1}, &(0x7f0000000780)=')ppp1md5sumnodev%securitysystemppp1I]trustedmime_type$\x00', 0xfffffffffffffffd) keyctl$unlink(0x9, r5, r6) [ 699.733697] binder: 10071:10082 ioctl 40046207 0 returned -16 [ 699.755582] binder: 10071:10078 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 699.805390] binder: 10085:10093 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 699.839020] binder: 10086:10092 BC_ACQUIRE_DONE u4004630400000000 no match 09:17:24 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x7, 0x0}) [ 699.861258] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 699.868698] binder: 10085:10093 unknown command 0 [ 699.885580] binder: 10086:10092 unknown command 0 09:17:24 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x7, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x0, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 699.911629] binder: 10086:10092 ioctl c0306201 20000140 returned -22 [ 699.920734] binder: 10085:10093 ioctl c0306201 20000140 returned -22 [ 699.943734] netlink: 20 bytes leftover after parsing attributes in process `syz-executor2'. [ 699.980760] binder: 10086:10114 BC_ACQUIRE_DONE u4004630400000000 no match 09:17:24 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x463044000000000}], 0x0, 0x0, 0x0}) [ 700.023339] binder: 10110:10119 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 700.034114] binder: 10086:10114 unknown command 0 09:17:24 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x9, 0x20000) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffff9c, 0x84, 0x14, &(0x7f0000000180)=@assoc_value={0x0}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000100)={0x9, [0xffffffffffffffc0, 0x3, 0x9, 0x81, 0x38, 0x7, 0x3, 0x1ff, 0x1]}, &(0x7f0000000580)=0x16) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000540)={r2, 0x7ce4}, &(0x7f0000000240)=0xfffffffffffffffb) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0xc0, 0x0) setsockopt$inet_dccp_int(r5, 0x21, 0x200000b, &(0x7f00000005c0)=0x9, 0xfd5f) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000200)={r3, 0x80}, &(0x7f00000002c0)=0x8) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x400, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r6, 0xae03, 0x2) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000840)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r5, &(0x7f0000000500)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x9e7f21f768cabcca}, 0xc, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="9c0100001c052ba39ceef9cdfcddb9b3b061773ada34b4906d41b31f99496354201ef52df978b9a85fe528ade85cb451b4b9fbf3036929060a8148536bd2c2f5b02e052f99d91342bd90bc0af8cd40f4618c7d9ea7c0e9f3bc6a4e3c3adf36dac162495e8e105c9bda86957c2dfe904fd59ba72497ffb5a35a701298a425d994066c", @ANYRES16=r7, @ANYBLOB="000128bd7000fcdbdf2513000000c0000500080001006962000008000100696200001c0002000800040003000000080004000900000008000400090000003c00020008000400000001000800040008000000080002001a000000080003008ccd00000800030001000080080003007c080000080001001a0000004c00020008000200feffffff08000400810000000800010010000000080003000200000008000100120000000800010018000000080001000b0000000800030000020000080001001b0000000800010065746800100007000c0003002000000000000000100007000c0003000180000000000000a800010044000400200001000a004e220000009dff02000000000000000000000000000100000000200002000a004e200000000000000000000000000000000000000000ff0700001800010069623a76657468315f746f5f626f6e6400000000380004001400010002004e22ac14141b0000000000000000200002000a004e2106000000fe8000000000000000000000000000aa02000000100001007564703a73797a3200000000"], 0x19c}, 0x1, 0x0, 0x0, 0x40080}, 0x2000c041) 09:17:24 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuacct.usage_user\x00', 0x0, 0x0) write$cgroup_int(r1, &(0x7f0000000200)=0x2, 0x12) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'}) accept$packet(0xffffffffffffff9c, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000440)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', r2}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r4 = socket$inet_sctp(0x2, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000740)={0x0, @in6={{0xa, 0x4e23, 0x100, @empty, 0xba}}}, &(0x7f0000000800)=0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000840)={r5, 0xfffffffffffff771}, &(0x7f0000000880)=0x8) 09:17:24 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000580)={0x1ffff}) ioctl$KVM_SMI(r2, 0xaeb7) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 700.067699] binder: BINDER_SET_CONTEXT_MGR already set [ 700.068030] binder: 10086:10114 ioctl c0306201 20000140 returned -22 [ 700.119158] binder: 10110:10124 ioctl 40046207 0 returned -16 [ 700.129099] binder: 10126:10130 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:24 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x4c}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 700.183768] binder: 10126:10130 unknown command 0 09:17:24 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6c00000000000000, 0x0}) [ 700.209065] binder: 10126:10130 ioctl c0306201 20000140 returned -22 [ 700.250626] binder: 10142:10144 unknown command 0 09:17:25 executing program 3: setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000140)=0x92, 0x4) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:25 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x763044000000000}], 0x0, 0x0, 0x0}) [ 700.280348] binder: 10142:10144 ioctl c0306201 20000140 returned -22 [ 700.317884] binder: 10142:10152 unknown command 0 09:17:25 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) setxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.capability\x00', &(0x7f0000000180)=@v2={0x2000000, [{0x6, 0x4}, {0xbf7d, 0x6}]}, 0x14, 0x3) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000100000052f857a1b2cd95651", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) [ 700.337616] binder: 10148:10153 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 700.352182] binder: 10142:10152 ioctl c0306201 20000140 returned -22 09:17:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = dup3(r1, r2, 0x0) setsockopt$packet_buf(r3, 0x107, 0x2, &(0x7f00000000c0)="6e06bfa9a6513e19e41b0502cd431e4f9633f84b085ab66c0b9006f75aa98dc78cf8dadabbbbe8c2ddd3033c55c8fc384cc4b2c3b661795a0502d4c5608da76cbd2a3949859f85825188a1cd7773dae029a76270a893da90b4497d1c3ee35d6bbb342c961be10078301d62d55c1a616e7acc5ada916000fa220d7738ad1e0933cbe0f9a71779271c5a7dbcb1ac7975a133859035bd475d1482c0abf99dbfdf927dee87e9f3f52fb87aba2ea5b2def3cf1dc92f7d", 0xb4) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0xe816, 0xcf}) write$UHID_INPUT(r3, &(0x7f0000001640)={0x8, "e52aac313baccb9b551156a2d7c12b7711c32a17d3c4c9ceef08c2046fe288a7036e513019e5e114cc4ae935d23a9990952824f5d0c1f52e2eb94e5301ba9dc9a02818038eaef46fc2c3ebbe46e4a6024c93823f66462ba3d68913fdeadd1087b06846aa3ddf6ed3dc2b61b4960f48c2edf5cdf23c7e8d3f2e6daa71e66b29bc19e377d7df4637d735194a52da503a0ac44383ba5b3da867e09ceae02a9bfc21e7f28814c2fab7da41344e207ca706dc37592abdb685e4b80eb6dc2b1dc550a1d16166d163a4a220a54d7844facbbb2648ee90aa05c3c03ee447d79e517df8ffe70c215bd0bf69e86a5f48d571b9337590d05e9947727c0d77d18a117f110252735ca6700a55fd26838935808cce7b7c222a75339e44230bdeb99bc39c0c1cc20de74fcb9744f4c4a988f3874a846d31abcf5504d78a3e14f35f6cbd123fcff22890cc17c730c3ea9f74616dfe60064552ec25568a6211bdc39483a28bed0df0afc7d7c6d13d301e080c8846eab1a9d914b0695b16dd3009feaf204d22e32c5ecc333e616159d55328d375e59194c5c9a0b3843afb283d1d26f59e03105e91aa552386468432a09be73220e942394f34c559797b74bfe7c5c2c639a40e4d2e81e1004b127540a0bdd6be2f95698e75e4f1203a47d61f506ac9364be9d98ae46536f74afe08c450ecb902e00f188c9f32aed0677455e10bbe82c763a464f10f64c403c35376b7a675546835209f0e2809e9c2bd191f784dda4b727bfac512497a07474e6d3e13233601df81abcdb6fbfb152483ec61baaee45a5d733c62107f63c55a046401a5ddef70cef8d52cb4784e3efc34de554c8ff48f7ae3d6dc1ed4eb70fe1e610355fd66ce1a375b63b6641fb3dadfab8a9b0b1f26ca11f7287258ad4766e08340f8f2fd53e7e5f287bb73c186f0290f225687040c762776a02e5e65f1b9b713e8ef98ffe111b3e4e7b761dd3ed763ed8dafd67625fb300ac752c0ff9c0c04b75be292c3f0247bd0b3560f1c76aff38791037fcf2b812f1601934a8fc769f7198e0df685841489263a1495a8a8bab1a63cb12b3089a3e30aab15ae872437e52a6f0dbc4df2d0e8df4c6bcd47beefc179d85b70b42b319453e6efaff96a509420bec299f227c4b676c58038916897f15430ff52087dd97dd329c6b6e207378053accaa31843a333e4f69586103424f44bd67eb355c1fbe078e62f07ebaae46c3e335372127dc5fa70a4579af715e531bda52761dc206aded4678079720603a577ef7e5fb5a81a525b7c96a4047d9d6bb80d7e0ce55cc0a4f73256ae9c515307f13fe54126786de425d7a674b05116104176faac5b9365b33fd2f5a710a5159d342abecede83ad421bbb712cd5b006671a958cec907311719eb3e0b5dc4fb51054e06656a7a2a066c0aac65ceb434ca3f242cb2b1d7a22179a85cbbeeacc2f0135d8dd4d1363a98d2543fa4973e19eb359e956d27f142c75f62c7aecaf47090236b9791847725bc6fde15cd4a119a4976a3f0f2d622973ad9000aae56f88b396fa1881ec0b0a5de9955fc8f864b36eacd635b88826e0a64897d605fa4a14f7786b037cf308bef61c7f860e38f1ae67fe8cb7802dbe85f9c0c082eed1a13e645370d0c95d63bba215ac8a637b8f968aef06329d62ba131b56b46bfcfa6a5e82016d5eeb6e7db45595d1acaaa5ec9886315d3dced9d0a15c44c043ac91e4ae7077139774607b76cbc017f636145beb84c128cf35ddf4a895a56b8d141f743c9189a71387893f785804f85927a23ccd79c432ab686b621ec91706ef082b4ea4fa608ce2daca0d2e2e07ff51e6a8fdc22f1c8ee5ae53720f93b4547704fae580e5560e3c7b1ac2a38ffc294d3c96635e3b919339394843c8a171c7912ceb9c0a11be25783694b177b399e7a495538e293a59d3ab44b176afed6894aa0e501d9b98981be3f2057bf6c9869403a34cb83ad57150c674301f39524a026f3608a3414287bc4e507355823c6f8640bb803a392fb8847023d1db3c39753e72414682c617de9bd0d5b6a55d46004d49f20d2f8f53cdd8eb11402f7895cd7c01b4964fd005c564b0b0e156969ccde818dda3a7cae02d1d3af95081e6549f28976fa81b5e90fbb0a62fea850ffaf0220132189c11a74996261f6de6001c50364f08c4f48fd46a0417ec8ee4d003efeead64b87d64b43cd6868f365e72e26dd9f5f9f74d135f64464cb38dd62051ae70c5a4daabebe700eb9b290b8ed4142db0090219e6186f8f71fa8fe1ebe42f621b8eed182ee8ad0401f0a3530fd48e4d1eb2637f1fbd2a7032b0f85715203c12ab8ff48131bc4ff28272b57119a76bc0b30fef5294c23c0b2bcadfbba37a00502b5e43d72148d9acc7cb7cb39dc830cd6f30262a09eecf29d1055c2edc3926cfd5076aa5f9f172ed145359fc974ca5ded652433d212607bed155df1aff269414548a39a644b6ce927de5de6e6750575c4fd7ea7fe10b1e51fde6975c0c23fc012a8b12fe3fa64e972e4e09eafea165ae5c1ffc9d761e1314a781959c223b96eefde0f4f45c7ac032a8d3f1bd304114c3329a3e4966eddcc8d44ae70bad2932f963100955e2d2d487347c2aa8356bc6bc3c84e418163c758f1372246884e6d80d87d7ab3fe660dda13ada65f200b4fb365223b93bbc29493ae6dbbbb1823edb8e9f045b60414edab955e1046b67a8d4908ab08ad90216125d2ffd8c7814a9a4940df0a653b1cf53cf456412228445ebc8e1584adfe13207ff24fe602e2a506218710483b5544347a3d515b7d2ddcaa1bb7ae3578841918a8ed00659d5f260d23ae17a9ffc77f79758844586fe53517097838a92dde8873e8be1cd5934f1a4bfdd9d0b5725b811c4a2c121b7729946993a736bd195c55684ea680304af4844a1b2f74e2c2b2ccaeceb00b9c2c515b70912efb27643c5624025e358b44853cc0efddc103ee514471af902cd9b68f102c95a91d2b825b473ce842e6367b0b7305ce8be6f9c812abe860bb632e00b69a0370e5c8f9ba0cebbcbe1b9276949c303a4e9e3b6db37a0716520c07512192364abb58399fca973a1b32106096eda8bb85745562e8a35c5e917fdf858091a4c29d6549e10098d6b205fc5cad546fe07b3a70756cf7079c88f3708f0c8527002b99e80cbd584a3737fb37953cd6dccf21add4d4b6e65894490840c008578737d5e208649d1cd34beb403c2226300297853a29cf6c661b426c13306575d81f6fd21712e0ec4366013883b95fd1d5094acbf156e42de11cb873744983ec1ff9cfbee2278053b8b4e523388bd41dfd3c2ecaacc5d9d2958bbfa94f4bd0ac1c61c98ab295dd5c69020f1329818df9a2aa88ced03f4e6a4d1f8cb020afcd2384e65511ddeb908ba0c13a03dd32e8d4ccf0246008f35ef5184f81b8fed73b4aae4998bd8c7d784210042247d39396ba881bf43555d0ec58deede7b4729e79d31b2a346527594ca3a47a1723a792a701dc18d0124365e2c4a4fefed48c29a9f2fc747b302eaf92a100b2da211c91de4ab79d4aede483d852635c6f14d38095a5739d475c7aa67fdd54767a056eeb3098dfd8d1c21f32e76f0247f04118448273586856e641b83f540a643e72dc15804b78bac475f39e23291798aa45a2c10aa5fef2d5e4d7b8f529a66535d11c6149e9797f2fcce2804f2a5370345e98b0c02c7dd27135d414fe72f0740423920d68b64f6b8c05788c6692ceb4831b5d4593a970dc3ee2528765fb739964f4fed7200d7e796a9f3d0d60834e638dd8c29d4e85011e4ba4f127fe765954a5b5bb5d1cc69f2376599d5a3e8c30714893f763c06061072c10cb0eee17eb2a2514acc584b04e169d4a33a330367bb725ff9462f5d50282a2e393293eec8ea1eaab8297cc108798a4a57eccdb00647ab9f07318993f7c59c395a93cbd681d0a967a56e3f13c832c48dcc0d0096870b0d51b754e70b12a849b6f376923f7f7d909f64d64e1d6e338d39166b725265b96ed21e36b12057288d66e5df04b7b734ed0957d47fde172be2473b9ac6fdb823abe3e11ec69a170a14511d5572d6c0d9f6b749acad7003f0567bb6f9381649e42d02764077330d5af3d93185968a9f8dfed16c4a7c768a2bb98304946a557182c0ce93e82b340074e384cc6bd6129483386c654a6ab3bb12fe8e86adafa93f218fdf5019c09292858ae38ef7aa6a78e3f846215856d630ae9c5fc4009693b2767ea55c469f9099693287b35d43ee0f7a5baf3328d37b2c536f2abd6e21e472c105ae982cdd26a5a20562122e71efb1486c28d9409c3114b608f297695958c5604cf0918c0c70c56c79170260d73bde297e47cae1c404cca0a96eed51a2dc8f6f6ad862fe767ee5b5e68f231096825d935b809b3c1b5d9a2cd76cae22652bed7d263b42612ed717eba0aaf2a3989c4520c402d294285497a42736454ccb62fb3fdd073b91d4e2f6895fba9639ee78bd8ccb5bc3ce442fbeb9a1521314b82804293159fd7df4db66b78a06fe93e705bbc4e0d294a787c3cbf271b2acd15e7b4998c822f7724d3191e2265bd0d694dfb08063c9ff26a424884b46e26b5560d756c114ad1a7b92eee3f49dc2883b604ecc49c5ce92ce467778301326588a6577d44758e8d90710248d110dbf3d3d568779bd1c616369f84619dd089e38b51634f7c5d2ac9f1547a342877815a3864ad70b68b196bde9d810512f411d5235633ef65088788dfa3f152df7cee3a0803f6ac7ae192301dec07ff870ff3d7cf1c09cc9093263b225d01222376531007af9e6fb96e5ccaa8274f70adc786db7f33a20a752717b56b9a03bfce15a1aacd78c4adf8bdf41de8aaf421684c27526088c54322b5eea9175ef9c574c1f873218cc6f5df233892d7d5b0b0649ffc5a1c4909f2967a8c1f15b419ecde0448f071fa71e553f4f12cfa5e35022e75ddc5509edddc3de82d9097759b27f7c24776702e0ff64559281f796f11c1a9c77a156f390d2d18d1759b6be0347eb5bb4df912e9cfafa0db3be3243bacb378ca0946cece695a8099d6d7a24fc8bcca4c09695e3208f17f00bf404f6eb7852dfe73c163a19fd4e890e0edd5c7a727984b6f47a952373b95200bba061756c699c218b52c265b22bcd5cb24fdf056621fdd2126cede171e435320ca34e56e4c82a2afc9a59d3bf4647877658b6f23a6484f37acd8e2e184926993b5d1bbe6cdba64f486b4fb41bb94a644140540894f8fc14e585bc8beae88eabf926add289c82eb8cea99743baed842d76eb5c5573f7a7f3f2693960d6bfed697b5619afd942f41689dbd281a35e32478ba3a388dada82a2f4164481aa6a8f3946a84ea6186b20ce388c202be42996ae90feec7258d4a4a276353df84c96b160ac003d81cf395c0e61b0f0a9e692c32fab307f754cae5de7716a00cb96160cd39c931f4885d612862cecf6ba76502c9d266f97e4cf6cf0a16f787788e5471458a0dc24d3f2a28caa0f7ee00cf8bb113bd9c2b086037d765b5ec9a849df6f482fc01b48261e44299b0bc88321d837b6e2d221ebf2996b4140cd82e531de27f8de445f31c64469a5a145b031cd2569d19e27369c31ec63a989f0c9aaba7cc9d36d652001d40004f83a90d6465854f31bf15d1ef6bff4c02d60b948a37e3f50d250d7f85f545f507014aae5a35908283168c034f654acbb9d0fc261671d612e3d74261653e69e5e9cf7c8fda298b4d6c879cbbb97eafe648ba70150599089d65c1fdc0d5af879a2d46a443ac6dd21b33f72510742db4faf7eeb1580580ffe26e2d5ff", 0xca1}, 0x1006) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r2, 0x40405515, &(0x7f0000000040)={0x8, 0x2, 0x7, 0x8}) 09:17:25 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x7a}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 700.390150] binder: BINDER_SET_CONTEXT_MGR already set [ 700.400407] binder: 10156:10158 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 700.418263] binder: 10148:10159 ioctl 40046207 0 returned -16 [ 700.431376] binder: 10156:10158 unknown command 0 09:17:25 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/qat_adf_ctl\x00', 0x1, 0x0) ioctl$RTC_EPOCH_SET(r2, 0x4008700e, 0x15) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f00000000c0)=@sack_info={0x0, 0x7fffffff, 0xe7}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000140)={r3, @in={{0x2, 0x4e23, @rand_addr=0x2}}, [0x6, 0x10001, 0x8, 0x300a8f13, 0x4, 0xffffffffffff324c, 0x9, 0x0, 0x8, 0x4, 0x9, 0x6, 0x6a, 0x7ff, 0x10000]}, &(0x7f0000000240)=0x100) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000), 0x4) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 700.449457] binder: 10156:10158 ioctl c0306201 20000140 returned -22 09:17:25 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x700000000000000, 0x0}) 09:17:25 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = open(&(0x7f0000000100)='./file0\x00', 0x22002, 0x40) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000140)=[@in6={0xa, 0x4e22, 0x3ff, @empty, 0x7}, @in6={0xa, 0x4e23, 0x3, @mcast2, 0x3}, @in={0x2, 0x4e22, @multicast1}], 0x48) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f00000001c0), &(0x7f0000000200)=0xc) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000240)={0x2d, 0x4, 0x0, {0x2, 0x80000000000, 0x5, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x2d) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 700.513920] binder: 10167:10171 unknown command 0 [ 700.546241] binder: 10167:10171 ioctl c0306201 20000140 returned -22 09:17:25 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x4800000000000000}], 0x0, 0x0, 0x0}) [ 700.588875] binder: 10167:10180 unknown command 0 [ 700.597914] QAT: Invalid ioctl [ 700.607627] binder: 10167:10180 ioctl c0306201 20000140 returned -22 [ 700.612382] binder: 10178:10182 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 700.631532] QAT: Invalid ioctl 09:17:25 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0xc78057f1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="010000002ca24b362c80f680e85eb2d43ad7", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) r3 = syz_open_procfs(r2, &(0x7f00000001c0)='net/ipv6_route\x00') syz_open_dev$amidi(&(0x7f0000000400)='/dev/amidi#\x00', 0x5, 0x90000) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r3, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x94, r4, 0x1, 0x70bd2c, 0x0, {}, [@TIPC_NLA_BEARER={0x80, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xae}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x8000, @ipv4={[], [], @multicast2}, 0x2}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x2, @loopback, 0x9}}}}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @rand_addr=0x6}}, {0x14, 0x2, @in={0x2, 0x4e24, @loopback}}}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x20040041}, 0x800) [ 700.651335] binder: BINDER_SET_CONTEXT_MGR already set [ 700.668273] binder: 10178:10186 ioctl 40046207 0 returned -16 09:17:25 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x7000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:25 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000180)={0x0, 0x80000001}, &(0x7f0000000240)=0x8) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000380), &(0x7f00000003c0)=0x4) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000280)={r1, @in6={{0xa, 0x4e20, 0x81, @remote, 0x8}}, 0xffffffff, 0xfffffffffffffffd, 0x8, 0x8}, &(0x7f0000000340)=0x98) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$RTC_PLL_GET(r2, 0x80207011, &(0x7f0000000200)) setsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f00000001c0)=0x7, 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) splice(r3, &(0x7f0000000000), r0, &(0x7f0000000100), 0x7, 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @mcast2, 0x9}, 0x1c) [ 700.696620] binder: 10178:10182 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 700.713039] binder: 10187:10189 unknown command 0 [ 700.748268] binder: 10187:10189 ioctl c0306201 20000140 returned -22 09:17:25 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0xffffff7f00000000, 0x0}) [ 700.790230] binder: 10192:10195 unknown command 0 [ 700.805225] binder: 10187:10198 unknown command 0 [ 700.810072] binder: 10192:10195 ioctl c0306201 20000140 returned -22 [ 700.828922] binder: 10187:10198 ioctl c0306201 20000140 returned -22 09:17:25 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x80, 0x400001) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x84, r3, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x71}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x10}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x200}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xcf0f}]}, 0x84}, 0x1, 0x0, 0x0, 0x8000}, 0x4008091) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 700.846451] binder: 10192:10200 unknown command 0 09:17:25 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x40046307}], 0x0, 0x0, 0x0}) [ 700.887068] binder: 10192:10200 ioctl c0306201 20000140 returned -22 [ 700.915213] binder: BINDER_SET_CONTEXT_MGR already set [ 700.951794] binder: 10202:10207 ioctl 40046207 0 returned -16 [ 700.985697] binder: 10209:10211 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1074029319 09:17:25 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='loginuid\x00') pread64(r0, 0x0, 0x0, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x8000000) 09:17:25 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:25 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xb630000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:25 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x7000000, 0x0}) 09:17:25 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000000100)={&(0x7f0000009180)={0x1, 0x1, 0x0, {0x77359400}, {0x0, 0x2710}, {0x1}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 701.058234] binder: 10209:10211 unknown command 0 [ 701.072731] binder: 10209:10211 ioctl c0306201 20000140 returned -22 09:17:25 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x4}], 0x0, 0x0, 0x0}) [ 701.154460] binder: BINDER_SET_CONTEXT_MGR already set [ 701.194442] binder: 10219:10226 ioctl 40046207 0 returned -16 09:17:25 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000001000)={{0xa, 0x0, 0x3, @mcast2}, {0xa, 0x0, 0xfffffffffffffffe, @remote}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x413]}, 0x5c) setsockopt$inet_int(r0, 0x0, 0x40, &(0x7f0000000ffc)=0x10000, 0x4) 09:17:25 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6c000000, 0x0}) 09:17:25 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x8, 0x4) syz_mount_image$reiserfs(&(0x7f0000000140)='reiserfs\x00', &(0x7f0000000180)='./file0\x00', 0x5, 0x8, &(0x7f0000000740)=[{&(0x7f00000001c0)="4a8e53dffe1d1ec9c7aa0d75cdbc4edda1b82a068e8699abb66d87f295ba7d129a88d23d5ef4eda7cddb125255d2ec7ed046fa3bb81647fa0483aa815df0aa70346e62bf49bc26789aed1cf5fc2b6ff9062f3111275188511bf1f9574fb6853fc1cc86f4a51a09c895b245daa881356be511b7db9522c18bc6f77573b4d2ce18100fad43ddecdb0c5f992ff9f69c901570d5569372f26811545887d2671c94e808aaee07b7576d31fd9f01fd756d8d92d5a961745a0177c8baa0c3a033b6d0a5c54b87aec9b797cc2fd15eee5d34e20e0f57e2ddb9", 0xd5, 0x5}, {&(0x7f00000002c0)="b35d6adc0c7d02eb66011548a330b6d08f376b6dfe605d8bdb31eaa7bc3bf545e5f8931d", 0x24, 0xffff}, {&(0x7f0000000300)="dc2fc0bafb56b5aca913555e63253c46d8594e8c3cd4177d06721b96ba426f1a47492d5ad390f1a126a9e033e53d8762a6af4025888afcd3af0295a285c86dca32b780caf512af7ef17e60cd6109bc84b510238a7309aa17ca76f63d09cfdc6abbb7a03f62123a9917655edc214447eded3a1bea6e9ecc04a98ff3eedb96d6f49535ccd5c1b21c5bda2b70f19cde69432ce8710c3b510a8d8508a4b199074f896353d285e3e8b03ff61f6e366daa62e61b3c8a65a05d3cbe33a1db74fcd4b2d3df185b8f14ec1defbecae57a797b5675934bcc80e155e2c9fca43d4515", 0xdd, 0x2}, {&(0x7f0000000400)="c2d00e5de9ea9af8aff27d0bf8e752a2415aab01190b4e0c4e4e0fa95d8e0c7d25148c948d597bb45f6d9b7313f88a2942b2f915373d8746975b2e7bf27aacca9cad9aeca113c31516fbdd911f9e3fb680086146de8b38283699d0bf56d59a43f06cddcf9a1dfcdfabec48992a678b9b6fca5c3dd1d17d7deb2bd067912adddfd950aa6242d1057cd7b58649f2ae4c5abd75ad", 0x93, 0x48000}, {&(0x7f00000004c0)="ff408fedd6ec6f13fee5480935d59a5a9f1793bd7f32e68abd9a742c171578565f21", 0x22, 0x9}, {&(0x7f0000000500)="972ff63aeb234082bba2890b23a97cc5ebc5893f3640152cf6e40b9a0b434e750e36fd35889baa4952cd2e5d2cfd2c9d02a7d25685dbefa48c416910f6c5b8208f1630ad2789f528fac8d127aad8b84bf1a1f166e0f01c0cf65cbf2fd43055638e654f841709af6dfec2c34dcbdad71b3c22334b2b9c6cd20255be0c51c250f714f60ae622c2c1b8162e093478ba18ef8c79c42a5f9e0e48ef2d7722ed06c2a469676912de560cb49bbb92d60d3df3b71242bf91f3c925c9eb2286f2247706", 0xbf, 0x4}, {&(0x7f00000005c0)="a9c1e0b71ab4f1ceb0d45d68c0be46cfcd921f0820ebae17d46d4c88a990502bb8d140651878d3c01f159487cdd1a39fcc1120e188cf2fb0d8091d67d636d4992d6682ac57a6264c23b0b5d439c61656def722fb059c46bcc1e123c7e6cd86232e4f48e052aa6710edde68fc12940c7d30df", 0x72, 0x2}, {&(0x7f0000000640)="570df343b1bfc808d716987dbb1b834bc0c441b037fcb0ed48fa80acbad7e9cfd8ba270e9bc8c70b59975bfd1d6c9263f63e02612437eae8c8c98dd6af6bbb99a201b79caea1a130b89f823614ef1abef5345a0c3f84c3ea226daaf1da43d6a402898528b7a76a97f59a916fd2cdef20cdf376b6b82287b49bc119e0a763a1cb4c32c6a12c2c67dd1d54146439eb3aae43d86dc83cd1a264246dab53c74edd6fc398727fbb9bd8ee6bd2d689284df4f560a574bf426110828e6c84558555a25b3d127333ba1a3dca349dbc51532c6d82aa869b5302063b", 0xd7, 0xffffffff}], 0x2000, &(0x7f00000008c0)=ANY=[@ANYBLOB="6772706a71756f74612c6e6f7461696c2c646174613d77726974656261636b2c6673757569643d39377735613238372d33773f342d006300772d757761002d7f003d777f6500352c6f626a5f757365723d2c7063723d30303030303030303030303030303030303032352c6f626a5f726f6c653d2f6465762f76736f636b002c009939df731220b5fb3c31c33ae354eaff925b7b5277dfcc8266cdfc3c5c9dde5a"]) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) ioctl$EVIOCREVOKE(r2, 0x40044591, &(0x7f0000000100)=0x8) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000800)=0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000840)={0x0}, &(0x7f0000000880)=0xc) kcmp(r3, r4, 0x0, r0, r2) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 701.200089] binder: 10222:10230 unknown command 0 [ 701.205226] binder: 10222:10230 ioctl c0306201 20000140 returned -22 [ 701.236588] binder: 10233:10234 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 09:17:26 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="05001600000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 701.270325] binder: 10222:10239 unknown command 0 [ 701.275211] binder: 10222:10239 ioctl c0306201 20000140 returned -22 [ 701.294869] binder: 10233:10234 unknown command 0 [ 701.318252] binder: 10233:10234 ioctl c0306201 20000140 returned -22 09:17:26 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0xf20e, 0x101000) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000200)={0x6}) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8001, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[], 0xffdc) read(r0, &(0x7f0000000140)=""/165, 0x1000000eb) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000004bc0)=[{&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev}, 0x1c, &(0x7f00000008c0)=[{&(0x7f00000004c0)="fb077768b2a7175b5e0cd57936eb8d7a76dec0f00afe7531", 0x18}], 0x1, &(0x7f0000000ac0)}], 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)="dddfb13163a47dac4bb7ae18bdb544cb41bfefe621b179ecbbd8d05b0769d0d13bf9d883bb792a6348d380b17c0e3f379a62ac4457ad55051a", 0x39, 0xfffffffffffffff9) sendmsg$nl_route(r2, &(0x7f0000000540)={&(0x7f0000000400), 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=@ipv4_newrule={0x30, 0x20, 0x1, 0x0, 0x0, {0x9, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x4}, [@FRA_DST={0x8, 0x1, @local}, @FRA_SRC={0x8, 0x2, @remote}]}, 0x30}}, 0x0) 09:17:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x200000000000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:26 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="010000000000000000000000000000009ec43fbb5fc810eeb7f2e936a605ebe0b900ce58ed149438bbe24db3e0beae986837963ddc794de705415d5a314b95721604f5c237a1860799ca2426ff1488a260349f3f", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005f34a59932ac27b7"], 0x48}}, 0x0) 09:17:26 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x863104000000000}], 0x0, 0x0, 0x0}) [ 701.375139] Unknown ioctl 1074021777 [ 701.383017] binder: BINDER_SET_CONTEXT_MGR already set [ 701.390650] Unknown ioctl 21545 [ 701.396037] binder: 10249:10253 ioctl 40046207 0 returned -16 [ 701.472002] Unknown ioctl 1074021777 09:17:26 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x3000000, 0x0}) [ 701.496145] Unknown ioctl 21545 [ 701.513746] binder: 10262:10264 unknown command 0 09:17:26 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x1e, 0x3ff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x8000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f00000001c0), 0xc, &(0x7f0000000700)={&(0x7f0000002400)=ANY=[@ANYBLOB="4fe3e34a123c"], 0x1}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000008440)=[{{&(0x7f00000002c0)=@rc, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000140)=""/44, 0x2c}, {&(0x7f0000000340)}], 0x2, &(0x7f00000004c0)=""/234, 0xea, 0x3}, 0x2}, {{&(0x7f0000000400)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/89, 0x59}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000000640)=""/122, 0x7a}, {&(0x7f0000001780)=""/206, 0xce}], 0x4, &(0x7f0000001880)=""/50, 0x32, 0x100000000}, 0x9}, {{&(0x7f00000018c0), 0x80, &(0x7f0000001f80)=[{&(0x7f0000001940)=""/119, 0x77}, {&(0x7f00000019c0)=""/39, 0x27}, {&(0x7f0000001a00)=""/251, 0xfb}, {&(0x7f0000001b00)=""/254, 0xfe}, {&(0x7f0000001c00)=""/215, 0xd7}, {&(0x7f0000001d00)=""/156, 0x9c}, {&(0x7f0000001dc0)=""/133, 0x85}, {&(0x7f0000001e80)=""/94, 0x5e}, {&(0x7f0000001f00)=""/60, 0x3c}, {&(0x7f0000001f40)=""/53, 0x35}], 0xa, &(0x7f0000002040)=""/133, 0x85, 0x5}, 0x5}, {{&(0x7f0000002100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f0000002700)=[{&(0x7f0000002180)=""/205, 0xcd}, {&(0x7f0000002280)=""/160, 0xa0}, {&(0x7f0000002340)=""/192, 0xc0}, {&(0x7f0000002440)=""/70, 0x46}, {&(0x7f00000024c0)=""/82, 0x52}, {&(0x7f0000002540)=""/154, 0x9a}, {&(0x7f0000002600)=""/253, 0xfd}], 0x7, &(0x7f0000002780)=""/32, 0x20, 0x1}}, {{&(0x7f0000008680)=@generic, 0x80, &(0x7f0000003c00)=[{&(0x7f0000002840)=""/162, 0xa2}, {&(0x7f0000002900)=""/46, 0x2e}, {&(0x7f0000002940)=""/161, 0xa1}, {&(0x7f0000002a00)=""/248, 0xf8}, {&(0x7f0000002b00)=""/4096, 0x1000}, {&(0x7f0000003b00)=""/159, 0x9f}, {&(0x7f0000003bc0)=""/52, 0x34}], 0x7, 0x0, 0x0, 0x1000}, 0xfffffffffffff000}, {{&(0x7f0000003c80)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000007100)=[{&(0x7f0000003d00)=""/210, 0xd2}, {&(0x7f0000003e00)=""/165, 0xa5}, {&(0x7f0000003ec0)=""/240, 0xf0}, {&(0x7f0000003fc0)=""/253, 0xfd}, {&(0x7f00000040c0)=""/4096, 0x1000}, {&(0x7f00000050c0)=""/4096, 0x1000}, {&(0x7f00000060c0)=""/29, 0x1d}, {&(0x7f0000006100)=""/4096, 0x1000}], 0x8, &(0x7f0000007180)=""/224, 0xe0, 0x5}, 0x1}, {{&(0x7f0000007280)=@ethernet={0x0, @link_local}, 0x80, &(0x7f0000007800)=[{&(0x7f0000007300)=""/76, 0x4c}, {&(0x7f0000007380)=""/37, 0x25}, {&(0x7f00000073c0)=""/233, 0xe9}, {&(0x7f00000074c0)=""/242, 0xf2}, {&(0x7f00000075c0)=""/83, 0x53}, {&(0x7f0000007640)=""/183, 0xb7}, {&(0x7f0000007700)=""/233, 0xe9}], 0x7, &(0x7f0000007880)=""/48, 0x30, 0x101}, 0x9}, {{&(0x7f00000078c0)=@ax25, 0x80, &(0x7f0000007d00)=[{&(0x7f0000007940)=""/100, 0x64}, {&(0x7f00000079c0)=""/118, 0x76}, {&(0x7f0000007a40)=""/1, 0x1}, {&(0x7f0000007a80)=""/237, 0xed}, {&(0x7f0000007b80)=""/40, 0x28}, {&(0x7f0000007bc0)=""/186, 0xba}, {0x0}], 0x7, &(0x7f0000007d80)=""/178, 0xb2, 0x12}, 0x1}, {{&(0x7f0000007e40)=@rc, 0x80, &(0x7f0000008340)=[{&(0x7f0000007ec0)=""/103, 0x67}, {&(0x7f0000007f40)=""/88, 0x58}, {&(0x7f0000007fc0)=""/157, 0x9d}, {&(0x7f0000008080)}, {&(0x7f00000080c0)=""/203, 0xcb}, {&(0x7f00000081c0)=""/94, 0x5e}, {&(0x7f0000008240)=""/218, 0xda}], 0x7, &(0x7f00000083c0)=""/101, 0x65, 0xc7}, 0x146}], 0x9, 0x40012103, 0x0) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x410402, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbbf4, 0x2800000000000000}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x22, 0x1, 0x0, 0x1fffff, {0x4}, [@nested={0x8, 0x11, [@generic="e2"]}]}, 0x1c}}, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000380)='fou\x00') sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000d65000)={&(0x7f0000de2ff4), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000030000000000000000975d0d3122c6a5b05a42000000cd321bcb21bfa769936eb8b37a0cc9216ed15af5d500000000bf68df327a955ef7873e53de973c8e9f9f23925dd8b247753c8fe89cd5a03513142ee05abc6dd4a914c69a5f979a7973e65117a2ec9b0c45a82fa860f9d30ccae7f73db2c0137625d86fe59b0172b838da531a05a8ab2420882690ede142ca3c143916d8f31a33ba8bf45d8a0c1b31504d53992598"], 0xa7}}, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000007c80)=0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:26 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r0, 0x29, 0x0, &(0x7f0000000340)=0x5e63, 0x3) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200000, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x0, &(0x7f0000000040)={@remote, 0x0}, &(0x7f00000002c0)=0x14) r4 = getuid() getresgid(&(0x7f0000000100), &(0x7f0000000140)=0x0, &(0x7f0000000180)) r6 = msgget$private(0x0, 0x304) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f0000000300)={r3, 0x1, 0x6, @link_local}, 0x10) msgctl$IPC_RMID(r6, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x2) write$FUSE_ENTRY(r0, &(0x7f00000001c0)={0x90, 0x0, 0x4, {0x3, 0x3, 0xff, 0x2, 0xafd4, 0x7, {0x6, 0x447b, 0xfffffffffffffffc, 0x0, 0x9, 0x5, 0x1, 0x8000, 0x1ff, 0x1a9, 0x1, r4, r5, 0x0, 0x100000001}}}, 0x90) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) [ 701.552789] binder: 10265:10267 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 701.563624] binder: 10262:10264 ioctl c0306201 20000140 returned -22 [ 701.578525] netlink: 4 bytes leftover after parsing attributes in process `syz-executor2'. [ 701.592501] binder: 10265:10267 unknown command 0 [ 701.617142] binder: 10262:10276 unknown command 0 [ 701.626865] binder: 10265:10267 ioctl c0306201 20000140 returned -22 [ 701.642831] binder: 10262:10276 ioctl c0306201 20000140 returned -22 [ 701.661717] binder: BINDER_SET_CONTEXT_MGR already set 09:17:26 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x500, 0x0}) [ 701.667030] binder: 10273:10281 ioctl 40046207 0 returned -16 09:17:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x1000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:26 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x40106308}], 0x0, 0x0, 0x0}) 09:17:26 executing program 3: r0 = socket$inet6(0xa, 0x8000000, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x101, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) getpgid(r2) [ 701.816405] binder: BINDER_SET_CONTEXT_MGR already set [ 701.827705] binder: 10290:10292 ioctl 40046207 0 returned -16 [ 701.828107] binder: 10293:10296 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1074815752 [ 701.834989] binder: 10295:10297 unknown command 0 [ 701.855401] binder: 10295:10297 ioctl c0306201 20000140 returned -22 09:17:26 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r3, 0x1, 0x70bd25, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40080) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 701.892113] binder: 10293:10296 unknown command 0 [ 701.897512] binder_thread_write: 24 callbacks suppressed [ 701.897530] binder: 10295:10303 Acquire 1 refcount change on invalid ref 16777216 ret -22 [ 701.912078] binder: 10293:10296 ioctl c0306201 20000140 returned -22 [ 701.972375] binder: 10295:10303 unknown command 0 [ 701.989309] binder: 10295:10303 ioctl c0306201 20000140 returned -22 09:17:26 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0xf20e, 0x101000) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000200)={0x6}) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8001, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[], 0xffdc) read(r0, &(0x7f0000000140)=""/165, 0x1000000eb) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000004bc0)=[{&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev}, 0x1c, &(0x7f00000008c0)=[{&(0x7f00000004c0)="fb077768b2a7175b5e0cd57936eb8d7a76dec0f00afe7531", 0x18}], 0x1, &(0x7f0000000ac0)}], 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)="dddfb13163a47dac4bb7ae18bdb544cb41bfefe621b179ecbbd8d05b0769d0d13bf9d883bb792a6348d380b17c0e3f379a62ac4457ad55051a", 0x39, 0xfffffffffffffff9) sendmsg$nl_route(r2, &(0x7f0000000540)={&(0x7f0000000400), 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=@ipv4_newrule={0x30, 0x20, 0x1, 0x0, 0x0, {0x9, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x4}, [@FRA_DST={0x8, 0x1, @local}, @FRA_SRC={0x8, 0x2, @remote}]}, 0x30}}, 0x0) 09:17:26 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x74, 0x0}) 09:17:26 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x7400000000000000}], 0x0, 0x0, 0x0}) 09:17:26 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x7a000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 702.065207] netlink: 4 bytes leftover after parsing attributes in process `syz-executor2'. [ 702.165382] binder: 10312:10313 Acquire 1 refcount change on invalid ref 2046820352 ret -22 [ 702.173690] binder: BINDER_SET_CONTEXT_MGR already set [ 702.190269] binder: 10318:10324 ioctl 40046207 0 returned -16 [ 702.196402] binder: 10315:10322 unknown command 0 [ 702.201896] binder: 10315:10322 ioctl c0306201 20000140 returned -22 [ 702.208592] binder: 10312:10313 unknown command 0 09:17:26 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000300)=0x3, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x400001, 0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000280), &(0x7f00000002c0)=0xc) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2001}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00032cbd7000fedbdf25020000000800030002000000080001004e2300000400050008000400010000000800040003000000080002000a0020efe1fad62fc0fe000008000300ff0000000804040002000000"], 0x3}, 0x1, 0x0, 0x0, 0x20044004}, 0x0) [ 702.216420] binder: 10312:10313 ioctl c0306201 20000140 returned -22 [ 702.216588] binder: 10315:10325 unknown command 0 [ 702.227950] binder: 10318:10323 Acquire 1 refcount change on invalid ref 0 ret -22 [ 702.228863] binder: 10312:10326 Acquire 1 refcount change on invalid ref 2046820352 ret -22 [ 702.236111] netlink: 4 bytes leftover after parsing attributes in process `syz-executor2'. [ 702.244803] binder: 10312:10326 unknown command 0 09:17:27 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@loopback, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000200)=0xe8) r2 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$get_persistent(0x16, r1, r2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a2899b1"], 0x48}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x80001000, 0x200000) r5 = socket$inet6(0xa, 0x3, 0x3a) r6 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/audio\x00', 0x40, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r5, 0x84, 0x20, &(0x7f0000000200)=0x400404, 0x4) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)=0x0) ioctl$TUNSETGROUP(r6, 0x400454ce, r7) userfaultfd(0x0) epoll_ctl$EPOLL_CTL_MOD(r6, 0x3, r5, &(0x7f0000000280)={0x2}) syz_genetlink_get_family_id$team(&(0x7f0000000600)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000640)={'team0\x00'}) getpeername(r6, &(0x7f0000000680)=@xdp, &(0x7f0000000700)=0x80) getsockname$packet(r4, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000780)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000800)={{{@in6=@ipv4={[], [], @remote}, @in6=@mcast1}}}, &(0x7f0000000900)=0xe8) getsockopt$inet6_mreq(r4, 0x29, 0x15, &(0x7f0000000b80)={@local}, &(0x7f0000000bc0)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000c00)={'vcan0\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000004780)={'veth1_to_team\x00'}) accept(r6, &(0x7f00000047c0)=@xdp, &(0x7f0000004840)=0x80) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000004880)={{{@in6=@remote, @in=@loopback}}, {{@in=@broadcast}, 0x0, @in6=@dev}}, &(0x7f0000004980)=0xe8) accept$packet(r4, &(0x7f0000004d80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000004dc0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000004ec0)={'team0\x00'}) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000005000)={{{@in6, @in=@broadcast}}, {{@in6=@local}, 0x0, @in=@loopback}}, &(0x7f0000005100)=0xe8) 09:17:27 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xa00000000000000}], 0x0, 0x0, 0x0}) [ 702.260722] binder: 10315:10325 ioctl c0306201 20000140 returned -22 [ 702.262486] binder: 10312:10326 ioctl c0306201 20000140 returned -22 [ 702.267808] binder: 10318:10323 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:17:27 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x200000000000000, 0x0}) 09:17:27 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x4800}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 702.395294] binder: 10332:10334 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:27 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0xf20e, 0x101000) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000200)={0x6}) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8001, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[], 0xffdc) read(r0, &(0x7f0000000140)=""/165, 0x1000000eb) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000004bc0)=[{&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev}, 0x1c, &(0x7f00000008c0)=[{&(0x7f00000004c0)="fb077768b2a7175b5e0cd57936eb8d7a76dec0f00afe7531", 0x18}], 0x1, &(0x7f0000000ac0)}], 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)="dddfb13163a47dac4bb7ae18bdb544cb41bfefe621b179ecbbd8d05b0769d0d13bf9d883bb792a6348d380b17c0e3f379a62ac4457ad55051a", 0x39, 0xfffffffffffffff9) sendmsg$nl_route(r2, &(0x7f0000000540)={&(0x7f0000000400), 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=@ipv4_newrule={0x30, 0x20, 0x1, 0x0, 0x0, {0x9, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x4}, [@FRA_DST={0x8, 0x1, @local}, @FRA_SRC={0x8, 0x2, @remote}]}, 0x30}}, 0x0) [ 702.448786] binder: BINDER_SET_CONTEXT_MGR already set [ 702.480190] binder: 10336:10341 ioctl 40046207 0 returned -16 [ 702.489216] binder: 10332:10334 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 702.502820] binder: 10340:10345 Acquire 1 refcount change on invalid ref 18432 ret -22 [ 702.525222] binder: 10332:10334 unknown command 0 09:17:27 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x74000000, 0x0}) [ 702.536288] binder: 10340:10345 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 702.544219] binder: 10332:10334 ioctl c0306201 20000140 returned -22 [ 702.550451] binder: 10340:10345 unknown command 0 [ 702.574773] netlink: 4 bytes leftover after parsing attributes in process `syz-executor2'. 09:17:27 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x1) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, r3, 0x108, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x38, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x91}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9c83}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc000}, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:27 executing program 0: getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000001880)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f0000000280)=0xe8) r1 = getuid() r2 = getuid() syz_mount_image$hfsplus(&(0x7f0000000200)='hfsplus\x00', &(0x7f0000000240)='./file0\x00', 0xe3, 0x7, &(0x7f00000017c0)=[{&(0x7f0000000300)="100ec0599a7466d53267da2bf4c2b30f0c9fdfe3abab8efd78efa89675fe253d699c47c3fc753160c71f26eb0fae4e736108790f7801fc15c8125593e1e0e32dabe95c2ba3922d434e22984b23bb7e4f922a4b36c29877ca7e3f4d23071e91070841074c35820a793cb3689496d8d066fe0665aebca58652e1845e461ea3a90a7e90ed45b0b1736f6becd71430a2bd4c7565264f5f01a3cadda49ad163786be43a7c92afb12796e20619ed401e6370", 0xaf, 0x1}, {&(0x7f00000003c0)="2ffe7574bfbf51238b39aa08e249e8aa763c8e7f6094249583c53b4ec901e14e76d784925c70a65eed0c3bb7005f590e0400c5b7e574293849ec78f44f3c161623554a5d235ca8edb0c7e97f2753db0fd96078b2344aa0916ed798084428251eb8fc6bda3cd8a6de7eaeb4b6a1c4274104324b5083db05c92e577879cf156460dda1203a346a9d4fed2a5af711e5e7ed33cdd6542bd9e6b8ebe5a838d382a1f8ae88e381d12c4bd4881668b515744ab31382c143fb115f0a2c76788390", 0xbd, 0xedd}, {&(0x7f00000014c0)="ec21dcfc924409cb6612b05f49c851f4448492fa921a319391bfdc3459948a249c17c6d7cea1939cff9a24dc255382224a0c2c909260765d83e1ef7722e5efbc072fd89510cfbe322d7b475127", 0x4d, 0x6}, {&(0x7f0000001540)="8c261099b59df7a317a62231f36b008cde71d2d3db70fdf3efea34d6da854efb2cd2322c421fa0f9ae858583770612e7393051035c9af046217f1227742c522ef6759ee8beda48e251cab1603cb162f0833a5086d301318abf809d19a2fa3d", 0x5f, 0x11a0}, {&(0x7f00000015c0)="a5fd0eb190d1ab3e911fc1551d02606dd7eec55ce22bd1e488672e7bd2b1000a6b88f068fcf368916df708cee0efbeacc5effee494b64899c020d9b08b7169da701085479513c0478dd17789d9befc", 0x4f, 0x5}, {&(0x7f0000001640)="75a2bd0bc77bdbc2b5dcaa31d872307b56bdbec3c1d50dffcda4b845a3ecaaf02205632c14c918632a485ba0b451146e97de96f968fc1da2e0b77cc78c6e2ddefabf8c63b97f5dcbb06db103c260d8e14cd1d7c10d2508e37b2bd6c5ee40e066b32ed1d377a64ea18ec14dac41bec0cb8ddb845ac32426b9e7eea4e8f4de8a0f24ead30e325b0f6406e0d035b2add75b10405e495efa69c743e6ee46e302edb1b9841b9efdaa85c4e72f26fc06ae35f5839bb3ec4e440b9dacb878dd46fa298421e855a843169f7a26bc16c49e8c45615224c098418ff385e54baafdf6c800043890b78c", 0xe4}, {&(0x7f0000001740)="a36dad994b580dc001240bfcdbf444df393edcc00fe3d6aceeae18aa14f267dd15b8c6b979f65b8aaa3f94512fee8ec3621dbd1a684ed95fb77249b98ed0f9ef8dceba556005964f163f968a5c5e3ba765cd", 0x52, 0x7}], 0x40010, &(0x7f0000001980)={[{@uid={'uid', 0x3d, r0}}, {@uid={'uid', 0x3d, r1}}, {@part={'part', 0x3d, 0x9}}, {@nodecompose='nodecompose'}], [{@uid_eq={'uid', 0x3d, r2}}]}) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r3, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r4}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) syz_mount_image$ntfs(&(0x7f0000000100)='ntfs\x00', &(0x7f0000000140)='./file0\x00', 0x4, 0x1, &(0x7f0000000180)=[{&(0x7f00000004c0)="eab5b5bd4f054770e7a50aa90aa89651008fce000ab1cb04be9fa97969f39ef32160c578e3926f8ea54b445f2eb4be2cd6d703c0d91af859ce54ff647e59ee13dbb66167b1eb7b5db79e7573b0174a8fa05aee8031269b4fec0b5361d792831a9f61f6e9c0d686df294fd4e3ad25ba64a73dc8ff024bb83071d5fbc906d6bab9dc78335e68eb289848794ebab78deef8528b22eaedeecd89fc68eae5c48d75e42a2f2ffe23a37390f0e97681801eaa53b45d2f3603c1761585ba3f5d35945a66fc2f2cf06649bf7816936c2eba1dab7a6b7b7a1716bb62c250e4c1a3869a558faca5a9310273a65eec67cf454e15cb9ccecf3443ff6d39cb8cce9515050e04e6710e53b3296bf00785bae5bf41c0e832ac51de4984228b0945a3d3e519b0284fe9b94e1d1a46d9a455a43ab10a3ef2154e6d7616caff5bb1f12f37827501943d316e96d9d4da71967a281b59c1dc6b9a614dff2f577c7ce46caef79628d014778f37be7b4857d923dfeeedd88070718913b93434f8a070365a0582a885b5e494652b258fb0a010f7ebd09d0bb7bdc8a3ef827e1f3e22ebf6f1368ee2f3736f3cac3249d182552664c7d8e138ccc9cfd23e5c7ac47039a86952288afc8819e9cf7ab472b8d963f516555692d5cf0152f87ff2fbd86195aeaa4600c583cb40f7df91126d7edd7e7032d53e86aed2f14292f6a8f2caf05817ea594956c434532c1398514c54186340de3fc41b0a6a3ebc3d846eaac970a5d01d5031bff4e64a72fb1e3d810369e9b2b935fdfa32da70613d0a1ce974ec8558e9db585f0f91206c7579119c6761bed206473f0fcffc36004f25da7ce4c2953f2356691cb43894ef564f160a4f349eed63897757023ebf2215065d37c92d145c97c3886757cc1f6393ead93117c7672e16819e64b05d43e1bb6b68ecffa9a8fadf4ceb351b65a5d0a45951e9300aba7fa29566a93ef93d030f979bb37af81ea512701b3ab9cb50e36e3335463b9bf719d2b8270b3722437e900d43b37403929466eb511f98ac89ba2e71b25063c3892ef62495ba7d10b9394a6ab3fc5a6dab086d9ac0234a3c47d56dc225a7156e64e808d3cfcad6e2dfa6e171c7884f158f78c6997f22519ec4a5b86db05e11132f1ee6b1bc607a1191c4dd76985497beccab029ef6a180cc2f000de2b44dece793e34451aa9dad245cbc3b44ae549bd49b895ed5dd5414de011c725e788da54fb29cc5de3b285e7520c69ca72d5f8f71c0a733075d5d70b3670e0bcf557a521006b8b13cfd3a7196be34b10060f0fc1722181f46b821dab1f180132a0242c0d91b3e75076745f6f7d04032f1598041ad869eec508cfcd20f0eb592465616fbd1d14284005df3bb293cdaf727676a3edb0b2d74d73bd091ed06d7e3bb32d26314148a7f37895cd755752ca9b1efd28f85af801f2cb277aef180f6e67db4857fb0930fcf467cf9f0140b1a14c93dea174f16cd3b305dcb53f0ccaf2195e37f62b30ba5ce1c2b55f152f1bc25ab6889bfa6c1da65e676402bbb097156efe41731162ffe814124a573710fc2f6b6d57e3e44ff7d3c8da86fd2005170548c91026dfe1579c922f1e7bf539a3ea0e00942fd4b20d0edf79e300fa8e71be5d92831c9782379dd31018f37e114a41828b9c967d868f094099b0dcb920233aec29cc851bae929605f55881e10b241a5eda6e60455193f94de241c7d8ae7278f49fba8b5df9bea2863a88e3b913123bbef7e1f440f2e69050d68b5bfda8cd0c4d0597f31a60a22af133cec2dd4cfc1434ca7327c0c0ff3d66b6ca5c17d261986fb9b20dc4905521585d6f171ecf4908d81302e7d9e55a57fea8135c440f7794d490f78850e69e886633c95ed976f5cbc64485783f44772911f3cc3017a0c202ed7fbcc4d49d4b8fefaa1f350e5f454dc09eb3e84dc1f9d9841656fe1bb477c841b5deaeda22d07510c587e52b2a733e11c15e118fc77db134944428583f852ac513f1a562c690681aa571842a06dc4927d2dc0f095242617d4d2825b66e12286cd75a5b0fabbad413ea74832284e3d775c16389ced4448fe3db469661f2d24a01e7a4b36b6f2de1ed00782919d5084cebda98b1a7587cff286c11941a29f3df3106ad12f4ac8dfa50347da4b7e0f3ed025c0559654bf2a686734169e1f54e2eb458e680b984a84fb3db0639d92be590adf7cdccd63e8f1a2a182a8007fa186d6e3982c004fe0daa6ddde3c5e001beea1b5b44e54913cddc0c133cd82f46e5318ef37ac6c977ec7aa1b7c141976a7b6d11eaa8a52fcc9f4e5b17250e5d1dbdad1908f6bef18eceee4143a5583edd55b46c106753a046f6938aed7ab6f1e61c9c8c49b779423a246f83e9e369576401efd14dbffc11707cfedf7ea82d34b12c3b477955fd72093a5683c7a45f36b28d7d85b4bb4e9b078f83be9ae79498499a3ca095f8437b2660e6bf02473bc005ece04a96078965686e0d6bc01162b79b9355df7ef72043def6500f315f8fa5546b865acd9d2a9983b5ce84110136c4eb1be006ded11107f7d1f8abdf053275061fad0912c93be25d7df631f592ded85b94da2068831bb694e11554b2fbe3932a35c765503dc3c2eb8e6e70e929d17ebd0dfbefa34e6f45fb4ebf0fcae61a252b5b29fbf21b3b87b8a543216c03d923f902db26c3e86d4574ede7abba2e33cd961685c02bf0c0944bd6bd96549fe967b6623a5553a8b84a3edf6cc7544c542df7a1e2d111c1f6cdc9634663501a0b0a1966ef5f9e1284896d005c98feb3b68c7a0eecda0b61a3bf6bd2be7cdac5c013be7adf33646395717b7c9049368002cf1b77abfe0ea7781af8e7958af32aaf6b5530a1f44c4b6a4005d088b2dd443b7993e4cb38bb7df082864063ad275715fdb77cd85db518acd65457c9b9089433bbb8c291a17a58aff55c77c5c3e275672547401184add624ab104f5b06ba1ebcb3e09880b4b92a2a64338409716647161d86f966de0263327040e5ee92ee8de1b2729a1047f50ca3ab3891c5325134c81f635a0f72e282d4b03008692e37a5ed050999b0d2e490ce9bc48f180fc63a363dd5f384cf42ec05cea1e6449b7a2a8ffb26a08d95aa48f1dc180adb70042c7b9b132920d64bd89b6eba3404fe2491b175858688ca0843325128bb5b73bdfd00c43a2727f5c0ba53228e5a14021232f49d6972e6ff9ac813dc780f078dc3fd81f8eba7f3f5b587e9b23f586b8f7e6c72037d3511ffa4386ceaccf4b0076b0a78fca5cf2c449ea8fff9bcdcc43b41869dc87b35029d1903b3a455d80664a0ad3c7d55e5732799bdd3c6663326c80b2e457d12279ab79c273b9d191dab2b181cd648574677ffabe96e095a83833ac0e5fc6a891d54247b2d0cb6261f79ffa41552dcde52a0ef291604ab8d214da43793a9ce2f1053224c2e65223e364a5eb1167e3899d3ba1965f057537ce9d3db0ba9cd6063ad68d4fd16aee15d00672dc55b994d09129020d4098eed1ad71aa6561e4196f63d2522f1876054140d6571020db5ba7850ad5cb26598a74f10571591f1caa6eacff743e6915eaf093be068920b9abb0fa3c83a98531242bbd4d65bca282b79aace8915c7ac45a31575cbbba979669b7a5c94b00238c1d9fb199daebb1186f2fb82a927a632685bcc7b499ef1019a4c434a687700ae753f20f6214cf4b36c57e501d371cf11c8ccbe0bce29f2aa99aabdb42bd7030677417d91c0786f53966a3d228f237dac6be449ce30aa91e6e3a3e7516b094d17f3510dffd87293d7d10b9f6ff41b47c90b512352e53029aec8f11e40a500f870c97561993cf47d7dda6ed11a98734380648ad7765b4a2211c75469da7b6b482f86ffd73ba345bbb71e0be7296a852d87b4c78ee0097beb2e2db4e105b007a5c647a06c7d2bad16ef02bf44293391ed71016d3667101d4fd82f90aa6f8f4a2fec5ff0954dd76a832206b16b8d3972838a2f2a5d8744da8835c33e92db94c4fe531b0fe72a63e05d5aeeec2203269d034489ea85468d5babcbe5b11a138879e20964e6b5e07d6bd1f5af03cf2a3a034f148aed3e2883f53a76ac480fe8f788f9b8d40825298b3c8674be06efdfb3d00f6ff134462d992b82d8503c3969671dcc6d9628c11e0972313faf5ee8f9fe740d00cc59391464791fd04526e102979dd91b9f61945a2af05e6f2bdb28a9084138341dd2931cb4550143c621b5491a445ca189cf1e5ab11c201e8c4061be0ef69844d5bd0f413b576b0e83ec5e8808939b323341f8cc84410f94ec5cd544280c361af875d6a6dbecb39527ac92fe42998234c48e471a322bc71d38934e03347c50deddbd00fc7b9cb62c7f1fd3fbae1d7c026749f1683daaf8d9dcc97bb7fe865c5eb72f0d4c9b75fe1305674cdf5fd9029bfbd90adc5c2f4d6662c08111676f1b30a86e2296591f776cb0aea79764d256515736b214844e2d55f0470688fecf254f6be97de0e524b5fd103863848fc608d139ec5dd3dc544d09cb4bced2910d5024c962a41abd0a83cb8bf2a94160ff22823fed5f6a51592c7c383a28c48466bfa1e85d6d62842daae819d99f44700b47bf758b64539523b8a7bdf354347c97e0c895d39d4f0552f303c27391dcc74c1e9ba5e3ace7b3df3f3c0a235c52a3505c96836694edfcbdffc8860aad7a45207cff805a1f139b496a8df408b73b718629e6cfac049254643d8e61926db97e8cabe7dea4e8a4422743c42856394e80db9530d9f62a0ae428c9269ebdcf3bcfa45c940f13ac38e9a254f0c2498080614d5a03f922301af9ac076d070d30005b975b7b314dbbf9f0dc417e2e1c2be109e86c858ba4ce06ef1c83f0949312ab5ded22305f4303e1d1327f94e9323b8a21830a92cbbf32eb3f881032cae56f475c7316b50b7f4321868ef022df4b2ce344b013ad6f6e15d36f8bdfc8c43813204d8e2f83aa0d76e89f1a9268fef9a943248f6b48e3bbb90d8f17fc08e3e76cbb52390576e156e196c13682a262ab6d9050d44cdaf4df080150c3af7462fb35e3e07c6bfbf827b0cfde4b1d1ba3aea3a5bb7d548ad21376d378ac9d20bfb951d17fce37a3b5de06b5be8472c9ced3506cb006c181a4edf6240bad35d7b086de31d21c0dd872c2b2be5bf3bdb5736401f737f5bf4519e5ba8825ad378c9d6547d329e3722e92304c7236b0b94ff04500748cbc663928323a2796b708b08e0207d9fe85fad3cf8d1d0ba1d7e650ba005b1131aa4bd96f5c9faf57cf45750c36119b63241ef66bc69b9f1a7cee83034bf6d6b667b3bf233e159c30fdfbb0c176d281c5ab017ae42182aa218ce1c01fdac101ff72cd8b7d27ee5c0d4507b2a1527e29092d50a525419f8551dc21c754a2c9fdc8a26dcee985719e9145020ea51bfcde9f73567cb84439596a8d4fd7be9bbfba5aa01e4449658a34ed893326e532f313b1032cda1646770bf731444b2403edce695086cd87432d0c18b198453d60b017b8cea2676541c5a9f33ae93ffb1cd981923eb2913f17a0af6c5bbc33b020de4717b4f54faf38f945c1803b3b955490b96943da41ca96d290d6744f2ae26e0e8ef1389444ee10d68c5eda8b2106c75088a593b6c4c9f99801247afe751e794c1ab58e4e4aed1b958951bcc017ce9cc672d8cd381828abd1853b21e9f580335c526e11e2e4fcdf281678827c29ccfd57dc7a22208d1fa22861b6b57d765332761eef11b31cde8109cf8e8ce9f0f4ecec9fbc03c01c64583ccf1d721eecbcb3fa2660df67794e2ca6f81d9177d159c1ff418ea320c5eade2798e53a56141fc1cbfd387", 0x1000, 0x5f}], 0x10, &(0x7f00000001c0)={[{@dmask={'dmask'}}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}]}) sendmsg$can_bcm(r3, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r4}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 702.584080] binder: 10332:10334 Acquire 1 refcount change on invalid ref 0 ret -22 [ 702.589478] binder: 10340:10345 ioctl c0306201 20000140 returned -22 [ 702.599761] binder: 10332:10334 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 702.618839] binder: 10332:10334 unknown command 0 [ 702.630575] binder: 10332:10334 ioctl c0306201 20000140 returned -22 09:17:27 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x1e, 0x3ff, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x8000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f00000001c0), 0xc, &(0x7f0000000700)={&(0x7f0000002400)=ANY=[@ANYBLOB="4fe3e34a123c"], 0x1}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000008440)=[{{&(0x7f00000002c0)=@rc, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000140)=""/44, 0x2c}, {&(0x7f0000000340)}], 0x2, &(0x7f00000004c0)=""/234, 0xea, 0x3}, 0x2}, {{&(0x7f0000000400)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/89, 0x59}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000000640)=""/122, 0x7a}, {&(0x7f0000001780)=""/206, 0xce}], 0x4, &(0x7f0000001880)=""/50, 0x32, 0x100000000}, 0x9}, {{&(0x7f00000018c0), 0x80, &(0x7f0000001f80)=[{&(0x7f0000001940)=""/119, 0x77}, {&(0x7f00000019c0)=""/39, 0x27}, {&(0x7f0000001a00)=""/251, 0xfb}, {&(0x7f0000001b00)=""/254, 0xfe}, {&(0x7f0000001c00)=""/215, 0xd7}, {&(0x7f0000001d00)=""/156, 0x9c}, {&(0x7f0000001dc0)=""/133, 0x85}, {&(0x7f0000001e80)=""/94, 0x5e}, {&(0x7f0000001f00)=""/60, 0x3c}, {&(0x7f0000001f40)=""/53, 0x35}], 0xa, &(0x7f0000002040)=""/133, 0x85, 0x5}, 0x5}, {{&(0x7f0000002100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f0000002700)=[{&(0x7f0000002180)=""/205, 0xcd}, {&(0x7f0000002280)=""/160, 0xa0}, {&(0x7f0000002340)=""/192, 0xc0}, {&(0x7f0000002440)=""/70, 0x46}, {&(0x7f00000024c0)=""/82, 0x52}, {&(0x7f0000002540)=""/154, 0x9a}, {&(0x7f0000002600)=""/253, 0xfd}], 0x7, &(0x7f0000002780)=""/32, 0x20, 0x1}}, {{&(0x7f0000008680)=@generic, 0x80, &(0x7f0000003c00)=[{&(0x7f0000002840)=""/162, 0xa2}, {&(0x7f0000002900)=""/46, 0x2e}, {&(0x7f0000002940)=""/161, 0xa1}, {&(0x7f0000002a00)=""/248, 0xf8}, {&(0x7f0000002b00)=""/4096, 0x1000}, {&(0x7f0000003b00)=""/159, 0x9f}, {&(0x7f0000003bc0)=""/52, 0x34}], 0x7, 0x0, 0x0, 0x1000}, 0xfffffffffffff000}, {{&(0x7f0000003c80)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000007100)=[{&(0x7f0000003d00)=""/210, 0xd2}, {&(0x7f0000003e00)=""/165, 0xa5}, {&(0x7f0000003ec0)=""/240, 0xf0}, {&(0x7f0000003fc0)=""/253, 0xfd}, {&(0x7f00000040c0)=""/4096, 0x1000}, {&(0x7f00000050c0)=""/4096, 0x1000}, {&(0x7f00000060c0)=""/29, 0x1d}, {&(0x7f0000006100)=""/4096, 0x1000}], 0x8, &(0x7f0000007180)=""/224, 0xe0, 0x5}, 0x1}, {{&(0x7f0000007280)=@ethernet={0x0, @link_local}, 0x80, &(0x7f0000007800)=[{&(0x7f0000007300)=""/76, 0x4c}, {&(0x7f0000007380)=""/37, 0x25}, {&(0x7f00000073c0)=""/233, 0xe9}, {&(0x7f00000074c0)=""/242, 0xf2}, {&(0x7f00000075c0)=""/83, 0x53}, {&(0x7f0000007640)=""/183, 0xb7}, {&(0x7f0000007700)=""/233, 0xe9}], 0x7, &(0x7f0000007880)=""/48, 0x30, 0x101}, 0x9}, {{&(0x7f00000078c0)=@ax25, 0x80, &(0x7f0000007d00)=[{&(0x7f0000007940)=""/100, 0x64}, {&(0x7f00000079c0)=""/118, 0x76}, {&(0x7f0000007a40)=""/1, 0x1}, {&(0x7f0000007a80)=""/237, 0xed}, {&(0x7f0000007b80)=""/40, 0x28}, {&(0x7f0000007bc0)=""/186, 0xba}, {0x0}], 0x7, &(0x7f0000007d80)=""/178, 0xb2, 0x12}, 0x1}, {{&(0x7f0000007e40)=@rc, 0x80, &(0x7f0000008340)=[{&(0x7f0000007ec0)=""/103, 0x67}, {&(0x7f0000007f40)=""/88, 0x58}, {&(0x7f0000007fc0)=""/157, 0x9d}, {&(0x7f0000008080)}, {&(0x7f00000080c0)=""/203, 0xcb}, {&(0x7f00000081c0)=""/94, 0x5e}, {&(0x7f0000008240)=""/218, 0xda}], 0x7, &(0x7f00000083c0)=""/101, 0x65, 0xc7}, 0x146}], 0x9, 0x40012103, 0x0) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x410402, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbbf4, 0x2800000000000000}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x22, 0x1, 0x0, 0x1fffff, {0x4}, [@nested={0x8, 0x11, [@generic="e2"]}]}, 0x1c}}, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000380)='fou\x00') sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000d65000)={&(0x7f0000de2ff4), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000030000000000000000975d0d3122c6a5b05a42000000cd321bcb21bfa769936eb8b37a0cc9216ed15af5d500000000bf68df327a955ef7873e53de973c8e9f9f23925dd8b247753c8fe89cd5a03513142ee05abc6dd4a914c69a5f979a7973e65117a2ec9b0c45a82fa860f9d30ccae7f73db2c0137625d86fe59b0172b838da531a05a8ab2420882690ede142ca3c143916d8f31a33ba8bf45d8a0c1b31504d53992598"], 0xa7}}, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000007c80)=0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r2, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:27 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x7a00000000000000}], 0x0, 0x0, 0x0}) [ 702.646446] binder: 10340:10355 Acquire 1 refcount change on invalid ref 18432 ret -22 [ 702.710244] binder: BINDER_SET_CONTEXT_MGR already set [ 702.739224] binder: 10340:10355 unknown command 0 [ 702.750425] binder: 10353:10360 ioctl 40046207 0 returned -16 [ 702.754750] binder: 10340:10355 ioctl c0306201 20000140 returned -22 [ 702.766019] binder: 10366:10370 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x2}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 702.785734] binder: 10366:10370 unknown command 0 [ 702.799347] ntfs: (device loop0): parse_options(): Unrecognized mount option fscontext. [ 702.812094] binder: 10366:10370 ioctl c0306201 20000140 returned -22 09:17:27 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/qat_adf_ctl\x00', 0x20080, 0x0) connect$l2tp(r1, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x1, 0x3, 0x4, 0x1, {0xa, 0x4e21, 0x6, @mcast1, 0x7}}}, 0x32) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:27 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x5, 0x0}) [ 702.848875] ntfs: (device loop0): parse_options(): Unrecognized mount option . [ 702.933771] binder: 10382:10384 unknown command 0 09:17:27 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xb63000000000000}], 0x0, 0x0, 0x0}) [ 702.963192] binder: 10382:10384 ioctl c0306201 20000140 returned -22 [ 702.994332] binder: BINDER_SET_CONTEXT_MGR already set 09:17:27 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'v\x00\x94n0\x00\x00\x00\xe1t\x00\x80\x00\x00\x04\x00', 0x0}) getresuid(&(0x7f00000001c0)=0x0, &(0x7f0000000200), &(0x7f0000000240)) ioctl$KVM_GET_SREGS(r1, 0x8138ae83, &(0x7f00000004c0)) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@ipv4={[], [], @local}, @in6=@mcast1, 0x4e22, 0x0, 0x4e23, 0x8, 0x2, 0x80, 0xa0, 0xde, r2, r3}, {0x8, 0xffff, 0x3, 0x6, 0x7, 0x1, 0x0, 0x8}, {0x3613, 0x7, 0x0, 0xffffffff}, 0x101, 0x6e6bb9, 0x0, 0x1, 0x1, 0x3}, {{@in6=@local, 0x4d2, 0xff}, 0x2, @in6, 0x3504, 0x1, 0x3, 0x7, 0x9, 0x8, 0x6}}, 0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) fcntl$getflags(r1, 0x408) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r4}, 0x1, &(0x7f0000008d00)={&(0x7f0000000080)=ANY=[@ANYBLOB="0100000200000000c84bcb7c353a69416b0000005cbd0000000040009b0b71085a26", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00368f33806782e1433ced000000010000e02f0000000022"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r4}, 0x10, &(0x7f0000002ff0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100009e5d9c2d36fcc746bf4221373d4b100000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x4, 0x600c41) 09:17:27 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x94, 0x0, 0x9}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000140)={r2, 0x1}, 0x8) [ 703.026839] binder: 10382:10393 unknown command 0 [ 703.032749] binder: 10389:10392 ioctl 40046207 0 returned -16 [ 703.041022] binder: 10382:10393 ioctl c0306201 20000140 returned -22 09:17:27 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x400000000000000, 0x0}) 09:17:27 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @mcast2, 0x9}, 0xfffffffffffffeaa) [ 703.148060] binder: 10395:10403 unknown command 0 [ 703.156952] binder: 10395:10403 ioctl c0306201 20000140 returned -22 09:17:27 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x40046304}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:28 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x100000000000000, 0x0}) [ 703.318716] binder: 10412:10413 unknown command 0 [ 703.319737] binder: BINDER_SET_CONTEXT_MGR already set [ 703.345203] binder: 10409:10417 ioctl 40046207 0 returned -16 [ 703.355066] binder: 10412:10413 ioctl c0306201 20000140 returned -22 [ 703.411705] binder: 10412:10423 unknown command 0 [ 703.416604] binder: 10412:10423 ioctl c0306201 20000140 returned -22 09:17:28 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0xf20e, 0x101000) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000200)={0x6}) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8001, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[], 0xffdc) read(r0, &(0x7f0000000140)=""/165, 0x1000000eb) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000004bc0)=[{&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev}, 0x1c, &(0x7f00000008c0)=[{&(0x7f00000004c0)="fb077768b2a7175b5e0cd57936eb8d7a76dec0f00afe7531", 0x18}], 0x1, &(0x7f0000000ac0)}], 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)="dddfb13163a47dac4bb7ae18bdb544cb41bfefe621b179ecbbd8d05b0769d0d13bf9d883bb792a6348d380b17c0e3f379a62ac4457ad55051a", 0x39, 0xfffffffffffffff9) sendmsg$nl_route(r2, &(0x7f0000000540)={&(0x7f0000000400), 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=@ipv4_newrule={0x30, 0x20, 0x1, 0x0, 0x0, {0x9, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x4}, [@FRA_DST={0x8, 0x1, @local}, @FRA_SRC={0x8, 0x2, @remote}]}, 0x30}}, 0x0) 09:17:28 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000001600b2cdc2b64a289991b3e7aad10382b37525e25de963b67fc4b566dcd9578209a9d6cbad790483869f8606ce72e45ebd415f8fd96006a0f00fe1d1e0d79ac263cf9352b220fbb709bb3a415389c5c5cb6a21d0923e1a9480b40e954d3c76534b3eb67a47fc52"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x1, 0x2) clock_gettime(0xfffffffffffffffd, &(0x7f0000000200)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f0000000240)={0x80, @time={r3, r4+10000000}, 0x9, {0x101, 0x8}, 0x9, 0x2, 0x9}) accept$inet(r2, 0x0, &(0x7f0000000300)) 09:17:28 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x700000000000000}], 0x0, 0x0, 0x0}) 09:17:28 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f00000001c0)=0x6, 0x4) setxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:policy_config_t:s0\x00', 0x25, 0x3) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 703.473897] binder: BINDER_SET_CONTEXT_MGR already set [ 703.500324] binder: 10426:10428 ioctl 40046207 0 returned -16 09:17:28 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x400c630f}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:28 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x7a000000}], 0x0, 0x0, 0x0}) [ 703.521394] binder: 10431:10435 unknown command 0 [ 703.536831] binder: 10431:10435 ioctl c0306201 20000140 returned -22 09:17:28 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) r2 = syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x200, 0x100) ioctl$TIOCGSOFTCAR(r2, 0x5419, &(0x7f00000002c0)) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000280)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r3, 0x114, 0x7, &(0x7f0000000180)={@un=@file={0x1, './file0\x00'}, {&(0x7f0000000100)=""/119, 0x77}}, 0xa0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:28 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x7400000000000000, 0x0}) [ 703.595133] netlink: 4 bytes leftover after parsing attributes in process `syz-executor2'. 09:17:28 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) getsockname(r0, &(0x7f0000000100), &(0x7f0000000180)=0x80) [ 703.654704] binder: 10442:10443 unknown command 0 [ 703.669829] binder: 10445:10448 unknown command 0 [ 703.692918] binder: 10442:10443 ioctl c0306201 20000140 returned -22 09:17:28 executing program 2: mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x62}) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000180)=0x3) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0xa, r2, 0x2, 0x8}) read(0xffffffffffffffff, &(0x7f0000001240)=""/176, 0xffffffffffffff04) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x2, 0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x3f, 0x0, {"6d3a03a22ad13804238c25806cdd75ac"}}}}, 0xa0) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000200)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000300)='./file0/file0\x00', &(0x7f00000003c0)='./file0/file0\x00') ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(0xffffffffffffffff, 0xc04c5349, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, &(0x7f0000000b40)) chdir(&(0x7f00000002c0)='./file0/file0/file0\x00') ioctl$sock_inet_SIOCGIFNETMASK(r3, 0x891b, 0x0) chmod(0x0, 0x20) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000580)={0x0, 0x0, 0x30}, 0x0) write$P9_RSTAT(r1, &(0x7f0000000440)=ANY=[@ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="4f0326b9c9f6a74e0f61aee38b286817b62b3516f28d9130c84cc84f9277f3d5c3bc02f4b7a607ac2a094d8056977587ae2a309344f45248fef09adaabf37d536e936332fb4bb23811b509eda58eb46dd8a684de06289894f989d32936302ae94f6fc162a9b74fcadb7796a650a528cb4d6fa49e8cca2e6f64ba0ba387110534e43a9675b849780401ed", @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYPTR64, @ANYPTR64, @ANYPTR64, @ANYPTR, @ANYPTR64, @ANYRES16=r0, @ANYRES16=r0], @ANYRESHEX=r0], @ANYRESOCT=r3, @ANYRESOCT=0x0, @ANYRES16=r2], 0x38) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, &(0x7f00000005c0)) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) write$FUSE_GETXATTR(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000880)={0x9, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, {0x2, 0x4e20, @loopback}, {}, 0x100, 0x92, 0x4, 0x1, 0xfffffffffffffffa, 0x0, 0x7, 0xfffffffffffffffc, 0x7}) [ 703.709224] binder: BINDER_SET_CONTEXT_MGR already set [ 703.710297] binder: 10445:10448 ioctl c0306201 20000140 returned -22 [ 703.733424] binder: 10442:10457 unknown command 0 [ 703.738429] binder: 10442:10457 ioctl c0306201 20000140 returned -22 [ 703.746946] binder: 10447:10453 ioctl 40046207 0 returned -16 09:17:28 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xa00}], 0x0, 0x0, 0x0}) 09:17:28 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:28 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6000000, 0x0}) 09:17:28 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) getpeername$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000100)=0x1c) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1e, &(0x7f0000000040)=0xdf8, 0x4) ioctl$sock_netdev_private(r0, 0x89f9, &(0x7f0000000140)="054803391908d2cae2beaeef1884cf2914205443f23e4822647553f1504bfd7666d51ff1dd0c0f8ab6180f2bba106a4a9a8335e695a0e522e01d00c270d7fa0a7ffcbb9521a40aab7561cd9a902ae9ab0a73a320aea91d7745e9c22ac38931c0fa347972f2732951cf7c1f047bf1d09739a5cb39aeb9dcbfd293588e067e63c1f759615b97032baf391238976b75cb2a76d55672d1dfe47f0d891f1589b26bedfa0343a392dfe1026073e793ddd5a28a5ef3ab19d57408bd6c81870989cb52a6cdbacb0a75e82663a21eff9585332240b12eba55d7ed20862b253adbbbd156b4467da7d22bad538e") bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:28 executing program 2: mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x62}) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000180)=0x3) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0xa, r2, 0x2, 0x8}) read(0xffffffffffffffff, &(0x7f0000001240)=""/176, 0xffffffffffffff04) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x2, 0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x3f, 0x0, {"6d3a03a22ad13804238c25806cdd75ac"}}}}, 0xa0) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000200)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000300)='./file0/file0\x00', &(0x7f00000003c0)='./file0/file0\x00') ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(0xffffffffffffffff, 0xc04c5349, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, &(0x7f0000000b40)) chdir(&(0x7f00000002c0)='./file0/file0/file0\x00') ioctl$sock_inet_SIOCGIFNETMASK(r3, 0x891b, 0x0) chmod(0x0, 0x20) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000580)={0x0, 0x0, 0x30}, 0x0) write$P9_RSTAT(r1, &(0x7f0000000440)=ANY=[@ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="4f0326b9c9f6a74e0f61aee38b286817b62b3516f28d9130c84cc84f9277f3d5c3bc02f4b7a607ac2a094d8056977587ae2a309344f45248fef09adaabf37d536e936332fb4bb23811b509eda58eb46dd8a684de06289894f989d32936302ae94f6fc162a9b74fcadb7796a650a528cb4d6fa49e8cca2e6f64ba0ba387110534e43a9675b849780401ed", @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYPTR64, @ANYPTR64, @ANYPTR64, @ANYPTR, @ANYPTR64, @ANYRES16=r0, @ANYRES16=r0], @ANYRESHEX=r0], @ANYRESOCT=r3, @ANYRESOCT=0x0, @ANYRES16=r2], 0x38) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, &(0x7f00000005c0)) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) write$FUSE_GETXATTR(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000880)={0x9, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, {0x2, 0x4e20, @loopback}, {}, 0x100, 0x92, 0x4, 0x1, 0xfffffffffffffffa, 0x0, 0x7, 0xfffffffffffffffc, 0x7}) 09:17:28 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x40486311}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 703.923595] binder: 10466:10472 unknown command 0 [ 703.964258] binder: 10466:10472 ioctl c0306201 20000140 returned -22 [ 703.971455] binder: BINDER_SET_CONTEXT_MGR already set [ 703.980699] binder: 10467:10481 ioctl 40046207 0 returned -16 [ 704.003371] binder: 10478:10484 unknown command 0 09:17:28 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x60}], 0x0, 0x0, 0x0}) [ 704.008427] binder: 10478:10484 ioctl c0306201 20000140 returned -22 09:17:28 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000000100)=ANY=[@ANYRES32=r1, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000be0fe60605d2987a04f459b7d9c0975800010000000000000000000000f2cdc2b64a28996800a6b15f2d10bb7639fc6a6ba8071adb5aeff707a870584e08e4307d1e51e071882c4a7e7e19192c348f63e2044145699ef4caee70a67dcb41a44cf2ec6769ae8136cc106ef31317944009a8de92f99b19c001f1b7bb59e36cee15906074f5befca45f5169cf8ce3f1b37f4e91f5c7103a1857a592337a6299889077a7af64b231410af4dd182d3a315479657d9f6127cd3b8211fb3208"], 0x6}, 0x1, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 704.049790] binder: 10478:10491 unknown command 0 09:17:28 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6c, 0x0}) [ 704.076719] binder: 10478:10491 ioctl c0306201 20000140 returned -22 09:17:28 executing program 2: mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x62}) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000180)=0x3) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0xa, r2, 0x2, 0x8}) read(0xffffffffffffffff, &(0x7f0000001240)=""/176, 0xffffffffffffff04) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x2, 0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x3f, 0x0, {"6d3a03a22ad13804238c25806cdd75ac"}}}}, 0xa0) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000200)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000300)='./file0/file0\x00', &(0x7f00000003c0)='./file0/file0\x00') ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(0xffffffffffffffff, 0xc04c5349, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, &(0x7f0000000b40)) chdir(&(0x7f00000002c0)='./file0/file0/file0\x00') ioctl$sock_inet_SIOCGIFNETMASK(r3, 0x891b, 0x0) chmod(0x0, 0x20) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000580)={0x0, 0x0, 0x30}, 0x0) write$P9_RSTAT(r1, &(0x7f0000000440)=ANY=[@ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="4f0326b9c9f6a74e0f61aee38b286817b62b3516f28d9130c84cc84f9277f3d5c3bc02f4b7a607ac2a094d8056977587ae2a309344f45248fef09adaabf37d536e936332fb4bb23811b509eda58eb46dd8a684de06289894f989d32936302ae94f6fc162a9b74fcadb7796a650a528cb4d6fa49e8cca2e6f64ba0ba387110534e43a9675b849780401ed", @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYPTR64, @ANYPTR64, @ANYPTR64, @ANYPTR, @ANYPTR64, @ANYRES16=r0, @ANYRES16=r0], @ANYRESHEX=r0], @ANYRESOCT=r3, @ANYRESOCT=0x0, @ANYRES16=r2], 0x38) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, &(0x7f00000005c0)) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) write$FUSE_GETXATTR(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000880)={0x9, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, {0x2, 0x4e20, @loopback}, {}, 0x100, 0x92, 0x4, 0x1, 0xfffffffffffffffa, 0x0, 0x7, 0xfffffffffffffffc, 0x7}) [ 704.149172] binder: 10494:10500 unknown command 0 09:17:28 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x40106309}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:28 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000000)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 704.176971] binder: 10494:10500 ioctl c0306201 20000140 returned -22 09:17:28 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x40106309}], 0x0, 0x0, 0x0}) 09:17:29 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) bind(r0, &(0x7f0000000100)=@tipc=@nameseq={0x1e, 0x1, 0x3, {0x0, 0x1, 0x2}}, 0x80) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}, 0x1, 0x0, 0x0, 0x4000000000000}, 0x20000000) [ 704.221297] binder: BINDER_SET_CONTEXT_MGR already set [ 704.238950] binder: 10501:10511 ioctl 40046207 0 returned -16 [ 704.275198] binder: 10512:10514 unknown command 0 09:17:29 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x7a00000000000000, 0x0}) 09:17:29 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0x1000000000df8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 704.310158] binder: 10512:10514 ioctl c0306201 20000140 returned -22 [ 704.334435] binder: 10512:10522 unknown command 0 [ 704.343917] binder: 10512:10522 ioctl c0306201 20000140 returned -22 [ 704.395833] binder: 10519:10520 unknown command 0 09:17:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xffffff7f00000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 704.426935] binder: 10519:10520 ioctl c0306201 20000140 returned -22 09:17:29 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000102000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:29 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) ioctl(r0, 0x0, &(0x7f0000000100)="22cd2922b1658fcf4b7fc38c9a2f25c084c461decb16246fb1b30ab1e1150c395f91260e8d9f565e77e097be6d21909053eafa1ff14afc281b18ddea0ba36f2e09c49d73aac26814a92cfc9b8d6eeb45379d0a245fdc9af65e1b0acb3c6f3c898060e2d0f562b3a460b2b53455b6a9bd1c8a44c95addec5cbf3ee58abaa160e3f38300267c5ce9678903ac6d049f88cdc1798411950dd22a89cf20606867863b9ae4f55f8a17530649417bf129e79ea2d00d85907959a874c4f179b8e04cfc2be049e71e4bf7387ec4c140fe18a1e258e9491c599cdd11482c703db3d3a6b7498d33f89ebb0ba81eb4f018b09dabd4982c311e577fe59f03c9faa526b6ac9caef4d2e6d937b28370739f290a970c6b391d6be1a8963afd632a45c837d7d508bb4cc60f33b6ed61e96d776e36252bfcc34615e1b01d0a3792d6c02be831231ee2f43bef43232b6305fae6fb9b99fbbcf4fd32d9bdc7eeb4a75ccb9172ee7ebf3742ad04e04451b9a705e9d122da682a4cf4cbfa6605dbf754898292d234182680b726094184effe90676bb4465755328bcc9f8e74ca9d0b93840148952f2f6312fe8273b88a07ff4653db9e9c7f6de2770c311e9b2bc3c50ce209140e49b8ee1d069104def2d4f1ab9f732b8cf078b872f60ac0bd75bdc9176343ceca1e2e2a94c3d7431f9c3f70f1292fd0b19b67848ceb1792eb4ad4e11d26725d9938a7359febd3fed923895b882a2c9cc4264b31d0d0348314948d897191f9ca4f4572c83d90d2b15e506966aab6b978124d869ad5f24fc84128ce7dd180d57cb6c1bbf9e5c70370683c30bae7a790a4b6a9e21df3b4ac35fc86822699ad6e2b725488fddec127558a2256bd00271f582ba2133f43fca38cd0f768c06b5a0f9bb338e6a18ade1ad988055b396f34204100f4c5a87a6bb246fb8c81171aa94456bfe9c7833b4f6912393633b1b4bf819cd6041b749bb009a7d29525fd5e615ea6db0cbbf663d8ef0113fdde6825be983d69c5f2750aa74b5a5fbbdf31b1ea84fee52e505babf6f6313c1a5e24521a10b1d26aa6fbeb0d47e8d82d6f69f9c14a8f391821a31e71e1761c029dda2b5fa2638681d74a05ad70647733cbfe1f79a3e57d1023761219b853cf0ccc0b4e32d1f8e2f027cbb287ac2b4e3c61b1921af36c4cb804cf2708eaee834dd1ed31c198861a6295542616e55bef4ddc3484e24cb65a62459011c59a866dae0af39938d779c37fc0c11b4aa3d0ecc41fb9e846ef562f00aace8b090bd742bd58522ee2c945c0de34a9e89fbfcaf6923ced102f6008732312a89db65bf56926ef861200a5dfefbba6bb816e2827d927ebda0d8050f38a54c352b649b4e9eb234fcc0347338180433708ea2ed25507eef533f1a8516a7281ec732d31b08ddf4fba70981c9ecb563b60db284a856bfbd925f2a95363a5e101cdb9f96e800073e02cb5bdd460e70fa6fb99af50907ca1e0c8a9bd3473b1ad3e6ff45197b24e564b25779d93a430d5f5c9956d1dda76c98dd5e36f92019c16101bbc8e8acaccc88eac52dbc2eba508b33c91bb3e9bd638582eee14a31e31bfc298353ffa14bf7e79a9645eb17e11dda69415614649ae1afa387c84930327bf3647fe52edfc0120552bca70a2bf02a4b69b7fc1dbd24cff113a29d2045f80077bd81a70eb0f2707264d2495a0d316b25541055c4aeb577cec4d8934812c173477b8857ca8c3b34a30e5ec012dd87b969d94074e5ad584e153e4ba2712e2e6ba67e5c2e604075b5b6328646812ea525f382a66dedf77ab196066d419dc725eb51dbe9b2b925dbea12e8ad9b12aef39aafc7669690315529598dd8b171c7b3bf3ca9d5e719f52a37a8049ed685572dd76a0b47a9b9cf2110a357cd66121928a5e2651748c644e169028b227fe7f43d406bd0b07c9d672a3f937f8a614255224be29565a039cb5b8d9d6335a4eb607a5b2960c9de2af5e8cf34a77c8dd0296fb22001da62f199a19bae60687af568be618e601fa85fe184a3e8107bde5630f0bbaa986c288acc95699d1fe6beb6a8a7ae29dd0ff305647ff75e35bd106e2572d79f8e553cbf7d0580686e0e7c20bfaef96f439d3cf1f79af7869e9ce32f184087c406c20115932174139a6139df058a2c5ee11ce62a6cffded98513893c81b5d7671e0c81c39d4e1d209e679d5bfbc62195bd83f0954b936e58d099859011e798e6d4e2cb21dec0076e565e0d34a9dfc7f2bd3888d44f559926fb43a95bac0e45e6213e1ab4c29d160c4a515f3ffede8c5be0279bf11cf49f0b51a5b7b612524d5d47605754ad7e58326edb67a740c61cab9c206aa93195799a180f18ec167b4e4228a5d3594feb5d718c1145c82326cf1eb968ac4099063a690ca7519b0f3a2f733a290844fcbe0d9ebd4e280d00917bff63a4101248302aec8bf130f0a9c493c7ad20ff94516c6781e47b98285f334d30e0e479914a5eb533f03647ac633b925def28bc0cc219905a3345970f1f328be18c02dfbe3a632297b637817fd705f1e9e0981ba72ced6243bbce6d967dfceb3b7773c12089050ce1f931afa01d6f0d9d2e055e8cd080367cb790ac5327db41722759c8787a1cd545aa08df3b531586365edba8d949f50bdbad41c4d800c1f1c89c9f1c022f84331c799bff1655ea205845a2d0c1cd070787b8fcb866b9acf214c3ddf088a9c6d7e61b104d2f5af002c681834a5fc3793d8e28ee846019ede55989c26fa27a509ea54ef2336ee0d9192425f23ee1220208c59b8c8f55d84fa60023b6c66f6f3c418d191e908d2f4c74016513edeb6dc5cd8e2220dca17af4edf4918b5bf57d10910efe725bc19811535f0b53e60342e60d259c6b2bb06ac4ba027d8788ad9165f1b0c6119bd80fcaed144da49dac539400327e74ee3a17753fcee9d39d8017144ba7f0dc3c9309458c6990a4233e36197d7ae065526f5f16de412a5b074627c806d5099acfc4a3afaf5834386f6b99fe307fa6e3d7d4b58f74774334f615d928de90ef368e568dd8291fd51e62b9504cb4d17406e7eadc777fddec46482c553b6fe8213e9cda5e4283d6f78f0fdf58b1352e441844f70f22f2b00f0a5789a56c9038c1d24a307e5fd406879477324f806cd9069e22323d7d24f94bc1f34bd5c10d6a6b533291a825aced608b0b63ddc76eb06880b5d1434bf81031cfcd1f80d76fd58d3b1cf31cc93716aa74e49be0ca922d20444a8ee857201cc7a7947f098d5f09ccedf63aea9a37f43b75dc855baf04bf0efe1e9c697bca50c86db6d5dc7e808c23bf7597febb4cecefe967feec8ea6302399048bc656867d4e0a457d9ceb4d6da13811c59ae164bd79e667c96fb8123a1aa0a9df073f912b6b13e699debc85f6a73853beeaa779550f6edc12f33b6c8a5f5cccfc436913a083963eebce5d3ebe0323b6f559da149dd33ad318ac9ba81788dd91b4b5afc4bb20cff779ec3e06ef271343a81c8559419ba7e3a17eb1384d7a96aa4b0260286095a396a6c6829cd67505b4881c5dc57aac2c83b052ed58b65723c9ec4eaa3a70cb6113b53ab5bd79c0b5a010d1560279938c2f9098be5588b4119b26e10212c0d91a175efc7f7fe11f63b33b58017b561ef698b6811242ea865c33de8a809a6baaf1d54bb1ad3c2dcd9f7b4dd8ed8d2f74a659249b9a0ca2bd0050e09cecafde783beee51f8d8da4b27f5a9cad29b581c1240d8863aa10d9d8dce88c8a44f3e244f293f93f6168e84ba688a9a9e443eedff8b03a3ddeef046b95627b342a7663289cfef3374ee36d569befd641dfc2a444b6d474f53bd81f136583060c382b4ef8ea80fae0a360b1b24892356464f7f8f3803b81782cbdbdc30ef8093780fcac8681bdbcca5d42278408ed28233b8ffd7ef85cf6f37b5410ed5cf0810f8c3bb1b0e448e8fbb2c579f4e3fe183ed27121ffcb306c766fd4019215acbf43c4060183fb15c50d38f7275b0e521986b5189a55504c66df5958867f4195f0a88cfac72802426e779e7cbe4dc8edebf4377e0ae6a665b313206d94ae8360ce89d0fdceef31c5d9fbfb6f99ddd9f37da9d3f35a435cd7cfbfa1babde8fd0e42e3cd467d3965a31715b2b3ddc7cf07d316b2392f582177ffa8341067d66a42f22564351c4c96ce9cb8be6b02b3e12d51267117564c908beb71dd7f06f65b27b62cc84d10ae8a34715042a97957352b2de770e5952550a3e0a302ed8b625c179964f590630cea2a0a4dfe1364e616bde2b0a0d5fc1b52a4b0f836d7a18440f5209136dc1393bde42b442229573494524a6b142a1eec83fcf574a3ca5e4786a8b3b7f39da1f1f7452caa7d5f0b24e5bdb9349d15a1a967ac8486457671bdf5595489bf25ae3dfc0702e97c3fcd8c23c9a25e7df796e3bbc2955bd044d3d207a53c862ea8496bfa6b9078d432148c4a914b0ed25e98518423ab7900e47fbc94dc646aabd43f3f82da11ac2856446f235573c21c243958ad4a2a0b9d9253a11de4213d6d399cd451de0741a82bdfb283b9b295bb6a26b551181304c1ca4dd65f8f922b859b690f72217650f7c4efd25a1e44bc12981b612c72564fb1a562eb533a97b959d3421beb3931fb05b18db8d4605bcd1457d92d028efa4891f20d27040e990a55dbffdb943e3d741746f063eb20ca7822e9572c414cccb79a6e72965312f97d8edd98e5657c96d9cc0d18bffc81222d88bd59582b120a1cfef54a31499c23671466e1c87cfa7a9b2d7c8009ac94a69ae2fa7e3d8d1d2a8cb4c93e8a2fb88b3c94be48214a49b7c01fe40ef750a804ac66d2004cd24c43f70de8062a9dde9c50d3ef878f78df220d8287998846ea3cb0c18b3d97b6021bb7acc0e34f364b57b63093b2a606eb0317e791c9c1ac048a86f07059fa690061681021fcdd7172fb887fb755964f2ef216727b9e3120a2ec79fb454d23cd6b1e7493eb92265f8373f7d3285acf4ee4416e12c867ac0abb6c1fa8f2175283b19374ed2b25c2c520f71a59dd06443fc66027a9b863248d50af24e5c7b96ed29a99653a440f4d7489bb0ee9832c00959871e7d581df683b88639d5e21d08660c7d8ae732102a912f96b4c27c6bb6cbd1138c80fafa6103d54fed8181cadb969f14b7fcbbeb36c1d40529ab6372ca794b1a17cd72fed58991c4c78221962127f81c06073d7e79ca942af59d9015f5f48072201b042851bcc474638e55a24fdf136d47b520c46bf3684e633b3ab077d654225e559fb3edad619f72a5b8c640779d8e2b8447db0721b080ee6276940f428b35f05aa24be476ecc81cdd70808d9b9faa7f2faf228231d950d985e2a74dffddf1746dad84ab57bc355801c0c80f80978ffeef0766985803be8c94945c669308b034b90ccddb97c87c6a2848082675c42db31e1e79eb2a41f8c24c05ed72b9058eb913a2a26695bc935cda6f4f44872fbe8339d486d32a2c341cd70a04dcbbf92b2ee6000e9e7097ec68fa400f3cdebb769caba0cc6ba2ec66f54b407e831f7a77562b6cc129e8ce7b885741d536de451794bdb59b6407b9289cb55cafec79f066b8c7d9c87d41dcb60381722697a61521410f6fa73ceb7ffae6a9fd72291f86bd1f1f7e205e353ed2fc92e31e8848a8fceeabe98856e9361569be8a3adbe4131a9029c4375011a2fb475c837a623307cba5ceda04f4c15fb2d65ad5e8781b8ebf82a8a947a7f1d4a45df138bc22ad21986b407ce178100d3899623dea287d31c80e770ca48058a1ac2d94993403f6991e3137d9d9a5f2c68003659da16c1964e695dad8028cf559099776a00000000000") [ 704.468930] binder_thread_write: 30 callbacks suppressed [ 704.468941] binder: 10530:10531 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:29 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x163404000000000}], 0x0, 0x0, 0x0}) [ 704.509912] binder: 10537:10538 unknown command 0 [ 704.531318] binder: 10537:10538 ioctl c0306201 20000140 returned -22 [ 704.556923] binder: BINDER_SET_CONTEXT_MGR already set [ 704.574297] binder: 10530:10543 ioctl 40046207 0 returned -16 [ 704.578094] binder: 10537:10549 unknown command 0 [ 704.588013] binder: 10537:10549 ioctl c0306201 20000140 returned -22 [ 704.589362] binder: 10530:10531 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 704.609946] binder: 10547:10548 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x7630440}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 704.638569] binder: 10547:10548 unknown command 0 [ 704.658841] binder: 10547:10548 ioctl c0306201 20000140 returned -22 [ 704.725581] binder: 10554:10555 unknown command 0 [ 704.736650] binder: 10554:10555 ioctl c0306201 20000140 returned -22 [ 704.791122] binder: 10554:10558 unknown command 0 [ 704.796307] binder: 10554:10558 ioctl c0306201 20000140 returned -22 09:17:29 executing program 2: mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x62}) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000180)=0x3) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0xa, r2, 0x2, 0x8}) read(0xffffffffffffffff, &(0x7f0000001240)=""/176, 0xffffffffffffff04) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x2, 0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x3f, 0x0, {"6d3a03a22ad13804238c25806cdd75ac"}}}}, 0xa0) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000200)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000300)='./file0/file0\x00', &(0x7f00000003c0)='./file0/file0\x00') ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(0xffffffffffffffff, 0xc04c5349, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, &(0x7f0000000b40)) chdir(&(0x7f00000002c0)='./file0/file0/file0\x00') ioctl$sock_inet_SIOCGIFNETMASK(r3, 0x891b, 0x0) chmod(0x0, 0x20) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000580)={0x0, 0x0, 0x30}, 0x0) write$P9_RSTAT(r1, &(0x7f0000000440)=ANY=[@ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="4f0326b9c9f6a74e0f61aee38b286817b62b3516f28d9130c84cc84f9277f3d5c3bc02f4b7a607ac2a094d8056977587ae2a309344f45248fef09adaabf37d536e936332fb4bb23811b509eda58eb46dd8a684de06289894f989d32936302ae94f6fc162a9b74fcadb7796a650a528cb4d6fa49e8cca2e6f64ba0ba387110534e43a9675b849780401ed", @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYPTR64, @ANYPTR64, @ANYPTR64, @ANYPTR, @ANYPTR64, @ANYRES16=r0, @ANYRES16=r0], @ANYRESHEX=r0], @ANYRESOCT=r3, @ANYRESOCT=0x0, @ANYRES16=r2], 0x38) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, &(0x7f00000005c0)) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) write$FUSE_GETXATTR(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000880)={0x9, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, {0x2, 0x4e20, @loopback}, {}, 0x100, 0x92, 0x4, 0x1, 0xfffffffffffffffa, 0x0, 0x7, 0xfffffffffffffffc, 0x7}) 09:17:29 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) r1 = shmget$private(0x0, 0x3000, 0x54000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$SHM_LOCK(r1, 0xb) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="0ef5a9a0000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:29 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xc630000}], 0x0, 0x0, 0x0}) 09:17:29 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0xfdfdffff, 0x0}) 09:17:29 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) r2 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_G_CROP(r2, 0xc014563b, &(0x7f0000000140)={0x0, {0x3, 0x101, 0x2b4, 0x1a}}) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x3, 0x80402) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) socket$bt_hidp(0x1f, 0x3, 0x6) 09:17:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x4c00}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 704.931521] binder_thread_write: 6 callbacks suppressed [ 704.931536] binder: 10561:10563 BC_CLEAR_DEATH_NOTIFICATION invalid ref 207814656 [ 704.933444] binder: 10565:10570 unknown command 0 [ 704.959313] binder: 10561:10563 unknown command 0 [ 704.964686] binder: 10561:10563 ioctl c0306201 20000140 returned -22 [ 704.971965] binder: 10560:10574 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:29 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x3, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[], 0x48}}, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x800, 0x0) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000100)={0x9, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20011000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x148, r3, 0x300, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffffffffb51f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x956}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x283f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0xf8, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x641}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x52}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x800}, 0x8010) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:29 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f00000002c0)={0x0, 0x4}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000340)={r2, 0x1000, "99d771786fe2a627e6aaf62cc0b835c2412cfd25c88c89d575a36c153b103f37e098a2af9277d07fee0af4698fd9b07fdd51297e62c60c5c4d555214c531d9900fa329a9778f2c8a78d482bd4f92bbe35d74e62b3d0cc3e41544fd5a346546328e7a1eeed7073ade5a857c781cc49425fdd0576f9ddbc2ca34a61658a84a3d6d81c3085f1334c80aeb86cf74f4036deb31da0df01a1765f8dc0fb11dfe56386f2bb93f3990703b82246c9dd2f55505df58d970ce890e4eea9e6a72afd64c50aaca0883ae200f2424624ef97674f199408bb98f2907acdf564d43087473977830b7bde5f7f883408a69259d349db0aec3bfbf353b8cddecf77e7efc0ec6ca1049b2f43a4024523abae1fb95257fde9b3f180bfe091f8404e836555233173fb21b6c3e9e26454f49a9f5f4c4cb4a79e33ccac3b72bf83b73bf2bd7924a53c5ef1a3d678c046375e19c86128ca325672d20ed921e8cdd7e5ad15853d9767faf44913e335d5f47cccb468cbf8ca44c080aa424c736409bf8a0a51fd666f4882afc2d883abb80eccea3d041414a97b14af76a021bf80b56ad53fa41c4607467ba847051cf7c7a097ffdfad3b4123d13575fd0e6cc916882fb5d1379f031a531c251166eb8f5b4025553ed9a5ebab92eb7397f56c388afc6f6419e25fbab3567f5fa2b45565ee1614d6ad08e7f161cb520762c827e9450a5c2950b85d58637a6202e18e349c115cbf34282e3592a1c2a54bd0ec8855a4f391bcd88a6b9ffefd1576f14bf0634f072d926a6244027fd4552ac2f83e017a7f0798d038400a9a6fe86e1619dcf714eff5bfb3d20d596a43200c387a49212eed8658f036a2e508e8862fec6f85e0b8d6e83a5407c4f7f992fb57186bd3b5925ebd0a241e9f8d4c7b58c40ea3cc677c9b86c788eb01440f6ce39aad97fb1b91d46f92bf02694550fc98adb060d2bc46f9a8237cccfc382b006229de2e537fbba86cd63133fd00f46a35a89ee4a04ba686fbcdab898f6694e6ac6e74ee7c527938fc41f8894b0b663046b25bb435e229ce38f002c25f46f9f38d4e02c05534778f8c74647e0409d1473ed90a1e6c1b725c1e144b97823a87b8cac0087f154184a241adde0ec550901687bff88164b347a5f5d402fd79f2f74e16b97fbce4e2f3c9c523074ea2cb59a94be8264ec68d8102b3003f62922344657ac49a020d30afe2cec5379bb1de35c6f424a757cded23740121f70ff0053d06c23a117d2f6682b12736cdc96ce8396d9e2d1dec45c629e74347a9735aec31f4098c80badf3f16f042b2ba366425e94bbbd53e8410cb51c932896b202b3377b76f6aac8992cb7a1eef554901fa83a015f4bb3db16429642865213efd2cb755c4fadfeaeb5814556611061fa8fffeaf17866f36f89a3451462339561c9df4868adfbd527d73b6a7949378a41f18669d65abd4531fb81ce51f7f6c119fcf27eb16bd2be776d782939201ef4beaaa9c8da3edec26f40e7081aa07708773fa60f37b9a2fa554b9ffbfb70a0fc662b82d5976adc96dd522c2f91890722bff400496abb0beb05e280b97dd2c03c89ccaf59db6786c52deae2e8d6f26f6e37d3e6390eb12d5012fbd62e0c520e9bc52afff02527dc38601d06e6db04381a901dbdcbc8e9861154bfdc0352170137ff97de55c1a521f966da1f42f1cbff684b79fde791947e45f77a53fa8e81232c00e15341bfdd75bda326a4b926259335d0df9e4269b7d1d271176f6782132893fde8a6922ae890983a742d4afdc2da9f110ed0f5b82b2340732142c18c0d8d24bcf61eee11f28802e3539bab05fb80035a05743670f9f89f2a69f63b551e5b0900ea0c39210bf5c1087b27e199f5fbd78cb413f832a0252caa35677a97dfc0009c28f60913a2df5e3eb36e3bdf8b70cd225b9b220d6b4a089b3099a52858cf4e03ff9114bc584cacd2c699a57a5e1679b4ac742be687680db681022c0cf0d04f5b8ddce8a189b0b5675e2f518e69933e72655a74d190bfd706ae4d43832d35ac04bdd25860876ceafdbc97ec2f821bf86121cc24ac6eeec21a39e41e6fdd1f7824685c5956d3def4c1d64d8b3ba0a1942c003523aee37e8d8f998fcfcb999170cb9f62351c4b88b097cd790ddcb78dbfc9acabc5d3c3b19b452e669d4e29ed7e05546d64b1767e0b817fd75f54b4a440276f2d9a65089d509b0f0a3d99fa501122023f7696bcacd4b66c0039c2a7324bdbcc5f6889cf09a37789c17d42a957f5668c9e0571999395b54d7b7bdcca7421c97b705eb70f770735791de7841615b2bfa8c4717ccbb17c031dffeb9c1f1ae94bf67d43808f16c31a4af0d3c69953d5235e744e69c44ad74d9d891dcc84f8478f029c13a143840501065a2ac12f66f969f53af1dead269c2a33dedecc8b50f4a004073c136c7271cc7e7515bfefbea5c4107aa78c32331cacfc21bb10de4c564c0ba16b0a8324f1ef980559de493b66be2bf15b4b8a1cdfaa96806ad404b4218d886a2b1fa25ddc6f73d1cb25ddef8c57a7016d6af5bc1775657057684d9239f7023bfef830bb7685d57965e178e0a5227ab1ed77dbc540773fc930622d3021f0c145a92d688e1deb25d4824dea3b3033825e8a5019674418a4d3bf401c4869033682573094d907b7f80e08896aef3117e86a825040115b5ad12422e3051970b733df356b746bdbe6fa595409f8281bd3572f9f4e75501e3f422b89c9c170e0893756a7ef8ff0f50db51821fc8d849570850cb0b681a1c2b8704139b532fc89540417485d29b5c2cdc3d807369cda53f33219c494601944376624f074d5697251393b612ff440ea9dae292eabe02ea7e328f343f4bb398b501fe993c37187adcc18a0c2ec0a62238df7d9049709b1b8df5fe1cbb28b8c5a990760004d41d550ae24ccaddc59b7d7505a83e03588c6b7a1545c91d1d7257d4dd260b505820c0ca6579d5fd1f66855da060f95caf49dfbc053f661f5b51825eb6432b039daaa05dcdf47324d02b4ad737e4121e92d9a4ebe709a33cdae9f5a868e5863bd2daa16a04582d08aed90ac6b650fbe1d34163c72f7a976f117482148e7331bfc3c4404e733bfb96f5818c8a801c06e3321b6d66c283cc7408225a6428930f4ec71ae4e11e1e3c3bf2e88d73cd658c650cbe5bc32197694130ea6b8dfccaf75265186254971759953ab24338f273aea89c8ab8dd1c688a5257acc8d8827ccf5b2a428bdaa7f3c958778c03b92aa49abc2296af1a306097f6f13a78c566cd5a68fe8fd52bde69cf53725fd59d80f1d1fef0ce69a6029cb59e00f7563d3721594be82de12c243bf6715f5c91415522c3efe41e9ca3897b2e9eaeed512eb5b71e3997e162b842b7f150352928898bc2f588e286702acdd4db2270a192913e4d6aa6f7b679251f96e93648925252f00f439db9ed3cc905233f9ab4f2e08ec349671eb4d5507fdb8a0d7de7f3534461c6a8006386c778646be10d2d69d316c7bc1008b7c8aba0cee7f6c5c1a8adc9f5191ba5fdba2c6367c633303d089e2a860f93ccc6a3b9cf0114ee1097fe98db23921b96d4f6c597c7910c40ea4ca6376bab103acf9a834c4276d7734166fda42a049c882373a9842b630f216293b79acd3e4ffdebfb3bef5ba4f66a825d575502f740c43693bf185d6aa3155506a34c0fcff91f5597f37d39c8afb4d20fa1312fca0c175ec2ac13bb687b4224f811933fee5efaf86efb6e2d9599ff44c11630ac55f09ed4b37f58b66f731a18fad2c8ff9bc7d9964791626798b290bdfe16a8497c40c32363309e6ad8b406a890672f890b5fabce8ab79242eb105ef13a5090ffcc960668949165af419968df6a4209879cda45bb03d4857ce790b12868410b0ae9daa2e26ca482aa7224d1bfb74106bf7b54fe809f1420cb94ced21947df447b71f1670e2a6ae9499873ff851a03174e6541df5b154548d3c327f1c276c72653629e52563cf155c00efaefa59bdb1637395363931854b7a257aef209f00774f049a34cac37be5d86b4f63744fdeb542ffa49b5ec98e8562fa6ffedc7984f95cfae78859a0e650fd5c41af751aae823bdef253669da9d441784b0e2de28b13c47da9a8181a7792bdec58c9b29bd868cfe06beef1eb9df4dc275b2e579ee9853bac18ac8a7ffed93ff2d26b398143b4dc992b828f1149f54ca615a135339e1bc424ceb43ba6b2e410d7179cf3c526906480e063df7cb4ce41d90a1ce8207e3ddcc8d15bcdc3b3ea25a480a0162cb097f487580d2695b81c42993a86d64021a4105f3191edbbd6829540b3f83d509d6a29de290a64c6eaa366347166be2e86e64ede665a556129db9b4b4c0456b958d8ee2637b461b01ddc03dc6d4bc884365c03f52ef411dcf8bcc7dd597ec0aa81a9d84940669e06606bf6264d58e25edc91ee63b812ebcb230bfe73bf7da2a6ddfab30efe938102d4aa786bd375c6e4f4f12285a7758aa036ec8b716a6237685b37e7a87c8868cbd96d4c0c5200ee8811299744edae582ddc22ca8758b07fc1d3a9813b3e0d0509b6d275c9ed208b339556b17d5ba16eb9d385acd45a37f0b74dd21aaa137e3a2a5c95bd6a760be804283155c38acdae16723f34380babac964c0e3698466abf46d9d963b0ce8c7ff796342fb8938b43599e9fc9ced9a50fdcb31935c65aed799834fbb04745a30be259ac67f33e8f93addc459880cbfe5d634e1f601b83c20b92aa81a914575f8bdbc909878cd065da2cf94884262a88473d94a253b94416fe031f057514ca7b123d9ec960f75fb14845b5f4057e6546a9828f50774380adc43f1fb04731f3dba50f184231ddf323f6511731ab671acdcf83965865b7bbe1a70febb01105618a0138e0ab3b81dd474be3b1b1d99c6fc750cd3d53283bdf4b78e7b23e1d3985352a04ba30a369c398aeeb5ab42eb778633b39b5d035a3d0c13e188e15fdf7e3871a7ccb114fc4532c98b2bc1981153329a7c16cf811c1b27bb84c0a4e668f67634a951b88ba4f44d0eabd2018cb361c070ec3ac73ce5b3a229c8d4feb45df6f0fd8adf8783e047a95932c7c44d2c8e338683273bd2d47561e0c477b1d1fa29cb41edca12be732765085be7dd0252ab56d8b3c73bd90df99f6fb93483be2beac00c968e2a502844a31d1d585b445280c08ccb0a8c8a78a01c37733e81c2976e424743069dd2fde9dd60fee1bbbfc94354995fee70768689155d3142d1b0e19b2e35206df9a4d93acccbd9fccb38e6b83213483e1b8f47ce77c4eac4fa7d726f451252c5e2cb7e14ecb169bf2b1b1dcb728db07ff6e3fa2fc459a8396d220012d3e482f2bd855dc185b617504198667591af076b3b2bacc4cbbf871200925d41622b1b8eb043cff700ba9956fd4d6bf3fe7241e3e9dc3f85d4adaa19096e1b957a73ba3195df02afca9dc6f12fbc0a01660c6257f12225182b5bff0c13aae49d3cc3c9064c881b71505347f87af552b4e484a6aead8c42e9c36965e98e180f3b734652270a276236add4f9a321209bb63bcdd7d82176b5c72c4ca05d036fb8acb18ea255c0fbbe61a95715378809cf4754187c34fc9f9b2a0a969ba6fc5cf54f3c1255e076e9339ce6c81cd5db24138a2fa21e7a8335392a9aad0dda541c758e7955fd34d42af542d30c104a055263d6d9ed4b57dd56f378f120a364c3ae2a4b85c37f44a314b33c6f396b2b542393bcffdc2df88909011bebf6b4d26161ee8f25b53d021ee349813989fa923faa5959b66efef0c133f1c4ae8f25bd38c0e5bf56aebde4ee20686910b353456be4d5a1d92e1f1744e00"}, &(0x7f0000001380)=0x1008) timer_create(0x5, &(0x7f0000000200)={0x0, 0x12, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000240)=0x0) timer_gettime(r3, &(0x7f0000000280)) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x480, 0x0) getsockopt$inet_buf(r4, 0x0, 0x26, &(0x7f0000000100)=""/172, &(0x7f00000001c0)=0xac) [ 704.972122] binder: 10565:10570 ioctl c0306201 20000140 returned -22 [ 704.987019] binder: BINDER_SET_CONTEXT_MGR already set [ 704.987038] binder: 10560:10576 ioctl 40046207 0 returned -16 [ 705.000710] binder: 10560:10574 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:29 executing program 2: mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x62}) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000180)=0x3) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000100)={0xa, r2, 0x2, 0x8}) read(0xffffffffffffffff, &(0x7f0000001240)=""/176, 0xffffffffffffff04) mkdir(&(0x7f0000000240)='./file0\x00', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x2, 0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x3f, 0x0, {"6d3a03a22ad13804238c25806cdd75ac"}}}}, 0xa0) r3 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000200)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000300)='./file0/file0\x00', &(0x7f00000003c0)='./file0/file0\x00') ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(0xffffffffffffffff, 0xc04c5349, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, &(0x7f0000000b40)) chdir(&(0x7f00000002c0)='./file0/file0/file0\x00') ioctl$sock_inet_SIOCGIFNETMASK(r3, 0x891b, 0x0) chmod(0x0, 0x20) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000580)={0x0, 0x0, 0x30}, 0x0) write$P9_RSTAT(r1, &(0x7f0000000440)=ANY=[@ANYPTR64=&(0x7f0000000480)=ANY=[@ANYBLOB="4f0326b9c9f6a74e0f61aee38b286817b62b3516f28d9130c84cc84f9277f3d5c3bc02f4b7a607ac2a094d8056977587ae2a309344f45248fef09adaabf37d536e936332fb4bb23811b509eda58eb46dd8a684de06289894f989d32936302ae94f6fc162a9b74fcadb7796a650a528cb4d6fa49e8cca2e6f64ba0ba387110534e43a9675b849780401ed", @ANYRESOCT=r0, @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYPTR64, @ANYPTR64, @ANYPTR64, @ANYPTR, @ANYPTR64, @ANYRES16=r0, @ANYRES16=r0], @ANYRESHEX=r0], @ANYRESOCT=r3, @ANYRESOCT=0x0, @ANYRES16=r2], 0x38) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, 0x0, &(0x7f00000005c0)) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) write$FUSE_GETXATTR(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000880)={0x9, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, {0x2, 0x4e20, @loopback}, {}, 0x100, 0x92, 0x4, 0x1, 0xfffffffffffffffa, 0x0, 0x7, 0xfffffffffffffffc, 0x7}) 09:17:29 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x3}], 0x0, 0x0, 0x0}) 09:17:29 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x4c000000, 0x0}) [ 705.053715] binder: 10565:10584 unknown command 0 [ 705.072622] binder: 10565:10584 ioctl c0306201 20000140 returned -22 09:17:29 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x6c00}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:29 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:29 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = memfd_create(&(0x7f0000000100)='+loem0vmnet0eth1-+^ppp0\\\x00', 0x2) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffff9c, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x400}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f00000001c0)={r3, @in6={{0xa, 0x4e24, 0x7fff, @remote, 0x7a}}, 0x0, 0x3, 0x1f, 0x9, 0x1000}, &(0x7f0000000280)=0x98) [ 705.204792] binder: 10592:10597 BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 705.212209] binder: 10593:10598 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 705.232871] binder: 10596:10599 unknown command 0 [ 705.238316] binder: 10592:10597 unknown command 0 [ 705.250597] binder: 10596:10599 ioctl c0306201 20000140 returned -22 [ 705.257453] binder: BINDER_SET_CONTEXT_MGR already set [ 705.268218] binder: 10592:10597 ioctl c0306201 20000140 returned -22 [ 705.281283] binder: 10593:10603 ioctl 40046207 0 returned -16 09:17:30 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000240)=""/148, 0x94}], 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000000)={0x3, [0xc1, 0x100, 0x4]}, 0xa) timer_create(0x7, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='net/route\x00') preadv(r2, &(0x7f0000000480), 0x2b0, 0x4c000000) [ 705.301639] binder: 10593:10598 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 705.302028] binder: 10596:10609 unknown command 0 09:17:30 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x12}], 0x0, 0x0, 0x0}) 09:17:30 executing program 0: syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x8, 0x40040) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:30 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6800000000000000, 0x0}) [ 705.352463] binder: 10596:10609 ioctl c0306201 20000140 returned -22 09:17:30 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0xf5617df3fd20724c) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0xfffffffffffffe11) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) 09:17:30 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x40046307}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 705.434937] binder: 10613:10617 BC_CLEAR_DEATH_NOTIFICATION invalid ref 18 [ 705.469439] binder: 10619:10620 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 705.482204] binder: 10613:10617 unknown command 0 [ 705.495320] binder: 10613:10617 ioctl c0306201 20000140 returned -22 09:17:30 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000000dcec2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000100)=ANY=[@ANYBLOB="01b0a44d7b00000000000000000000008534c8affa52bb5f5161", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:30 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x1634040}], 0x0, 0x0, 0x0}) 09:17:30 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x7fff, 0x32c) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xfffffffffffffff8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 705.580212] binder: BINDER_SET_CONTEXT_MGR already set [ 705.600368] binder: 10619:10633 ioctl 40046207 0 returned -16 [ 705.600910] binder: 10631:10632 unknown command 0 [ 705.629080] binder: 10635:10636 BC_CLEAR_DEATH_NOTIFICATION invalid ref 23281728 [ 705.662106] binder: 10631:10632 ioctl c0306201 20000140 returned -22 [ 705.671843] binder: 10635:10636 unknown command 0 09:17:30 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0xffffff7f, 0x0}) [ 705.691374] binder: 10635:10636 ioctl c0306201 20000140 returned -22 [ 705.702806] binder: 10631:10642 unknown command 0 09:17:30 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000080)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000300)={{{@in=@empty, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@remote}}, &(0x7f0000000200)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000100)=ANY=[@ANYBLOB="0100a18ad177b094d895010000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000000000000000005a34a59932ac27b7"], 0x48}}, 0x0) 09:17:30 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000d1c000)=0x6, 0x4) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000040)=0xdf8, 0x4) readahead(r1, 0x80000000, 0x2) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast2, 0x9}, 0x1c) [ 705.733142] binder: 10631:10642 ioctl c0306201 20000140 returned -22 [ 705.850390] binder: 10645:10649 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:30 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000240)=""/148, 0x94}], 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000000)={0x3, [0xc1, 0x100, 0x4]}, 0xa) timer_create(0x7, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='net/route\x00') preadv(r2, &(0x7f0000000480), 0x2b0, 0x4c000000) 09:17:30 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x600}], 0x0, 0x0, 0x0}) 09:17:30 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x1200000000000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:30 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100002899683f59a4487edec173f9b4fa8a23474b2427b6a8a2fd2ab18a1a4cfd7bedad4a26beb154c5697bbb6113965ece38d77e091a3ab08f93dc0738c53a48a2e704e07cc549a9468d05731980210c34c25199f29240044949b7b2ee03779d1f7d6cfbbe885fbb0dd70064187c73f65fc9e2eff60075cd2dd9a5180232dde5efdf57b9128d29dabfb4af4b8cfb9502bdc32573c335058af00feb6f5ef59f87efb663b89cf2656b"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="fd00009b32ac27aefb255aeaf0183525477791b70000000000000000000000000000000001fe0f0e9d4776665bbf360497ad68ce5e8a374c93a28742d38b49"], 0x48}}, 0x0) io_setup(0x1, &(0x7f0000000100)=0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) io_pgetevents(r2, 0x8000000000000000, 0xcb, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000300)={r3, r4+10000000}, &(0x7f00000003c0)={&(0x7f0000000340)={0x80000000}, 0x8}) 09:17:30 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = memfd_create(&(0x7f0000000100)='+loem0vmnet0eth1-+^ppp0\\\x00', 0x2) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffff9c, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x400}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f00000001c0)={r3, @in6={{0xa, 0x4e24, 0x7fff, @remote, 0x7a}}, 0x0, 0x3, 0x1f, 0x9, 0x1000}, &(0x7f0000000280)=0x98) [ 705.891912] binder: BINDER_SET_CONTEXT_MGR already set [ 705.897406] binder: 10645:10657 ioctl 40046207 0 returned -16 [ 705.916363] binder: 10645:10649 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:30 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x68000000, 0x0}) [ 705.991006] binder: 10661:10663 unknown command 0 [ 705.995919] binder: 10661:10663 ioctl c0306201 20000140 returned -22 [ 706.007481] binder: 10660:10667 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1536 [ 706.042192] binder: 10660:10667 unknown command 0 09:17:30 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r0, &(0x7f0000000000), 0xe) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x4) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000080)) [ 706.070330] binder: 10660:10667 ioctl c0306201 20000140 returned -22 [ 706.086345] binder: 10661:10675 unknown command 0 [ 706.102010] binder: 10661:10675 ioctl c0306201 20000140 returned -22 [ 706.111983] binder: BINDER_SET_CONTEXT_MGR already set 09:17:30 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @remote, 0x0, 0x0, 'lblc\x00', 0xffffffffffffffff}, 0x2c) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000100)=0x1) [ 706.136188] binder: 10674:10678 ioctl 40046207 0 returned -16 09:17:30 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x100000000000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:30 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x4800, 0x0}) 09:17:31 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x3f00}], 0x0, 0x0, 0x0}) 09:17:31 executing program 3: r0 = epoll_create1(0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000000)={0x0, 0x70, 0xfff, 0x6, 0x610, 0xffffffffffffeda6, 0x0, 0x0, 0x42, 0x4, 0x60, 0xfffffffffffffff8, 0x6, 0x7, 0x5, 0x9, 0x1, 0x4, 0x1, 0x40, 0x1000, 0xa7, 0x2, 0x6, 0x80000000, 0x1ff, 0xa51, 0x6b, 0x9, 0x20, 0xb6, 0x3, 0x400, 0x3, 0x401, 0x5, 0x6, 0x4, 0x0, 0xcf9, 0x3, @perf_config_ext={0x1, 0x1}, 0x10002, 0x1000, 0x200, 0x9, 0x1, 0x9, 0x3f1}) r1 = epoll_create1(0x0) close(r0) syz_open_dev$mice(&(0x7f0000000400)='/dev/input/mice\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) [ 706.281588] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0x1b25/0x1d70 [ 706.365676] binder: 10691:10692 unknown command 0 [ 706.373837] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0x1b25/0x1d70 [ 706.390079] binder: 10691:10692 ioctl c0306201 20000140 returned -22 [ 706.398672] binder: 10689:10694 BC_CLEAR_DEATH_NOTIFICATION invalid ref 16128 [ 706.406174] binder: 10689:10694 unknown command 0 09:17:31 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000240)=""/148, 0x94}], 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000000)={0x3, [0xc1, 0x100, 0x4]}, 0xa) timer_create(0x7, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='net/route\x00') preadv(r2, &(0x7f0000000480), 0x2b0, 0x4c000000) 09:17:31 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000140)=0x85e5, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:31 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x2}], 0x0, 0x0, 0x0}) [ 706.411852] binder: 10689:10694 ioctl c0306201 20000140 returned -22 [ 706.415235] binder: BINDER_SET_CONTEXT_MGR already set [ 706.430643] binder: 10691:10700 unknown command 0 [ 706.435795] binder: 10691:10700 ioctl c0306201 20000140 returned -22 [ 706.451494] binder: 10693:10699 ioctl 40046207 0 returned -16 09:17:31 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="000000000000000000000000000000000010000000000000ed793afe0000000002008201260001000000640000000001270005000000000000006400000000030d0085043100c90000006400000000043200052020002d010000d306000055aa", 0xfea1, 0x1a0}]) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001ef00000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x10401, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:31 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0xd63000000000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:31 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x300, 0x0}) 09:17:31 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) fsync(0xffffffffffffffff) chdir(&(0x7f00000002c0)='./file0\x00') r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x80, 0x0) dup3(r1, r0, 0x80000) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000280)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000300)=0x8) write(r3, &(0x7f0000000340), 0x10000014c) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) openat$vnet(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhost-net\x00', 0x2, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 706.631710] binder: 10711:10720 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 706.650558] binder: BINDER_SET_CONTEXT_MGR already set [ 706.669005] binder: 10711:10720 unknown command 0 [ 706.674780] binder: 10715:10722 unknown command 0 [ 706.680955] binder: 10716:10721 ioctl 40046207 0 returned -16 [ 706.687101] binder: 10711:10720 ioctl c0306201 20000140 returned -22 [ 706.694117] binder: 10715:10722 ioctl c0306201 20000140 returned -22 [ 706.723609] binder: 10715:10729 unknown command 0 09:17:31 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x4800000000000000, 0x0}) 09:17:31 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x40486311}], 0x0, 0x0, 0x0}) [ 706.746441] binder: 10715:10729 ioctl c0306201 20000140 returned -22 09:17:31 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x600000000000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 706.863510] binder: BINDER_SET_CONTEXT_MGR already set [ 706.867669] loop0: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p21 [ 706.890562] binder: 10733:10735 ioctl 40046207 0 returned -16 [ 706.982927] binder: 10734:10738 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1078485777 [ 707.020716] binder: 10734:10738 unknown command 0 [ 707.034337] binder: 10734:10738 ioctl c0306201 20000140 returned -22 [ 707.047376] binder_thread_write: 43 callbacks suppressed [ 707.047390] binder: 10739:10740 Acquire 1 refcount change on invalid ref 0 ret -22 [ 707.047521] loop0: p3 start 201 is beyond EOD, truncated [ 707.068253] loop0: p4 start 301 is beyond EOD, truncated [ 707.071049] binder: 10739:10740 IncRefs 0 refcount change on invalid ref 0 ret -22 09:17:31 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x2000000000000000, 0x0}) [ 707.092729] binder: 10739:10740 unknown command 0 [ 707.101763] binder: 10739:10740 ioctl c0306201 20000140 returned -22 09:17:31 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xffffff7f00000000}], 0x0, 0x0, 0x0}) [ 707.153713] binder: 10739:10742 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:31 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = inotify_init1(0x0) inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='./file0\x00', 0x4000000) inotify_add_watch(r1, &(0x7f0000ac5000)='./file0\x00', 0xa400295c) r2 = open(&(0x7f0000fa3000)='./file0\x00', 0x0, 0x0) rmdir(&(0x7f0000000040)='./file0\x00') dup2(r1, r2) [ 707.216448] binder: 10739:10742 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 707.271953] binder: 10739:10742 unknown command 0 [ 707.290430] binder: 10739:10742 ioctl c0306201 20000140 returned -22 [ 707.299264] binder: 10744:10749 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x963104000000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 707.334170] binder: 10744:10749 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 707.369594] binder: 10744:10749 unknown command 0 [ 707.372903] binder: BINDER_SET_CONTEXT_MGR already set [ 707.397841] binder: 10744:10749 ioctl c0306201 20000140 returned -22 [ 707.398885] binder: 10746:10753 ioctl 40046207 0 returned -16 09:17:32 executing program 2: r0 = socket$inet(0x10, 0x3, 0xc) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x10000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f0000000080)={0x7, 0x0, {0x3, 0x2, 0x1000, 0x0, 0x8000}}) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000010607031dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) [ 707.466904] binder: 10755:10757 Acquire 1 refcount change on invalid ref 0 ret -22 [ 707.490364] binder: 10755:10757 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 707.515387] binder: 10755:10757 unknown command 0 [ 707.530077] binder: 10755:10757 ioctl c0306201 20000140 returned -22 [ 707.552554] binder: 10755:10765 Acquire 1 refcount change on invalid ref 0 ret -22 [ 707.566032] netlink: 'syz-executor2': attribute type 1 has an invalid length. [ 707.566475] binder: 10755:10765 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 707.588536] netlink: 'syz-executor2': attribute type 1 has an invalid length. [ 707.588785] binder: 10755:10765 unknown command 0 [ 707.617124] binder: 10755:10765 ioctl c0306201 20000140 returned -22 09:17:32 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) connect$can_bcm(r0, &(0x7f0000000280)={0x1d, r1}, 0x10) connect$can_bcm(r0, &(0x7f0000000240)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000140)=""/253) 09:17:32 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x6800}], 0x0, 0x0, 0x0}) 09:17:32 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x5000000, 0x0}) 09:17:32 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r1 = socket$inet(0x2, 0x3, 0x6) r2 = socket(0xa, 0x1, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000001c0)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x3c, &(0x7f0000000000), 0x4) 09:17:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x463044000000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f00000001c0)=0x1) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000240)={[], 0x0, 0x200}) ioctl$KVM_RUN(r1, 0xae80, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000000300)='/dev/dsp#\x00', 0x3, 0x100) accept$inet(r2, 0x0, &(0x7f0000000340)) r3 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x0, 0x40000) write$P9_RCLUNK(r3, &(0x7f0000000200)={0x7, 0x79, 0x1}, 0x7) ioctl$BLKIOOPT(r2, 0x1279, &(0x7f0000000480)) r4 = dup3(r0, 0xffffffffffffffff, 0x80000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e22, @remote}}, 0x6}, &(0x7f0000000000)=0x90) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000040)={r5, 0x2}, &(0x7f0000000180)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f0000000440)={0xf, 0x8, 0xfa00, {r6, 0x8}}, 0x10) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40090000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x38, r7, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000014) [ 708.037894] binder: 10773:10778 Acquire 1 refcount change on invalid ref 0 ret -22 [ 708.044930] binder: BINDER_SET_CONTEXT_MGR already set [ 708.051735] binder: 10774:10783 ioctl 40046207 0 returned -16 [ 708.055993] binder: 10771:10779 BC_CLEAR_DEATH_NOTIFICATION invalid ref 26624 [ 708.060532] binder: 10773:10778 unknown command 0 [ 708.065764] binder: 10771:10779 unknown command 0 [ 708.074954] binder: 10771:10779 ioctl c0306201 20000140 returned -22 09:17:32 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="000000000000000000000000000000000010000000000000ed793afe0000000002008201260001000000640000000001270005000000000000006400000000030d0085043100c90000006400000000043200052020002d010000d306000055aa", 0xfea1, 0x1a0}]) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001ef00000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x10401, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:32 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) ioctl$int_in(r0, 0x5452, &(0x7f00000000c0)=0x5) connect$inet6(r0, &(0x7f0000000140), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0xfffffffffffffd2a) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') sendfile(r0, r1, 0x0, 0x10000) 09:17:32 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xb63}], 0x0, 0x0, 0x0}) 09:17:32 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0x101, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000280)=@buf={0xb4, &(0x7f00000001c0)="8b6f456a89d8cb5813dc1f671a170b0f4b33162e9734f3c7b196067d046031239ac6c7fc3c6580361d04ae911e8a9fd36f98b7230ebb798432a20697661263222be1f3d89fad722e87d1815623f57d3af3297c75788f9c19e73ee692cf501b437125ca9d2fca53067662e83d65c0e276ca0e49a0a9739502eeaf9ec08a010830dc40ac3d07e19b645f2a842e3ce446a51852c7056468840937afbaddc94c8e28efa697e1e371afd5105b11f76bcd639de378f13d"}) r1 = socket$can_bcm(0x1d, 0x2, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300)='/dev/snd/pcmC#D#p\x00', 0x2, 0x10000) connect(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r3 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xa4, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5387, &(0x7f0000000140)) sendmsg$can_bcm(r1, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000747ec9b500f0cdc2b64a2c99689d4881423cc6d40445f3c575b7a3c08ed8784d3a594fa2ea5620a2e25abca663ebc489e1b12beb13a6201138ce0dadae197f9e0bf69730a025345daf91f38fc6be0ab647028ab8c1d4a84240ebcdaaf3cbc706f248"], 0x48}}, 0x0) ioctl$VIDIOC_DV_TIMINGS_CAP(r3, 0xc0905664, &(0x7f0000000340)={0x0, 0x0, [], @bt={0x400, 0x20, 0x4, 0xfff8000000000000, 0x6, 0x0, 0x1, 0x5}}) ioctl$KVM_S390_UCAS_MAP(r3, 0x4018ae50, &(0x7f0000000400)={0x5, 0x3, 0x7}) sendmsg$can_bcm(r1, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 708.095327] binder: 10773:10778 ioctl c0306201 20000140 returned -22 09:17:32 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x6c00, 0x0}) 09:17:32 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x6c000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 708.161151] binder: tried to use weak ref as strong ref [ 708.172653] binder: 10773:10789 unknown command 0 [ 708.177688] binder: 10773:10789 ioctl c0306201 20000140 returned -22 [ 708.194758] binder: 10790:10791 unknown command 0 [ 708.204887] binder: 10790:10791 ioctl c0306201 20000140 returned -22 09:17:32 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x630d}], 0x0, 0x0, 0x0}) [ 708.223409] binder: 10790:10791 unknown command 0 [ 708.228382] binder: 10790:10791 ioctl c0306201 20000140 returned -22 09:17:33 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x300000000000000}], 0x0, 0x0, 0x0}) [ 708.278461] binder: 10793:10794 unknown command 0 [ 708.286108] binder: 10793:10794 ioctl c0306201 20000140 returned -22 09:17:33 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xa000000}], 0x0, 0x0, 0x0}) [ 708.355366] binder: 10796:10797 unknown command 0 [ 708.361581] binder: 10796:10797 ioctl c0306201 20000140 returned -22 09:17:33 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x500}], 0x0, 0x0, 0x0}) [ 708.419055] binder: 10799:10800 unknown command 0 [ 708.427470] binder: 10799:10800 ioctl c0306201 20000140 returned -22 09:17:33 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xd63}], 0x0, 0x0, 0x0}) [ 708.488972] binder: 10802:10803 unknown command 0 [ 708.496258] binder: 10802:10803 ioctl c0306201 20000140 returned -22 [ 708.620397] binder: BINDER_SET_CONTEXT_MGR already set [ 708.625741] binder: 10808:10823 ioctl 40046207 0 returned -16 [ 708.695400] binder: 10810:10827 unknown command 0 09:17:33 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000140)=0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000180)={'NETMAP\x00'}, &(0x7f0000000200)=0x1e) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000b64a28996800000000000000000000"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 708.721684] binder: 10816:10831 unknown command 0 [ 708.734704] binder: 10810:10827 ioctl c0306201 20000140 returned -22 [ 708.754584] binder: 10816:10831 ioctl c0306201 20000140 returned -22 [ 708.809398] binder: 10810:10840 unknown command 0 [ 708.887327] binder: 10810:10840 ioctl c0306201 20000140 returned -22 [ 709.087559] loop2: p1 p2 < p5 p6 p7 p8 p9 p10 p11 p12 p13 p14 p15 p16 p17 p18 p19 p20 p21 p22 p23 p24 p25 p26 p27 p28 p29 p30 p31 p32 p33 p34 p35 p36 p37 p38 p39 p40 p41 p42 p43 p44 p45 p46 p47 p48 p49 p50 p51 p52 p53 p54 p55 p56 p57 p58 p59 p60 p61 p62 p63 p64 p65 p66 p67 p68 p69 p70 p71 p72 p73 p74 p75 p76 p77 p78 p79 p80 p81 p82 p83 p84 p85 p86 p87 p88 p89 p90 p91 p92 p93 p94 p95 p96 p97 p98 p99 p100 p101 p102 p103 p104 p105 p106 p107 p108 p109 p110 p111 p112 p113 p114 p115 p116 p117 p118 p119 p120 p121 p122 p123 p124 p125 p126 p127 p128 p129 p130 p131 p132 p133 p134 p135 p136 p137 p138 p139 p140 p141 p142 p143 p144 p145 p146 p147 p148 p149 p150 p151 p152 p153 p154 p155 p156 p157 p158 p159 p160 p161 p162 p163 p164 p165 p166 p167 p168 p169 p170 p171 p172 p173 p174 p175 p176 p177 p178 p179 p180 p181 p182 p183 p184 p185 p186 p187 p188 p189 p190 p191 p192 p193 p194 p195 p196 p197 p198 p199 p200 p201 p202 p203 p204 p205 p206 p207 p208 p209 p210 p211 p212 p213 p214 p215 p216 p217 p218 p21 [ 709.286730] loop2: p3 start 201 is beyond EOD, truncated [ 709.311196] loop2: p4 start 301 is beyond EOD, truncated 09:17:35 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="000000000000000000000000000000000010000000000000ed793afe0000000002008201260001000000640000000001270005000000000000006400000000030d0085043100c90000006400000000043200052020002d010000d306000055aa", 0xfea1, 0x1a0}]) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x20002, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001ef00000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x10401, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:35 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$P9_RREMOVE(r1, &(0x7f0000000040)={0x7, 0x7b, 0x2}, 0x7) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f0000000000)={0x1000000000000, 0x1f, 0x40, 0x100}) write$RDMA_USER_CM_CMD_GET_EVENT(r1, 0x0, 0x0) write$FUSE_DIRENT(r1, &(0x7f00000000c0)={0x28, 0x0, 0x3, [{0x2, 0x3ff, 0x0, 0xff}]}, 0x28) 09:17:35 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x48, 0x0}) 09:17:35 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x7a}], 0x0, 0x0, 0x0}) 09:17:35 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x400c630e}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:17:35 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x10100, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000140)={{{@in, @in=@remote}}, {{}, 0x0, @in=@loopback}}, &(0x7f0000000240)=0xe8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r2, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800440}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, r3, 0xc00, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80000000}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8080}, 0x20008010) [ 711.271654] binder_thread_write: 7 callbacks suppressed [ 711.271667] binder: 11035:11036 BC_CLEAR_DEATH_NOTIFICATION invalid ref 122 [ 711.315593] binder_thread_write: 12 callbacks suppressed [ 711.315604] binder: 11042:11043 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 711.339885] binder: 11037:11038 unknown command 0 [ 711.770180] binder: 11037:11038 ioctl c0306201 20000140 returned -22 [ 711.871981] binder: BINDER_SET_CONTEXT_MGR already set [ 711.877325] binder: 11042:11062 ioctl 40046207 0 returned -16 [ 712.183314] binder: 11035:11036 unknown command 0 [ 712.277022] binder_thread_write: 11 callbacks suppressed [ 712.364782] binder: 11037:11065 Acquire 1 refcount change on invalid ref 1074553614 ret -22 [ 712.531169] binder: 11035:11036 ioctl c0306201 20000140 returned -22 09:17:37 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000200)=@nfc={0x27, 0x0, 0x0, 0x7}, 0x80) accept$packet(0xffffffffffffffff, &(0x7f0000001900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001940)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r4, 0x2282, &(0x7f00000001c0)) sched_setscheduler(r3, 0x6, &(0x7f0000000140)=0x586) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {0x0, 0x0, 0x4}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:37 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$P9_RREMOVE(r1, &(0x7f0000000040)={0x7, 0x7b, 0x2}, 0x7) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f0000000000)={0x1000000000000, 0x1f, 0x40, 0x100}) write$RDMA_USER_CM_CMD_GET_EVENT(r1, 0x0, 0x0) write$FUSE_DIRENT(r1, &(0x7f00000000c0)={0x28, 0x0, 0x3, [{0x2, 0x3ff, 0x0, 0xff}]}, 0x28) [ 712.840368] binder: 11042:11043 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 713.254661] binder: 11037:11065 unknown command 0 [ 713.820118] binder: 11037:11065 ioctl c0306201 20000140 returned -22 09:17:38 executing program 2: socketpair$unix(0x1, 0x2000000000000003, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x4) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000180)={0x3, 0x3, 0x0, 0x3, 0x4}) r3 = fcntl$dupfd(r2, 0xfffffffffffffffe, r1) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, 0x0) bind$bt_rfcomm(r3, &(0x7f0000000040)={0x1f, {0xffffffffffffffff, 0x1ff, 0x3}}, 0xa) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r3, 0x4010641c, &(0x7f0000000080)={r4, &(0x7f0000000100)=""/128}) 09:17:39 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0xd63000000000000}], 0x0, 0x0, 0x0}) 09:17:39 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x4000000, 0x0}) 09:17:39 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x101000, 0x0) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000140)={@broadcast, @dev={0xac, 0x14, 0x14, 0x11}, 0x0, 0x1, [@loopback]}, 0x14) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e24, 0x7, @remote, 0xe23}}}, &(0x7f0000000240)=0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={r3, @in6={{0xa, 0x4e21, 0x400, @mcast1}}, 0x6, 0x7, 0xfffffffffffff000, 0x3, 0xd7}, &(0x7f0000000280)=0x98) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:39 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000200)=@nfc={0x27, 0x0, 0x0, 0x7}, 0x80) accept$packet(0xffffffffffffffff, &(0x7f0000001900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001940)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r4, 0x2282, &(0x7f00000001c0)) sched_setscheduler(r3, 0x6, &(0x7f0000000140)=0x586) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {0x0, 0x0, 0x4}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:40 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x40046302}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 715.910321] binder: 11100:11121 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 715.940851] binder: 11107:11117 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 716.520148] binder: 11107:11117 unknown command 0 [ 716.560418] binder: BINDER_SET_CONTEXT_MGR already set [ 716.565758] binder: 11100:11135 ioctl 40046207 0 returned -16 [ 716.602208] binder: 11126:11133 Acquire 1 refcount change on invalid ref 1074029314 ret -22 09:17:41 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xc0140, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000000c0)={r0, 0x6, 0x1, 0x6, &(0x7f0000000080)=[0x0, 0x0, 0x0], 0x3}, 0x20) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x3f) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semctl$IPC_SET(0x0, 0x0, 0x13, &(0x7f0000000200)) 09:17:41 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f00000001c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @multicast1}, 0x0, 0x0, 0x4, 0x3}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x810, r0, 0x0) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000100000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000028f2ffffffffffffb7"], 0x48}}, 0x0) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x40, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r2, 0x11, 0x1, &(0x7f0000000140)=""/37, &(0x7f0000000240)=0x25) fcntl$notify(r0, 0x402, 0x38) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x802, 0x0) ioctl$VIDIOC_G_EDID(r3, 0xc0285628, &(0x7f0000000180)={0x0, 0x6, 0x9, [], &(0x7f0000000040)=0x80000000}) 09:17:41 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000200)=@nfc={0x27, 0x0, 0x0, 0x7}, 0x80) accept$packet(0xffffffffffffffff, &(0x7f0000001900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001940)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', r1}) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r2}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r4, 0x2282, &(0x7f00000001c0)) sched_setscheduler(r3, 0x6, &(0x7f0000000140)=0x586) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {0x0, 0x0, 0x4}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 716.857045] binder: 11107:11117 ioctl c0306201 20000140 returned -22 [ 717.331104] binder: 11126:11133 unknown command 0 [ 717.336177] binder: 11126:11133 ioctl c0306201 20000140 returned -22 [ 717.761331] QAT: Invalid ioctl [ 718.154267] binder: 11126:11158 Acquire 1 refcount change on invalid ref 1074029314 ret -22 [ 718.450044] QAT: Invalid ioctl 09:17:43 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x3630840}], 0x0, 0x0, 0x0}) [ 719.080479] binder: 11126:11158 unknown command 0 09:17:44 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x84, @local, 0x0, 0x1, 'lblcr\x00'}, 0x2c) r1 = syz_open_dev$media(0x0, 0xffffffff, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000002c0), &(0x7f0000000300)=0x4) rmdir(&(0x7f0000000080)='./file1\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='map_files\x00') write$P9_RSETATTR(r2, &(0x7f0000000180)={0x7, 0x1b, 0x1}, 0x7) keyctl$invalidate(0x15, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, 0x0, 0x0) epoll_pwait(0xffffffffffffffff, &(0x7f0000000280)=[{}], 0x1, 0x3, &(0x7f0000000380), 0x8) fchdir(r2) getdents64(r2, &(0x7f0000000200)=""/116, 0x184) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) statx(0xffffffffffffffff, &(0x7f0000000040)='./file2\x00', 0x0, 0x0, &(0x7f0000000500)) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f0000000140)={0x0, r2}) r3 = openat(0xffffffffffffffff, &(0x7f0000000480)='./file2\x00', 0x202, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, &(0x7f00000003c0)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000004c0)) quotactl(0x2080000201, &(0x7f0000000100)='./file1\x00', 0x0, &(0x7f00000002c0)) ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0x80045500, &(0x7f00000000c0)) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f0000000080)={0x84, @broadcast, 0x0, 0x1, 'ovf\x00'}, 0x2c) ioctl$SIOCGETLINKNAME(r3, 0x89e0, &(0x7f0000000400)={0x4}) mlock2(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) 09:17:44 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000240)={0x20001, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f00000000c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000000), 0x4, {0xa, 0x4e20, 0x435, @remote, 0x2}, r3}}, 0x38) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000200)={0x6, 0xbed, &(0x7f0000000300)="4f154b5c196b05c4b76debb53817c556539da2d94df4c68dbf1a1f779882fa1346cc58215c7f358f9d6db1bdddd1d96501f3d5721498ebf7d69642ec840754a65f923e2eb009444bd8e9bf9b0beae72e8b30d541ab9c6a6d1d2eab1d889b748461cd30947bb1ad95b154560207c3ae05cc24974fdd70e9421027f6a075f4485e572a4a14b0ddfb3b9c77db0653cdb9854e35db5d7fd20a2de365836055019cfffe84903fc31e6cc7bae566688a", &(0x7f00000003c0)="7063bab93f1ba8187d82a91709010162239d13569f5f738daba19738ecd90e1d9508cb9badabe18f18801e1a1039e15a219f132a4c59eb2f62c713f6fa019b0871447efdb5c41d989836c3ed567cb5c6d00ceee82cc6818be5143405c60111df9a27c539dfe3095b3e67c9ef31df7eb52a7a7d1c9d6c1a255967c71a7e50cb3910e4fc189a46109481bcf1bf7a757150c346c57f605e8f110535158433ed250b4353c627e4fddd9950", 0xad, 0xa9}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000180), 0x113, 0x8}}, 0x20) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 09:17:44 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x7a, 0x0}) [ 719.501218] binder: 11170:11171 Acquire 1 refcount change on invalid ref 0 ret -22 [ 719.520218] binder: 11126:11158 ioctl c0306201 20000140 returned -22 [ 720.696937] binder: 11170:11171 BC_CLEAR_DEATH_NOTIFICATION invalid ref 56821824 [ 720.760868] binder: 11191:11192 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:45 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x700000000000000}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 721.424191] binder: 11170:11171 unknown command 0 [ 721.549687] binder: 11191:11210 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 722.231408] binder: 11202:11216 Acquire 1 refcount change on invalid ref 0 ret -22 [ 722.239181] binder: 11202:11216 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 722.250523] binder: 11170:11171 ioctl c0306201 20000140 returned -22 [ 722.800213] binder: 11202:11216 unknown command 0 [ 723.340885] binder: 11202:11216 ioctl c0306201 20000140 returned -22 09:17:48 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x500000000000000, 0x0}) [ 724.091114] binder: 11202:11240 Acquire 1 refcount change on invalid ref 0 ret -22 09:17:48 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x6000000}], 0x0, 0x0, 0x0}) 09:17:49 executing program 3: r0 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x6, 0x400) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f00000000c0)={0x6, 0x9}) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) utimensat(0xffffffffffffffff, 0x0, 0x0, 0xff0fc5c0952f0380) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2000) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x970, 0x0, 0xfff}, {0xbdb, 0x0, 0x100000001}]}) [ 724.770143] binder: 11202:11240 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 725.264357] binder: 11202:11240 unknown command 0 [ 725.560091] binder: 11202:11240 ioctl c0306201 20000140 returned -22 [ 726.231588] binder: 11243:11257 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:51 executing program 2: ioctl(0xffffffffffffffff, 0x400001000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r0 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000180)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x4, 0x40, 0x9, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000040)) [ 726.517169] binder: 11252:11259 BC_CLEAR_DEATH_NOTIFICATION invalid ref 100663296 [ 727.237465] binder: 11252:11259 unknown command 0 09:17:52 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x8631040}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) [ 727.776864] binder: 11252:11259 ioctl c0306201 20000140 returned -22 [ 727.839140] snd_dummy snd_dummy.0: control 0:0:0:syz1:0 is already present [ 728.490651] binder: 11252:11284 BC_CLEAR_DEATH_NOTIFICATION invalid ref 100663296 [ 728.977132] binder: 11288:11298 Acquire 1 refcount change on invalid ref 140709952 ret -22 [ 729.190793] binder: 11252:11284 unknown command 0 [ 729.195693] binder: 11252:11284 ioctl c0306201 20000140 returned -22 09:17:54 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) r2 = dup3(r0, r0, 0x0) setsockopt$inet_buf(r2, 0x0, 0x40000002c, &(0x7f0000000100)="d3720e08a5431cfa835488181f0000e561e9c9e19d641236cbdf0488052b8c8a5d973b954a601e9cfccf27f7d9", 0x6613ffe951a7b873) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r1}, 0x10, &(0x7f0000008d00)={&(0x7f0000009180)={0x1, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "f2cdc2b64a289968"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) 09:17:54 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x60000000, 0x0}) [ 730.570359] binder: 11288:11298 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 731.471421] binder: 11308:11309 BC_CLEAR_DEATH_NOTIFICATION death notification not active 09:17:56 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/if_inet6\x00\'\x95\xaf\x9e\x0e\x06t\x91\xaerj:\xc3\xces\x06\xcf\x11\xea\x1f4\xd0\xebF\xca)x\xf1\x92\x98Ir\x87\xd8\xe9\x1196Oq\xa4\xd1\x8e9\xf9\xf9\x91\xe0\b\xdeY)\xc5\xe2\x8e\x12\x84\x1b\xabr\xe7\x96\xec\xf4\xba/\x80ze\x13\xb5\xb6B6\x0f\xa7\xf27\x81z\xb3G\xf6\xc7\xca\xc1\x90y\x8cF H\xc1\xa8\xe8K\x91b\x82\xc8\x98\a\x1a\x84\xf3\\g8\xab\xc3\x12\x05\xdc\xfd\xa7\x7fB\xf2*\x0e6\xc7\x01\xce\xeb\xc0|y\xab-#\xd9{3{R\x14\xc3=y|\xb8\xef\x98\xbe\xa0\xf1\xffd\xe4\xd7L\x16\xb2\x19{xW0\xed\x9b\x8d\x03\x1c\xd5\x03\x93\x01jJS\xcd=@\xe3n\xaar\x06H\xc5\xcfn\xa4m\xbf+\xe3\xae}&\xbb\xcd\a\x01f\xc5\x9e\x80\x16\xa8\xcf\xad#\x9c\xde\xcc\xc0\xc2\\\x9aa\xdcK\xfb\xed\x7f\xba\b\x9ah\x1b5\xd1\x83\xd03J\x92c\x9c\x822hY\x9f\x92iz\xfa\xa3\xb8\xc0${\x033\xf2\x90\x12\x89\xcb\xc9s\xd4\xe5\xed\xcd\xb2g\r\xfe\xed\x06f\xc7C\x80\v\xdc\xa7\t\xbf\xce\xf2\v!\xfac\xe2\xdc\f\xc0\x1e\t\x1c\xbd\x8f8\x14NKmD\xd4\x88e/\nY\xc4\x11-\xa3wp\x9d\xa0\x83\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc2\x88\x94\xa0\x94]\x1c\x9d\xed\xb6\xbcy\xb7\xbd\x9a\xb9\xfd\xec_\xd4\x8dVy\xa2\xf8\x9e%\x94\xe5n\xdd0x0}, &(0x7f0000000240)=0xc) sendmsg$can_raw(r1, &(0x7f0000000140)={&(0x7f0000000180)={0x1d, r2}, 0xfffffe13, &(0x7f0000000400)={&(0x7f0000000300)=@canfd={{0x0, 0xfffffffffffffe01, 0x9, 0x5}, 0xb, 0x1, 0x0, 0x0, "8a5af160642d133e4f30cd8034bdd7057ccbd674c61884a9511e06b56e5474fb7add4f59404fff22c492551722a2e8ebfc492be7a6b84fb8612f01f3af055a53"}, 0x74adea9b5d9bd7f7}}, 0x40000) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x3a8) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f00000004c0)={'filter\x00'}, &(0x7f0000000100)=0x54) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) fcntl$setpipe(r0, 0x407, 0x5) sendmsg$can_bcm(r0, &(0x7f0000009200)={&(0x7f0000001b80)={0x1d, r3}, 0x10, &(0x7f0000008d00)={&(0x7f0000000380)=ANY=[@ANYBLOB="0100b16f60ac277b187bc3b9b6d5fd83f94ef0473e07f17eb2d3e98e92b902e0a0421d1ea32b1aeb12e306e941f9cbc87cab1d5383467e012b59", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000000f2cdc2b64a289968"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r3}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) [ 734.431096] binder: 11330:11340 BC_CLEAR_DEATH_NOTIFICATION invalid ref 31232 [ 735.538779] binder: 11330:11340 unknown command 0 09:18:00 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire={0x40046305, 0x1200}, @clear_death={0x40046304}], 0x0, 0x0, 0x0}) 09:18:00 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x252, 0x82) r1 = memfd_create(&(0x7f0000000140)='cgroup2\x00u\xb56\xe0\x8f\x97\xe1\fB\x89\xe2\x96F/<\x8f\xc6\xa4\x18\"\x80\'\xbfMu\x93\x1e#\x8bA\xcfU\xaf\xcf}\xd2(Eg\xedZs\x8f3\x82\xaa\xe64\x9e\x103j\xdfhd\x99\xeb\x1d\x93y\xeb(', 0x0) io_setup(0x0, 0x0) io_submit(0x0, 0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x2000005) [ 736.280605] binder: 11330:11340 ioctl c0306201 20000140 returned -22 [ 736.792815] binder: 11354:11357 Acquire 1 refcount change on invalid ref 4608 ret -22 09:18:01 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") r1 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death], 0x0, 0x4c00000000000000, 0x0}) 09:18:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) bind(r0, &(0x7f0000000100)=@in={0x2, 0x4e20}, 0x80) setsockopt$inet_int(r0, 0x0, 0x0, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2, 0x8004e20}, 0x10) recvmmsg(r0, &(0x7f00000004c0)=[{{&(0x7f0000000400)=@ethernet={0x0, @dev}, 0x0, &(0x7f0000000480)}}], 0x6fdaec, 0x22, 0x0) [ 737.746761] binder: 11354:11357 IncRefs 0 refcount change on invalid ref 0 ret -22 09:18:03 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000002c0)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000480)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000080)={0x1, 0x10, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "5a34a59932ac27b7"}}, 0x48}}, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x80000) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r2, 0x28, 0x6, &(0x7f0000000140)={0x77359400}, 0x10) [ 739.401868] binder: 11371:11378 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 739.506176] binder: 11354:11357 unknown command 0 09:18:04 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x5d, 0x0, &(0x7f00000000c0)=[@acquire, @clear_death={0x400c630f, 0x74}], 0x0, 0x0, 0x0}) [ 739.726809] syz-executor5 (11354) used greatest stack depth: 10456 bytes left [ 740.403593] binder: 11354:11357 ioctl c0306201 20000140 returned -22 [ 742.722518] blkid invoked oom-killer: gfp_mask=0x6280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=-1000 [ 742.754426] blkid cpuset=/ mems_allowed=0 [ 742.763434] CPU: 1 PID: 11263 Comm: blkid Not tainted 4.20.0-rc7+ #160 [ 742.770117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 742.779464] Call Trace: [ 742.782056] dump_stack+0x244/0x39d [ 742.785696] ? dump_stack_print_info.cold.1+0x20/0x20 [ 742.790895] ? mark_held_locks+0x130/0x130 [ 742.795134] ? mark_held_locks+0x130/0x130 [ 742.799373] dump_header+0x27b/0xf72 [ 742.803104] ? pagefault_out_of_memory+0x197/0x197 [ 742.808039] ? __lock_acquire+0x62f/0x4c20 [ 742.812278] ? retint_kernel+0x2d/0x2d [ 742.816168] ? trace_hardirqs_on_caller+0xc0/0x310 [ 742.821104] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 742.825869] ? zap_class+0x640/0x640 [ 742.829599] ? print_usage_bug+0xc0/0xc0 [ 742.833666] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 742.838429] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 742.843970] ? find_held_lock+0x36/0x1c0 [ 742.848038] ? mark_held_locks+0xc7/0x130 [ 742.852190] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 742.857297] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 742.862402] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 742.866984] ? trace_hardirqs_on+0xbd/0x310 [ 742.871305] ? kasan_check_read+0x11/0x20 [ 742.875456] ? ___ratelimit+0x3b4/0x672 [ 742.879437] ? trace_hardirqs_off_caller+0x310/0x310 [ 742.884547] ? trace_hardirqs_on+0x310/0x310 [ 742.888964] ? lock_downgrade+0x900/0x900 [ 742.893124] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 742.898228] ? ___ratelimit+0x3b9/0x672 [ 742.902208] ? idr_get_free+0xf70/0xf70 [ 742.906185] ? kasan_check_read+0x11/0x20 [ 742.910334] ? do_raw_spin_unlock+0xa7/0x330 [ 742.914752] oom_kill_process.cold.27+0x10/0x903 [ 742.919514] ? zap_class+0x640/0x640 [ 742.923228] ? _raw_spin_unlock+0x2c/0x50 [ 742.927378] ? oom_badness+0xe6/0xaa0 [ 742.931176] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 742.936108] ? kasan_check_read+0x11/0x20 [ 742.940258] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 742.945536] ? oom_evaluate_task+0x540/0x540 [ 742.949960] ? find_held_lock+0x36/0x1c0 [ 742.954033] ? out_of_memory+0x974/0x1430 [ 742.958677] ? lock_downgrade+0x900/0x900 [ 742.962830] ? check_preemption_disabled+0x48/0x280 [ 742.967849] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 742.972784] ? kasan_check_read+0x11/0x20 [ 742.976931] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 742.982211] ? rcu_softirq_qs+0x20/0x20 [ 742.986191] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 742.991729] ? oom_evaluate_task+0x302/0x540 [ 742.996141] out_of_memory+0xa84/0x1430 [ 743.000128] ? oom_killer_disable+0x3a0/0x3a0 [ 743.004624] ? __alloc_pages_slowpath+0xf5c/0x2de0 [ 743.009561] ? __ww_mutex_check_waiters+0x160/0x160 [ 743.014607] __alloc_pages_slowpath+0x232c/0x2de0 [ 743.019483] ? warn_alloc+0x120/0x120 [ 743.023284] ? mark_held_locks+0x130/0x130 [ 743.027523] ? mark_held_locks+0x130/0x130 [ 743.031783] ? perf_iterate_sb+0x1b0/0xc60 [ 743.036031] ? update_load_avg+0x2470/0x2470 [ 743.040443] ? perf_log_itrace_start+0x530/0x530 [ 743.045203] ? perf_pmu_register+0xe70/0xe70 [ 743.049618] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 743.055156] ? __perf_event_task_sched_out+0x33a/0x1bf0 [ 743.060529] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 743.066071] ? should_fail+0x22d/0xd01 [ 743.069965] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 743.075079] ? zap_class+0x640/0x640 [ 743.078801] ? print_usage_bug+0xc0/0xc0 [ 743.082865] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 743.088406] ? __perf_event_task_sched_in+0x2a9/0xb60 [ 743.093606] ? lru_cache_add_file+0x20/0x20 [ 743.097944] ? __lock_is_held+0xb5/0x140 [ 743.102017] ? lock_release+0xa00/0xa00 [ 743.105993] ? perf_trace_sched_process_exec+0x860/0x860 [ 743.111452] ? __might_sleep+0x95/0x190 [ 743.115433] __alloc_pages_nodemask+0xad8/0xea0 [ 743.120108] ? _raw_spin_unlock_irq+0x60/0x80 [ 743.124608] ? __alloc_pages_slowpath+0x2de0/0x2de0 [ 743.129628] ? __switch_to_asm+0x34/0x70 [ 743.133688] ? __switch_to_asm+0x34/0x70 [ 743.137746] ? __switch_to_asm+0x40/0x70 [ 743.141814] ? __lock_acquire+0x62f/0x4c20 [ 743.146056] ? __schedule+0x8d7/0x21d0 [ 743.149948] ? mark_held_locks+0x130/0x130 [ 743.154195] ? mark_held_locks+0x130/0x130 [ 743.158432] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 743.163973] alloc_pages_vma+0x13d/0x690 [ 743.168043] __handle_mm_fault+0x27f8/0x5be0 [ 743.172465] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 743.177319] ? find_held_lock+0x36/0x1c0 [ 743.181398] ? zap_class+0x640/0x640 [ 743.185115] ? zap_class+0x640/0x640 [ 743.188838] ? find_held_lock+0x36/0x1c0 [ 743.192912] ? handle_mm_fault+0x42a/0xc70 [ 743.197149] ? lock_downgrade+0x900/0x900 [ 743.201300] ? check_preemption_disabled+0x48/0x280 [ 743.206319] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 743.211266] ? kasan_check_read+0x11/0x20 [ 743.215413] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 743.220689] ? rcu_softirq_qs+0x20/0x20 [ 743.224663] ? trace_hardirqs_off_caller+0x310/0x310 [ 743.229771] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 743.235312] ? check_preemption_disabled+0x48/0x280 [ 743.240339] handle_mm_fault+0x54f/0xc70 [ 743.244408] ? __handle_mm_fault+0x5be0/0x5be0 [ 743.248994] ? find_vma+0x34/0x190 [ 743.252553] __do_page_fault+0x5e8/0xe60 [ 743.256625] ? trace_hardirqs_off+0xb8/0x310 [ 743.261045] do_page_fault+0xf2/0x7e0 [ 743.264845] ? vmalloc_sync_all+0x30/0x30 [ 743.269049] ? error_entry+0x70/0xd0 [ 743.272768] ? trace_hardirqs_off_caller+0xbb/0x310 [ 743.277785] ? trace_hardirqs_on_caller+0xc0/0x310 [ 743.282715] ? syscall_return_slowpath+0x5e0/0x5e0 [ 743.287646] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 743.292496] ? trace_hardirqs_on_caller+0x310/0x310 [ 743.297509] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 743.302966] ? prepare_exit_to_usermode+0x291/0x3b0 [ 743.307984] ? page_fault+0x8/0x30 [ 743.311529] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 743.316374] ? page_fault+0x8/0x30 [ 743.319917] page_fault+0x1e/0x30 [ 743.323371] RIP: 0033:0x7ff1a2294c0e [ 743.327097] Code: 01 48 89 df 0f 85 5a 01 00 00 40 f6 c7 02 0f 85 20 01 00 00 40 f6 c7 04 0f 85 2e 01 00 00 44 89 d9 31 c0 c1 e9 03 41 f6 c3 04 48 ab 0f 85 c1 00 00 00 41 f6 c3 02 0f 85 9f 00 00 00 41 83 e3 [ 743.345999] RSP: 002b:00007ffe1779d8b0 EFLAGS: 00010246 [ 743.351359] RAX: 0000000000000000 RBX: 00007ff1a1746f10 RCX: 0000000000000002 [ 743.358629] RDX: 000000000000a110 RSI: 000000000000a120 RDI: 00007ff1a1747000 [ 743.365897] RBP: 00000000012ffeb0 R08: 0000000000000000 R09: 0000000001300116 [ 743.373163] R10: 0000000000000001 R11: 0000000000000100 R12: 0000000000000001 [ 743.380430] R13: 0000000000000064 R14: 0000000001300320 R15: 00000000013000e6 [ 743.398846] Mem-Info: [ 743.401390] active_anon:1358975 inactive_anon:5224 isolated_anon:0 [ 743.401390] active_file:119 inactive_file:147 isolated_file:32 [ 743.401390] unevictable:4096 dirty:1 writeback:0 unstable:0 [ 743.401390] slab_reclaimable:14185 slab_unreclaimable:109688 [ 743.401390] mapped:49281 shmem:291 pagetables:9236 bounce:0 [ 743.401390] free:24180 free_pcp:0 free_cma:0 [ 743.440643] Node 0 active_anon:5435900kB inactive_anon:20896kB active_file:476kB inactive_file:588kB unevictable:16384kB isolated(anon):0kB isolated(file):128kB mapped:197124kB dirty:4kB writeback:0kB shmem:1164kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 477184kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 743.469167] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 743.495365] lowmem_reserve[]: 0 2818 6321 6321 [ 743.500352] Node 0 DMA32 free:43780kB min:30052kB low:37564kB high:45076kB active_anon:2798352kB inactive_anon:4kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888780kB mlocked:0kB kernel_stack:3840kB pagetables:8844kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 743.535718] lowmem_reserve[]: 0 0 3503 3503 [ 743.540151] Node 0 Normal free:37032kB min:37364kB low:46704kB high:56044kB active_anon:2637156kB inactive_anon:20892kB active_file:604kB inactive_file:908kB unevictable:16384kB writepending:4kB present:4718592kB managed:3587816kB mlocked:16384kB kernel_stack:17216kB pagetables:28100kB bounce:0kB free_pcp:52kB local_pcp:0kB free_cma:0kB [ 743.572604] lowmem_reserve[]: 0 0 0 0 [ 743.576438] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 743.590234] Node 0 DMA32: 606*4kB (UME) 207*8kB (UE) 70*16kB (UME) 27*32kB (UM) 6*64kB (U) 0*128kB 2*256kB (ME) 0*512kB 2*1024kB (UE) 1*2048kB (E) 8*4096kB (M) = 43824kB [ 743.605654] Node 0 Normal: 651*4kB (UEH) 1449*8kB (UEH) 680*16kB (UMEH) 42*32kB (UME) 3*64kB (UME) 4*128kB (U) 39*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37108kB [ 743.622203] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 743.631111] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 743.639690] 564 total pagecache pages [ 743.645376] 0 pages in swap cache [ 743.648839] Swap cache stats: add 0, delete 0, find 0/0 [ 743.656618] Free swap = 0kB [ 743.659650] Total swap = 0kB [ 743.673088] 1965979 pages RAM [ 743.676208] 0 pages HighMem/MovableOnly [ 743.681736] 342853 pages reserved [ 743.685198] 0 pages cma reserved [ 743.688577] Out of memory: Kill process 17678 (syz-executor1) score 1007 or sacrifice child [ 743.701075] Killed process 17678 (syz-executor1) total-vm:70588kB, anon-rss:18300kB, file-rss:32640kB, shmem-rss:0kB [ 743.759030] syz-executor2 (11370) used greatest stack depth: 7648 bytes left [ 743.953412] blkid invoked oom-killer: gfp_mask=0x6280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=-1000 [ 743.999478] blkid cpuset=/ mems_allowed=0 [ 744.004983] CPU: 1 PID: 10940 Comm: blkid Not tainted 4.20.0-rc7+ #160 [ 744.011665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 744.021020] Call Trace: [ 744.023628] dump_stack+0x244/0x39d [ 744.027273] ? dump_stack_print_info.cold.1+0x20/0x20 [ 744.032472] ? mark_held_locks+0x130/0x130 [ 744.036716] ? mark_held_locks+0x130/0x130 [ 744.040973] dump_header+0x27b/0xf72 [ 744.044711] ? pagefault_out_of_memory+0x197/0x197 [ 744.049659] ? __lock_acquire+0x62f/0x4c20 [ 744.053951] ? percpu_ref_get_many+0x240/0x240 [ 744.058553] ? print_usage_bug+0xc0/0xc0 [ 744.062638] ? zap_class+0x640/0x640 [ 744.066362] ? print_usage_bug+0xc0/0xc0 [ 744.070436] ? print_usage_bug+0xc0/0xc0 [ 744.074508] ? zap_class+0x640/0x640 [ 744.078233] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 744.083781] ? find_held_lock+0x36/0x1c0 [ 744.087858] ? mark_held_locks+0xc7/0x130 [ 744.092019] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 744.097134] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 744.102249] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 744.106843] ? trace_hardirqs_on+0xbd/0x310 [ 744.111174] ? kasan_check_read+0x11/0x20 [ 744.115335] ? ___ratelimit+0x3b4/0x672 [ 744.119320] ? trace_hardirqs_off_caller+0x310/0x310 [ 744.124439] ? trace_hardirqs_on+0x310/0x310 [ 744.129381] ? lock_downgrade+0x900/0x900 [ 744.133551] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 744.138671] ? ___ratelimit+0x3b9/0x672 [ 744.142656] ? idr_get_free+0xf70/0xf70 [ 744.146647] ? kasan_check_read+0x11/0x20 [ 744.150806] ? do_raw_spin_unlock+0xa7/0x330 [ 744.155230] oom_kill_process.cold.27+0x10/0x903 [ 744.159995] ? zap_class+0x640/0x640 [ 744.163722] ? _raw_spin_unlock+0x2c/0x50 [ 744.167866] ? oom_badness+0xe6/0xaa0 [ 744.171662] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 744.176581] ? kasan_check_read+0x11/0x20 [ 744.180731] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 744.186021] ? oom_evaluate_task+0x540/0x540 [ 744.190446] ? find_held_lock+0x36/0x1c0 [ 744.194525] ? out_of_memory+0x974/0x1430 [ 744.198685] ? lock_downgrade+0x900/0x900 [ 744.202847] ? check_preemption_disabled+0x48/0x280 [ 744.207878] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 744.212820] ? kasan_check_read+0x11/0x20 [ 744.216976] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 744.222262] ? rcu_softirq_qs+0x20/0x20 [ 744.226255] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 744.231801] ? oom_evaluate_task+0x302/0x540 [ 744.236224] out_of_memory+0xa84/0x1430 [ 744.240214] ? oom_killer_disable+0x3a0/0x3a0 [ 744.244721] ? __alloc_pages_slowpath+0xf5c/0x2de0 [ 744.249669] ? __ww_mutex_check_waiters+0x160/0x160 [ 744.254707] __alloc_pages_slowpath+0x232c/0x2de0 [ 744.259600] ? warn_alloc+0x120/0x120 [ 744.263413] ? mark_held_locks+0x130/0x130 [ 744.267657] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 744.272599] ? kasan_check_read+0x11/0x20 [ 744.276758] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 744.282050] ? mark_held_locks+0x130/0x130 [ 744.286303] ? perf_iterate_sb+0x1b0/0xc60 [ 744.290553] ? perf_log_itrace_start+0x530/0x530 [ 744.295329] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 744.300874] ? should_fail+0x22d/0xd01 [ 744.304772] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 744.310318] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 744.315430] ? zap_class+0x640/0x640 [ 744.319165] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 744.324720] ? __lock_is_held+0xb5/0x140 [ 744.328859] ? lpss8250_probe+0x7e0/0xa50 [ 744.333028] ? find_held_lock+0x36/0x1c0 [ 744.337114] ? lock_release+0xa00/0xa00 [ 744.341104] ? perf_trace_sched_process_exec+0x860/0x860 [ 744.346564] ? finish_task_switch+0x1f4/0x910 [ 744.351083] ? __might_sleep+0x95/0x190 [ 744.355076] __alloc_pages_nodemask+0xad8/0xea0 [ 744.359761] ? compat_start_thread+0x80/0x80 [ 744.364180] ? __alloc_pages_slowpath+0x2de0/0x2de0 [ 744.369206] ? _raw_spin_unlock_irq+0x60/0x80 [ 744.373713] ? __lock_acquire+0x62f/0x4c20 [ 744.377966] ? __switch_to_asm+0x40/0x70 [ 744.382039] ? __switch_to_asm+0x34/0x70 [ 744.386107] ? __switch_to_asm+0x40/0x70 [ 744.390172] ? __switch_to_asm+0x34/0x70 [ 744.394249] ? mark_held_locks+0x130/0x130 [ 744.398491] ? mark_held_locks+0x130/0x130 [ 744.402738] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 744.408286] alloc_pages_vma+0x13d/0x690 [ 744.412365] __handle_mm_fault+0x27f8/0x5be0 [ 744.416794] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 744.421649] ? trace_hardirqs_on_caller+0xc0/0x310 [ 744.426600] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 744.431370] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 744.436828] ? retint_kernel+0x1b/0x2d [ 744.440724] ? trace_hardirqs_on+0x310/0x310 [ 744.445152] ? zap_class+0x640/0x640 [ 744.448874] ? zap_class+0x640/0x640 [ 744.452613] ? find_held_lock+0x36/0x1c0 [ 744.456693] ? handle_mm_fault+0x42a/0xc70 [ 744.460938] ? lock_downgrade+0x900/0x900 [ 744.465103] ? check_preemption_disabled+0x48/0x280 [ 744.470141] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 744.475084] ? kasan_check_read+0x11/0x20 [ 744.479247] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 744.484532] ? rcu_softirq_qs+0x20/0x20 [ 744.488511] ? trace_hardirqs_off_caller+0x310/0x310 [ 744.493624] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 744.499171] ? check_preemption_disabled+0x48/0x280 [ 744.504208] handle_mm_fault+0x54f/0xc70 [ 744.508281] ? __handle_mm_fault+0x5be0/0x5be0 [ 744.512875] ? find_vma+0x34/0x190 [ 744.516432] __do_page_fault+0x5e8/0xe60 [ 744.520503] ? trace_hardirqs_off+0xb8/0x310 [ 744.524930] do_page_fault+0xf2/0x7e0 [ 744.528741] ? vmalloc_sync_all+0x30/0x30 [ 744.532897] ? error_entry+0x70/0xd0 [ 744.536620] ? trace_hardirqs_off_caller+0xbb/0x310 [ 744.541641] ? trace_hardirqs_on_caller+0xc0/0x310 [ 744.546589] ? syscall_return_slowpath+0x5e0/0x5e0 [ 744.551528] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 744.556385] ? trace_hardirqs_on_caller+0x310/0x310 [ 744.561411] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 744.566875] ? prepare_exit_to_usermode+0x291/0x3b0 [ 744.571900] ? page_fault+0x8/0x30 [ 744.575454] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 744.580311] ? page_fault+0x8/0x30 [ 744.583858] page_fault+0x1e/0x30 [ 744.587313] RIP: 0033:0x7f01acf3ec0e [ 744.591044] Code: Bad RIP value. [ 744.594413] RSP: 002b:00007ffd5e935850 EFLAGS: 00010246 [ 744.599777] RAX: 0000000000000000 RBX: 00007f01aac42f10 RCX: 0000000000000002 [ 744.607047] RDX: 0000000000021830 RSI: 0000000000021840 RDI: 00007f01aac43000 [ 744.614320] RBP: 0000000002200eb0 R08: 0000000000000000 R09: 0000000002201116 [ 744.621600] R10: 0000000000000001 R11: 0000000000000100 R12: 0000000000000001 [ 744.628870] R13: 0000000000000064 R14: 0000000002201320 R15: 00000000022010e6 [ 744.739456] Mem-Info: [ 744.742199] active_anon:1363885 inactive_anon:1160 isolated_anon:0 [ 744.742199] active_file:35 inactive_file:37 isolated_file:21 [ 744.742199] unevictable:3584 dirty:0 writeback:0 unstable:0 [ 744.742199] slab_reclaimable:14157 slab_unreclaimable:109693 [ 744.742199] mapped:49210 shmem:290 pagetables:9200 bounce:0 [ 744.742199] free:24177 free_pcp:2 free_cma:0 [ 744.775746] Node 0 active_anon:5455540kB inactive_anon:4640kB active_file:240kB inactive_file:148kB unevictable:14336kB isolated(anon):0kB isolated(file):84kB mapped:196840kB dirty:0kB writeback:0kB shmem:1160kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 460800kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 744.816704] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 744.857349] lowmem_reserve[]: 0 2818 6321 6321 [ 744.862028] Node 0 DMA32 free:43860kB min:30052kB low:37564kB high:45076kB active_anon:2798344kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888780kB mlocked:0kB kernel_stack:3840kB pagetables:8820kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 744.890296] lowmem_reserve[]: 0 0 3503 3503 [ 744.894616] Node 0 Normal free:36940kB min:37364kB low:46704kB high:56044kB active_anon:2657204kB inactive_anon:4640kB active_file:148kB inactive_file:408kB unevictable:14336kB writepending:0kB present:4718592kB managed:3587816kB mlocked:14336kB kernel_stack:17152kB pagetables:27980kB bounce:0kB free_pcp:96kB local_pcp:0kB free_cma:0kB [ 745.638265] lowmem_reserve[]: 0 0 0 0 [ 745.728394] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 745.753277] Node 0 DMA32: 607*4kB (UME) 211*8kB (UME) 70*16kB (UME) 27*32kB (UM) 6*64kB (U) 0*128kB 2*256kB (ME) 0*512kB 2*1024kB (UE) 1*2048kB (E) 8*4096kB (M) = 43860kB [ 745.784583] Node 0 Normal: 622*4kB (UMEH) 1457*8kB (UMEH) 685*16kB (UEH) 42*32kB (UE) 2*64kB (UE) 4*128kB (U) 39*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37072kB [ 745.808528] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 745.818581] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 745.828499] 425 total pagecache pages [ 745.914947] 0 pages in swap cache [ 745.918440] Swap cache stats: add 0, delete 0, find 0/0 [ 745.939936] Free swap = 0kB [ 746.617080] Total swap = 0kB [ 746.623232] 1965979 pages RAM [ 746.626345] 0 pages HighMem/MovableOnly [ 746.637002] 342853 pages reserved [ 746.645072] 0 pages cma reserved [ 746.648462] Out of memory: Kill process 17676 (syz-executor1) score 1007 or sacrifice child [ 746.675626] Killed process 17676 (syz-executor1) total-vm:70472kB, anon-rss:18068kB, file-rss:32640kB, shmem-rss:0kB [ 746.902653] init invoked oom-killer: gfp_mask=0x6200ca(GFP_HIGHUSER_MOVABLE), nodemask=(null), order=0, oom_score_adj=0 [ 746.938961] init cpuset=/ mems_allowed=0 [ 746.960647] CPU: 1 PID: 1 Comm: init Not tainted 4.20.0-rc7+ #160 [ 746.966899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 746.976272] Call Trace: [ 746.978871] dump_stack+0x244/0x39d [ 746.982514] ? dump_stack_print_info.cold.1+0x20/0x20 [ 746.987720] ? mark_held_locks+0x130/0x130 [ 746.991972] ? mark_held_locks+0x130/0x130 [ 746.996222] dump_header+0x27b/0xf72 [ 746.999956] ? pagefault_out_of_memory+0x197/0x197 [ 747.004903] ? __lock_acquire+0x62f/0x4c20 [ 747.009181] ? percpu_ref_get_many+0x240/0x240 [ 747.013779] ? print_usage_bug+0xc0/0xc0 [ 747.017850] ? zap_class+0x640/0x640 [ 747.021590] ? print_usage_bug+0xc0/0xc0 [ 747.025659] ? print_usage_bug+0xc0/0xc0 [ 747.029733] ? zap_class+0x640/0x640 [ 747.033475] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 747.039040] ? find_held_lock+0x36/0x1c0 [ 747.043126] ? mark_held_locks+0xc7/0x130 [ 747.047287] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 747.052402] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 747.057517] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 747.062124] ? trace_hardirqs_on+0xbd/0x310 [ 747.066454] ? kasan_check_read+0x11/0x20 [ 747.070612] ? ___ratelimit+0x3b4/0x672 [ 747.074604] ? trace_hardirqs_off_caller+0x310/0x310 [ 747.079720] ? trace_hardirqs_on+0x310/0x310 [ 747.084138] ? lock_downgrade+0x900/0x900 [ 747.088301] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 747.093413] ? ___ratelimit+0x3b9/0x672 [ 747.097397] ? idr_get_free+0xf70/0xf70 [ 747.101385] ? kasan_check_read+0x11/0x20 [ 747.105542] ? do_raw_spin_unlock+0xa7/0x330 [ 747.109972] oom_kill_process.cold.27+0x10/0x903 [ 747.114741] ? zap_class+0x640/0x640 [ 747.118460] ? _raw_spin_unlock+0x2c/0x50 [ 747.122617] ? oom_badness+0xe6/0xaa0 [ 747.126439] ? oom_evaluate_task+0x540/0x540 [ 747.130860] ? find_held_lock+0x36/0x1c0 [ 747.134937] ? out_of_memory+0x974/0x1430 [ 747.139101] ? lock_downgrade+0x900/0x900 [ 747.143263] ? check_preemption_disabled+0x48/0x280 [ 747.148293] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 747.153235] ? kasan_check_read+0x11/0x20 [ 747.157389] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 747.162671] ? rcu_softirq_qs+0x20/0x20 [ 747.166695] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 747.171716] ? oom_evaluate_task+0x302/0x540 [ 747.176138] out_of_memory+0xa84/0x1430 [ 747.180131] ? oom_killer_disable+0x3a0/0x3a0 [ 747.184636] ? __alloc_pages_slowpath+0xf5c/0x2de0 [ 747.189592] ? __ww_mutex_check_waiters+0x160/0x160 [ 747.194629] __alloc_pages_slowpath+0x232c/0x2de0 [ 747.199511] ? warn_alloc+0x120/0x120 [ 747.203321] ? mark_held_locks+0x130/0x130 [ 747.207581] ? find_get_entry+0xaae/0x1120 [ 747.211832] ? filemap_map_pages+0x1a20/0x1a20 [ 747.216426] ? zap_class+0x640/0x640 [ 747.220155] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 747.225704] ? check_preemption_disabled+0x48/0x280 [ 747.230729] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 747.236272] ? should_fail+0x22d/0xd01 [ 747.240176] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 747.245290] ? zap_class+0x640/0x640 [ 747.249033] ? __lock_is_held+0xb5/0x140 [ 747.253117] ? mark_held_locks+0x130/0x130 [ 747.257363] ? lock_release+0xa00/0xa00 [ 747.261351] ? perf_trace_sched_process_exec+0x860/0x860 [ 747.266807] ? xa_load+0x2ba/0x460 [ 747.270358] ? lock_downgrade+0x900/0x900 [ 747.274524] ? __might_sleep+0x95/0x190 [ 747.278510] __alloc_pages_nodemask+0xad8/0xea0 [ 747.283193] ? __alloc_pages_slowpath+0x2de0/0x2de0 [ 747.288221] ? __page_cache_alloc+0x191/0x5c0 [ 747.292723] ? xa_load+0x2e1/0x460 [ 747.296274] ? xa_clear_mark+0x40/0x40 [ 747.300175] ? zap_class+0x640/0x640 [ 747.303908] ? zap_class+0x640/0x640 [ 747.307631] ? zap_class+0x640/0x640 [ 747.311356] ? __do_page_cache_readahead+0x663/0x810 [ 747.316472] ? find_held_lock+0x36/0x1c0 [ 747.320544] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 747.326112] alloc_pages_current+0x173/0x350 [ 747.330535] __page_cache_alloc+0x38c/0x5c0 [ 747.334874] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 747.339813] ? kasan_check_read+0x11/0x20 [ 747.344018] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 747.349305] ? generic_perform_write+0x6a0/0x6a0 [ 747.354073] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 747.359626] ? check_preemption_disabled+0x48/0x280 [ 747.364662] filemap_fault+0x1595/0x25f0 [ 747.368747] ? __lock_page_or_retry+0xa00/0xa00 [ 747.373427] ? mark_held_locks+0x130/0x130 [ 747.377681] ? filemap_map_pages+0xd6b/0x1a20 [ 747.382184] ? lock_downgrade+0x900/0x900 [ 747.386341] ? check_preemption_disabled+0x48/0x280 [ 747.391370] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 747.396306] ? kasan_check_read+0x11/0x20 [ 747.400458] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 747.405743] ? rcu_softirq_qs+0x20/0x20 [ 747.409743] ? filemap_map_pages+0xd92/0x1a20 [ 747.414248] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 747.419814] ? find_get_entries_tag+0x1400/0x1400 [ 747.424669] ? __lock_acquire+0x62f/0x4c20 [ 747.428925] ? lock_acquire+0x1ed/0x520 [ 747.432980] ? ext4_filemap_fault+0x7a/0xad [ 747.437324] ? lock_release+0xa00/0xa00 [ 747.441305] ? perf_trace_sched_process_exec+0x860/0x860 [ 747.446766] ? print_usage_bug+0xc0/0xc0 [ 747.450839] ? print_usage_bug+0xc0/0xc0 [ 747.454916] ? down_read+0x8d/0x120 [ 747.458550] ? ext4_filemap_fault+0x7a/0xad [ 747.462890] ? __down_interruptible+0x700/0x700 [ 747.467583] ext4_filemap_fault+0x82/0xad [ 747.471742] __do_fault+0x100/0x6b0 [ 747.475380] ? pmd_devmap_trans_unstable+0x220/0x220 [ 747.480491] ? mark_held_locks+0x130/0x130 [ 747.484734] ? mark_held_locks+0x130/0x130 [ 747.488972] ? find_held_lock+0x36/0x1c0 [ 747.493045] ? find_held_lock+0x36/0x1c0 [ 747.497123] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 747.502671] __handle_mm_fault+0x3ea6/0x5be0 [ 747.507084] ? poll_select_copy_remaining+0x18c/0x6a0 [ 747.512293] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 747.517150] ? __might_fault+0x12b/0x1e0 [ 747.521219] ? lock_downgrade+0x900/0x900 [ 747.525381] ? zap_class+0x640/0x640 [ 747.529107] ? zap_class+0x640/0x640 [ 747.532835] ? find_held_lock+0x36/0x1c0 [ 747.536923] ? handle_mm_fault+0x42a/0xc70 [ 747.541173] ? lock_downgrade+0x900/0x900 [ 747.545332] ? check_preemption_disabled+0x48/0x280 [ 747.550361] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 747.555296] ? kasan_check_read+0x11/0x20 [ 747.559448] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 747.564736] ? rcu_softirq_qs+0x20/0x20 [ 747.568718] ? trace_hardirqs_off_caller+0x310/0x310 [ 747.573828] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 747.579371] ? check_preemption_disabled+0x48/0x280 [ 747.584405] handle_mm_fault+0x54f/0xc70 [ 747.588482] ? __handle_mm_fault+0x5be0/0x5be0 [ 747.593081] ? find_vma+0x34/0x190 [ 747.596639] __do_page_fault+0x5e8/0xe60 [ 747.600716] ? trace_hardirqs_off+0xb8/0x310 [ 747.605143] do_page_fault+0xf2/0x7e0 [ 747.608949] ? vmalloc_sync_all+0x30/0x30 [ 747.613113] ? error_entry+0x70/0xd0 [ 747.616840] ? trace_hardirqs_off_caller+0xbb/0x310 [ 747.621861] ? trace_hardirqs_on_caller+0xc0/0x310 [ 747.626802] ? syscall_return_slowpath+0x5e0/0x5e0 [ 747.631744] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 747.636601] ? trace_hardirqs_on_caller+0x310/0x310 [ 747.641628] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 747.647088] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 747.652121] ? prepare_exit_to_usermode+0x291/0x3b0 [ 747.657147] ? page_fault+0x8/0x30 [ 747.660701] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 747.665554] ? page_fault+0x8/0x30 [ 747.669115] page_fault+0x1e/0x30 [ 747.672582] RIP: 0033:0x404d65 [ 747.675796] Code: Bad RIP value. [ 747.679167] RSP: 002b:00007fff5af2a2d0 EFLAGS: 00010217 [ 747.684539] RAX: 0000000000000000 RBX: 00007fff5af2a470 RCX: 00007f14febd7dd3 [ 747.691829] RDX: 0000000000000000 RSI: 00007fff5af2a620 RDI: 000000000000000b [ 747.699109] RBP: 00007fff5af2a620 R08: 00007fff5af2a6a0 R09: 0000000000000001 [ 747.706390] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 747.713665] R13: 00007fff5af2aa00 R14: 0000000000000000 R15: 0000000000000000 [ 747.844428] Mem-Info: [ 747.846927] active_anon:1368586 inactive_anon:229 isolated_anon:0 [ 747.846927] active_file:53 inactive_file:17 isolated_file:33 [ 747.846927] unevictable:0 dirty:0 writeback:0 unstable:0 [ 747.846927] slab_reclaimable:14095 slab_unreclaimable:109540 [ 747.846927] mapped:49229 shmem:290 pagetables:9198 bounce:0 [ 747.846927] free:24164 free_pcp:10 free_cma:0 [ 747.908550] Node 0 active_anon:5474344kB inactive_anon:916kB active_file:212kB inactive_file:104kB unevictable:0kB isolated(anon):0kB isolated(file):28kB mapped:196816kB dirty:0kB writeback:0kB shmem:1160kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 444416kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 747.958190] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 747.994458] lowmem_reserve[]: 0 2818 6321 6321 [ 747.999080] Node 0 DMA32 free:43880kB min:30052kB low:37564kB high:45076kB active_anon:2798344kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888780kB mlocked:0kB kernel_stack:3840kB pagetables:8820kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 748.057270] lowmem_reserve[]: 0 0 3503 3503 [ 748.064081] Node 0 Normal free:36776kB min:37364kB low:46704kB high:56044kB active_anon:2676008kB inactive_anon:916kB active_file:40kB inactive_file:40kB unevictable:0kB writepending:0kB present:4718592kB managed:3587816kB mlocked:0kB kernel_stack:17152kB pagetables:27972kB bounce:0kB free_pcp:868kB local_pcp:624kB free_cma:0kB [ 748.124230] lowmem_reserve[]: 0 0 0 0 [ 748.128078] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 748.145764] Node 0 DMA32: 606*4kB (UME) 212*8kB (UME) 71*16kB (UME) 27*32kB (UM) 6*64kB (U) 0*128kB 2*256kB (ME) 0*512kB 2*1024kB (UE) 1*2048kB (E) 8*4096kB (M) = 43880kB [ 748.212283] Node 0 Normal: 769*4kB (UMEH) 1495*8kB (UMEH) 687*16kB (UMEH) 44*32kB (UME) 4*64kB (UME) 3*128kB (U) 37*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37548kB [ 748.227897] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 748.237990] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 748.247894] 337 total pagecache pages [ 748.251770] 0 pages in swap cache [ 748.255225] Swap cache stats: add 0, delete 0, find 0/0 [ 748.264384] Free swap = 0kB [ 748.269121] Total swap = 0kB [ 748.272188] 1965979 pages RAM [ 748.286665] 0 pages HighMem/MovableOnly [ 748.351208] 342853 pages reserved [ 748.354690] 0 pages cma reserved [ 748.365408] Out of memory: Kill process 9819 (syz-executor1) score 1007 or sacrifice child [ 748.381285] Killed process 9819 (syz-executor1) total-vm:70472kB, anon-rss:16532kB, file-rss:32768kB, shmem-rss:0kB [ 748.459118] oom_reaper: reaped process 9819 (syz-executor1), now anon-rss:0kB, file-rss:32768kB, shmem-rss:0kB [ 748.528332] blkid invoked oom-killer: gfp_mask=0x6280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=-1000 [ 748.578286] blkid cpuset=/ mems_allowed=0 [ 748.598883] CPU: 1 PID: 10917 Comm: blkid Not tainted 4.20.0-rc7+ #160 [ 748.605565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 748.614932] Call Trace: [ 748.617535] dump_stack+0x244/0x39d [ 748.621174] ? dump_stack_print_info.cold.1+0x20/0x20 [ 748.626392] ? mark_held_locks+0x130/0x130 [ 748.630636] ? mark_held_locks+0x130/0x130 [ 748.634882] dump_header+0x27b/0xf72 [ 748.638622] ? pagefault_out_of_memory+0x197/0x197 [ 748.643567] ? mark_held_locks+0x130/0x130 [ 748.647820] ? __lock_acquire+0x62f/0x4c20 [ 748.652070] ? percpu_ref_get_many+0x240/0x240 [ 748.656666] ? print_usage_bug+0xc0/0xc0 [ 748.660739] ? zap_class+0x640/0x640 [ 748.664463] ? print_usage_bug+0xc0/0xc0 [ 748.668529] ? print_usage_bug+0xc0/0xc0 [ 748.672599] ? zap_class+0x640/0x640 [ 748.676342] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 748.681868] ? find_held_lock+0x36/0x1c0 [ 748.685913] ? mark_held_locks+0xc7/0x130 [ 748.690133] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 748.695216] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 748.700302] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 748.704869] ? trace_hardirqs_on+0xbd/0x310 [ 748.709171] ? kasan_check_read+0x11/0x20 [ 748.713302] ? ___ratelimit+0x3b4/0x672 [ 748.717257] ? trace_hardirqs_off_caller+0x310/0x310 [ 748.722340] ? trace_hardirqs_on+0x310/0x310 [ 748.726728] ? lock_downgrade+0x900/0x900 [ 748.730860] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 748.735942] ? ___ratelimit+0x3b9/0x672 [ 748.739897] ? idr_get_free+0xf70/0xf70 [ 748.743854] ? kasan_check_read+0x11/0x20 [ 748.747980] ? do_raw_spin_unlock+0xa7/0x330 [ 748.752376] oom_kill_process.cold.27+0x10/0x903 [ 748.757121] ? zap_class+0x640/0x640 [ 748.760814] ? _raw_spin_unlock+0x2c/0x50 [ 748.764944] ? oom_badness+0xe6/0xaa0 [ 748.768726] ? oom_evaluate_task+0x540/0x540 [ 748.773124] ? find_held_lock+0x36/0x1c0 [ 748.777168] ? out_of_memory+0x974/0x1430 [ 748.781306] ? lock_downgrade+0x900/0x900 [ 748.785455] ? check_preemption_disabled+0x48/0x280 [ 748.790454] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 748.795369] ? kasan_check_read+0x11/0x20 [ 748.799494] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 748.804751] ? rcu_softirq_qs+0x20/0x20 [ 748.808711] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 748.813710] ? oom_evaluate_task+0x302/0x540 [ 748.818107] out_of_memory+0xa84/0x1430 [ 748.822070] ? oom_killer_disable+0x3a0/0x3a0 [ 748.826581] ? __alloc_pages_slowpath+0xf5c/0x2de0 [ 748.831623] ? __ww_mutex_check_waiters+0x160/0x160 [ 748.836629] __alloc_pages_slowpath+0x232c/0x2de0 [ 748.841469] ? warn_alloc+0x120/0x120 [ 748.845251] ? mark_held_locks+0x130/0x130 [ 748.849470] ? print_usage_bug+0xc0/0xc0 [ 748.853514] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 748.859034] ? __perf_event_task_sched_in+0x2a9/0xb60 [ 748.864210] ? find_held_lock+0x36/0x1c0 [ 748.868257] ? mark_held_locks+0xc7/0x130 [ 748.872389] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 748.877907] ? should_fail+0x22d/0xd01 [ 748.881775] ? print_usage_bug+0xc0/0xc0 [ 748.885819] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 748.890907] ? kasan_check_read+0x11/0x20 [ 748.895038] ? zap_class+0x640/0x640 [ 748.898739] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 748.904264] ? __lock_is_held+0xb5/0x140 [ 748.908368] ? i915_gem_execbuffer2_ioctl+0x920/0xb30 [ 748.913561] ? lock_release+0xa00/0xa00 [ 748.917526] ? perf_trace_sched_process_exec+0x860/0x860 [ 748.922963] ? __might_sleep+0x95/0x190 [ 748.926920] __alloc_pages_nodemask+0xad8/0xea0 [ 748.931579] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 748.936319] ? __alloc_pages_slowpath+0x2de0/0x2de0 [ 748.941317] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 748.946058] ? __lock_acquire+0x62f/0x4c20 [ 748.950277] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 748.955017] ? mark_held_locks+0x130/0x130 [ 748.959398] ? mark_held_locks+0x130/0x130 [ 748.963621] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 748.969158] alloc_pages_vma+0x13d/0x690 [ 748.973219] __handle_mm_fault+0x27f8/0x5be0 [ 748.977614] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 748.982441] ? find_held_lock+0x36/0x1c0 [ 748.986493] ? zap_class+0x640/0x640 [ 748.990186] ? zap_class+0x640/0x640 [ 748.993881] ? find_held_lock+0x36/0x1c0 [ 748.997928] ? handle_mm_fault+0x42a/0xc70 [ 749.002146] ? lock_downgrade+0x900/0x900 [ 749.006276] ? check_preemption_disabled+0x48/0x280 [ 749.011275] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 749.016187] ? kasan_check_read+0x11/0x20 [ 749.020315] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 749.025579] ? rcu_softirq_qs+0x20/0x20 [ 749.029535] ? trace_hardirqs_off_caller+0x310/0x310 [ 749.034625] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 749.040147] ? check_preemption_disabled+0x48/0x280 [ 749.045149] handle_mm_fault+0x54f/0xc70 [ 749.049191] ? __handle_mm_fault+0x5be0/0x5be0 [ 749.053757] ? find_vma+0x34/0x190 [ 749.057285] __do_page_fault+0x5e8/0xe60 [ 749.061329] ? trace_hardirqs_off+0xb8/0x310 [ 749.065725] do_page_fault+0xf2/0x7e0 [ 749.069508] ? vmalloc_sync_all+0x30/0x30 [ 749.073640] ? error_entry+0x70/0xd0 [ 749.077347] ? trace_hardirqs_off_caller+0xbb/0x310 [ 749.082357] ? trace_hardirqs_on_caller+0xc0/0x310 [ 749.087266] ? syscall_return_slowpath+0x5e0/0x5e0 [ 749.092176] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 749.096999] ? trace_hardirqs_on_caller+0x310/0x310 [ 749.101997] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 749.107448] ? prepare_exit_to_usermode+0x291/0x3b0 [ 749.112449] ? page_fault+0x8/0x30 [ 749.115974] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 749.120799] ? page_fault+0x8/0x30 [ 749.124318] page_fault+0x1e/0x30 [ 749.127750] RIP: 0033:0x7fbb4c4b3c0e [ 749.131454] Code: Bad RIP value. [ 749.134798] RSP: 002b:00007ffc410e1180 EFLAGS: 00010246 [ 749.140142] RAX: 0000000000000000 RBX: 00007fbb4a2ebf10 RCX: 0000000000000002 [ 749.147390] RDX: 0000000000022b70 RSI: 0000000000022b80 RDI: 00007fbb4a2ec000 [ 749.154641] RBP: 00000000009c0eb0 R08: 0000000000000000 R09: 00000000009c1116 [ 749.161894] R10: 0000000000000001 R11: 0000000000000100 R12: 0000000000000001 [ 749.169142] R13: 0000000000000064 R14: 00000000009c1320 R15: 00000000009c10e6 [ 749.199756] Mem-Info: [ 749.203810] active_anon:1368362 inactive_anon:229 isolated_anon:0 [ 749.203810] active_file:35 inactive_file:80 isolated_file:29 [ 749.203810] unevictable:0 dirty:0 writeback:0 unstable:0 [ 749.203810] slab_reclaimable:14095 slab_unreclaimable:109550 [ 749.203810] mapped:49208 shmem:290 pagetables:9199 bounce:0 [ 749.203810] free:24619 free_pcp:79 free_cma:0 [ 749.242165] Node 0 active_anon:5474848kB inactive_anon:916kB active_file:140kB inactive_file:320kB unevictable:0kB isolated(anon):0kB isolated(file):116kB mapped:196932kB dirty:0kB writeback:0kB shmem:1160kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 428032kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 749.270245] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 749.296468] lowmem_reserve[]: 0 2818 6321 6321 [ 749.309122] Node 0 DMA32 free:43884kB min:30052kB low:37564kB high:45076kB active_anon:2798344kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888780kB mlocked:0kB kernel_stack:3840kB pagetables:8816kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 749.344663] lowmem_reserve[]: 0 0 3503 3503 [ 749.349036] Node 0 Normal free:36972kB min:37364kB low:46704kB high:56044kB active_anon:2676112kB inactive_anon:916kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:4718592kB managed:3587816kB mlocked:0kB kernel_stack:17152kB pagetables:27980kB bounce:0kB free_pcp:560kB local_pcp:108kB free_cma:0kB [ 749.383614] lowmem_reserve[]: 0 0 0 0 [ 749.387527] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 749.405650] Node 0 DMA32: 607*4kB (UME) 213*8kB (UME) 71*16kB (UME) 27*32kB (UM) 6*64kB (U) 0*128kB 2*256kB (ME) 0*512kB 2*1024kB (UE) 1*2048kB (E) 8*4096kB (M) = 43892kB [ 749.421682] Node 0 Normal: 782*4kB (UMEH) 1492*8kB (UMEH) 691*16kB (UMEH) 43*32kB (UME) 3*64kB (UME) 3*128kB (U) 35*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37032kB [ 749.437256] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 749.446106] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 749.456112] 409 total pagecache pages [ 749.459928] 0 pages in swap cache [ 749.525658] Swap cache stats: add 0, delete 0, find 0/0 [ 749.534089] Free swap = 0kB [ 749.537114] Total swap = 0kB [ 749.540157] 1965979 pages RAM [ 749.543255] 0 pages HighMem/MovableOnly [ 749.547206] 342853 pages reserved [ 749.550862] 0 pages cma reserved [ 749.554233] Out of memory: Kill process 9888 (syz-executor2) score 1006 or sacrifice child [ 749.562735] Killed process 9888 (syz-executor2) total-vm:70736kB, anon-rss:12468kB, file-rss:32768kB, shmem-rss:0kB [ 749.802181] blkid invoked oom-killer: gfp_mask=0x6280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=-1000 [ 749.838979] blkid cpuset=/ mems_allowed=0 [ 749.851543] CPU: 1 PID: 10898 Comm: blkid Not tainted 4.20.0-rc7+ #160 [ 749.858246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 749.867603] Call Trace: [ 749.870207] dump_stack+0x244/0x39d [ 749.873849] ? dump_stack_print_info.cold.1+0x20/0x20 [ 749.879050] ? mark_held_locks+0x130/0x130 [ 749.883291] ? mark_held_locks+0x130/0x130 [ 749.887539] dump_header+0x27b/0xf72 [ 749.891292] ? pagefault_out_of_memory+0x197/0x197 [ 749.896233] ? mark_held_locks+0x130/0x130 [ 749.900477] ? __lock_acquire+0x62f/0x4c20 [ 749.904723] ? percpu_ref_get_many+0x240/0x240 [ 749.909318] ? print_usage_bug+0xc0/0xc0 [ 749.913396] ? zap_class+0x640/0x640 [ 749.917128] ? print_usage_bug+0xc0/0xc0 [ 749.921227] ? print_usage_bug+0xc0/0xc0 [ 749.925295] ? zap_class+0x640/0x640 [ 749.929019] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 749.934565] ? find_held_lock+0x36/0x1c0 [ 749.938661] ? mark_held_locks+0xc7/0x130 [ 749.942820] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 749.947929] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 749.953038] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 749.957627] ? trace_hardirqs_on+0xbd/0x310 [ 749.961954] ? kasan_check_read+0x11/0x20 [ 749.966113] ? ___ratelimit+0x3b4/0x672 [ 749.970122] ? trace_hardirqs_off_caller+0x310/0x310 [ 749.975229] ? trace_hardirqs_on+0x310/0x310 [ 749.979644] ? lock_downgrade+0x900/0x900 [ 749.983805] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 749.989005] ? ___ratelimit+0x3b9/0x672 [ 749.992986] ? idr_get_free+0xf70/0xf70 [ 749.996972] ? kasan_check_read+0x11/0x20 [ 750.001133] ? do_raw_spin_unlock+0xa7/0x330 [ 750.005562] oom_kill_process.cold.27+0x10/0x903 [ 750.010285] syz-executor2 (9930) used greatest stack depth: 1768 bytes left [ 750.010340] ? zap_class+0x640/0x640 [ 750.021145] ? _raw_spin_unlock+0x2c/0x50 [ 750.025298] ? oom_badness+0xe6/0xaa0 [ 750.029130] ? oom_evaluate_task+0x540/0x540 [ 750.033540] ? find_held_lock+0x36/0x1c0 [ 750.037593] ? out_of_memory+0x974/0x1430 [ 750.041746] ? lock_downgrade+0x900/0x900 [ 750.045878] ? check_preemption_disabled+0x48/0x280 [ 750.050877] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 750.055796] ? kasan_check_read+0x11/0x20 [ 750.059924] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 750.065181] ? rcu_softirq_qs+0x20/0x20 [ 750.069137] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 750.074133] ? oom_evaluate_task+0x302/0x540 [ 750.078525] out_of_memory+0xa84/0x1430 [ 750.082485] ? oom_killer_disable+0x3a0/0x3a0 [ 750.086964] ? __alloc_pages_slowpath+0xf5c/0x2de0 [ 750.091879] ? __ww_mutex_check_waiters+0x160/0x160 [ 750.096883] __alloc_pages_slowpath+0x232c/0x2de0 [ 750.101716] ? perf_log_itrace_start+0x530/0x530 [ 750.106462] ? warn_alloc+0x120/0x120 [ 750.110244] ? mark_held_locks+0x130/0x130 [ 750.114462] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 750.119993] ? zap_class+0x640/0x640 [ 750.123701] ? print_usage_bug+0xc0/0xc0 [ 750.127746] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 750.133272] ? __perf_event_task_sched_in+0x2a9/0xb60 [ 750.138448] ? __lru_cache_add+0x2ff/0x4e0 [ 750.142667] ? find_held_lock+0x36/0x1c0 [ 750.146716] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 750.152238] ? should_fail+0x22d/0xd01 [ 750.156108] ? print_usage_bug+0xc0/0xc0 [ 750.160152] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 750.165234] ? zap_class+0x640/0x640 [ 750.168935] ? trace_hardirqs_on+0xbd/0x310 [ 750.173237] ? kasan_check_read+0x11/0x20 [ 750.177371] ? finish_task_switch+0x1f4/0x910 [ 750.181850] ? trace_hardirqs_off_caller+0x310/0x310 [ 750.186940] ? __lock_is_held+0xb5/0x140 [ 750.191004] ? lock_release+0xa00/0xa00 [ 750.194963] ? perf_trace_sched_process_exec+0x860/0x860 [ 750.200582] ? __might_sleep+0x95/0x190 [ 750.204545] __alloc_pages_nodemask+0xad8/0xea0 [ 750.209198] ? __alloc_pages_slowpath+0x2de0/0x2de0 [ 750.214218] ? anon_vma_interval_tree_remove+0x8cd/0x13c0 [ 750.219745] ? __lock_acquire+0x62f/0x4c20 [ 750.223967] ? __handle_mm_fault+0x2daf/0x5be0 [ 750.228533] ? mark_held_locks+0x130/0x130 [ 750.232751] ? mark_held_locks+0x130/0x130 [ 750.236970] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 750.242583] alloc_pages_vma+0x13d/0x690 [ 750.246635] __handle_mm_fault+0x27f8/0x5be0 [ 750.251044] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 750.255873] ? find_held_lock+0x36/0x1c0 [ 750.259922] ? zap_class+0x640/0x640 [ 750.263619] ? zap_class+0x640/0x640 [ 750.267315] ? find_held_lock+0x36/0x1c0 [ 750.271362] ? handle_mm_fault+0x42a/0xc70 [ 750.275585] ? lock_downgrade+0x900/0x900 [ 750.279716] ? check_preemption_disabled+0x48/0x280 [ 750.284716] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 750.289627] ? kasan_check_read+0x11/0x20 [ 750.293755] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 750.299029] ? rcu_softirq_qs+0x20/0x20 [ 750.302988] ? trace_hardirqs_off_caller+0x310/0x310 [ 750.308076] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 750.313609] ? check_preemption_disabled+0x48/0x280 [ 750.318614] handle_mm_fault+0x54f/0xc70 [ 750.322661] ? __handle_mm_fault+0x5be0/0x5be0 [ 750.327229] ? find_vma+0x34/0x190 [ 750.330753] __do_page_fault+0x5e8/0xe60 [ 750.334796] ? trace_hardirqs_off+0xb8/0x310 [ 750.339189] do_page_fault+0xf2/0x7e0 [ 750.342975] ? vmalloc_sync_all+0x30/0x30 [ 750.347108] ? error_entry+0x70/0xd0 [ 750.350806] ? trace_hardirqs_off_caller+0xbb/0x310 [ 750.355803] ? trace_hardirqs_on_caller+0xc0/0x310 [ 750.360719] ? syscall_return_slowpath+0x5e0/0x5e0 [ 750.365645] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 750.370471] ? trace_hardirqs_on_caller+0x310/0x310 [ 750.375466] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 750.380901] ? prepare_exit_to_usermode+0x291/0x3b0 [ 750.385899] ? page_fault+0x8/0x30 [ 750.389420] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 750.394244] ? page_fault+0x8/0x30 [ 750.397768] page_fault+0x1e/0x30 [ 750.401200] RIP: 0033:0x7f0b761abc0e [ 750.404905] Code: Bad RIP value. [ 750.408246] RSP: 002b:00007fff83113150 EFLAGS: 00010246 [ 750.413594] RAX: 0000000000000000 RBX: 00007f0b73ee3f10 RCX: 0000000000000002 [ 750.420848] RDX: 0000000000021b70 RSI: 0000000000021b80 RDI: 00007f0b73ee4000 [ 750.428102] RBP: 000000000183aeb0 R08: 0000000000000000 R09: 000000000183b116 [ 750.435349] R10: 0000000000000001 R11: 0000000000000100 R12: 0000000000000001 [ 750.442615] R13: 0000000000000064 R14: 000000000183b320 R15: 000000000183b0e6 [ 750.472628] Mem-Info: [ 750.475114] active_anon:1368726 inactive_anon:229 isolated_anon:0 [ 750.475114] active_file:21 inactive_file:46 isolated_file:6 [ 750.475114] unevictable:0 dirty:0 writeback:0 unstable:0 [ 750.475114] slab_reclaimable:14093 slab_unreclaimable:109260 [ 750.475114] mapped:49161 shmem:290 pagetables:9153 bounce:0 [ 750.475114] free:24397 free_pcp:115 free_cma:0 [ 750.515757] Node 0 active_anon:5474920kB inactive_anon:916kB active_file:136kB inactive_file:408kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:196752kB dirty:0kB writeback:0kB shmem:1160kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 415744kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 750.550272] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 750.576518] lowmem_reserve[]: 0 2818 6321 6321 [ 750.599931] Node 0 DMA32 free:43940kB min:30052kB low:37564kB high:45076kB active_anon:2798336kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888780kB mlocked:0kB kernel_stack:3840kB pagetables:8768kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 750.662564] lowmem_reserve[]: 0 0 3503 3503 [ 750.666941] Node 0 Normal free:36988kB min:37364kB low:46704kB high:56044kB active_anon:2677352kB inactive_anon:916kB active_file:184kB inactive_file:300kB unevictable:0kB writepending:12kB present:4718592kB managed:3587816kB mlocked:0kB kernel_stack:17024kB pagetables:27736kB bounce:0kB free_pcp:468kB local_pcp:0kB free_cma:0kB [ 750.699791] lowmem_reserve[]: 0 0 0 0 [ 750.703682] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 750.740065] Node 0 DMA32: 607*4kB (UME) 217*8kB (UME) 72*16kB (UME) 27*32kB (UM) 6*64kB (U) 0*128kB 2*256kB (ME) 0*512kB 2*1024kB (UE) 1*2048kB (E) 8*4096kB (M) = 43940kB [ 750.770020] Node 0 Normal: 852*4kB (UMEH) 1557*8kB (UMEH) 708*16kB (UMEH) 45*32kB (UE) 3*64kB (UME) 4*128kB (UM) 32*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37528kB [ 750.814010] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 750.822956] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 750.831565] 427 total pagecache pages [ 750.835362] 0 pages in swap cache [ 750.838792] Swap cache stats: add 0, delete 0, find 0/0 [ 750.845487] Free swap = 0kB [ 750.848522] Total swap = 0kB [ 750.858901] 1965979 pages RAM [ 750.863527] 0 pages HighMem/MovableOnly [ 750.867507] 342853 pages reserved [ 750.872907] 0 pages cma reserved [ 750.876283] Out of memory: Kill process 11187 (syz-executor1) score 1005 or sacrifice child [ 750.886665] Killed process 11187 (syz-executor1) total-vm:70604kB, anon-rss:6312kB, file-rss:32640kB, shmem-rss:0kB [ 750.983943] blkid invoked oom-killer: gfp_mask=0x6280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=-1000 [ 751.015840] blkid cpuset=/ mems_allowed=0 [ 751.028093] CPU: 1 PID: 11264 Comm: blkid Not tainted 4.20.0-rc7+ #160 [ 751.034778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 751.044126] Call Trace: [ 751.046701] dump_stack+0x244/0x39d [ 751.050315] ? dump_stack_print_info.cold.1+0x20/0x20 [ 751.055494] ? mark_held_locks+0x130/0x130 [ 751.059711] ? mark_held_locks+0x130/0x130 [ 751.063931] dump_header+0x27b/0xf72 [ 751.067636] ? pagefault_out_of_memory+0x197/0x197 [ 751.072548] ? mark_held_locks+0x130/0x130 [ 751.076765] ? __lock_acquire+0x62f/0x4c20 [ 751.080985] ? percpu_ref_get_many+0x240/0x240 [ 751.085549] ? print_usage_bug+0xc0/0xc0 [ 751.089600] ? zap_class+0x640/0x640 [ 751.093299] ? print_usage_bug+0xc0/0xc0 [ 751.097339] ? print_usage_bug+0xc0/0xc0 [ 751.101383] ? zap_class+0x640/0x640 [ 751.105080] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 751.110608] ? find_held_lock+0x36/0x1c0 [ 751.114657] ? mark_held_locks+0xc7/0x130 [ 751.118787] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 751.123871] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 751.128957] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 751.133522] ? trace_hardirqs_on+0xbd/0x310 [ 751.137823] ? kasan_check_read+0x11/0x20 [ 751.141951] ? ___ratelimit+0x3b4/0x672 [ 751.145906] ? trace_hardirqs_off_caller+0x310/0x310 [ 751.151004] ? trace_hardirqs_on+0x310/0x310 [ 751.155393] ? lock_downgrade+0x900/0x900 [ 751.159524] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 751.164616] ? ___ratelimit+0x3b9/0x672 [ 751.168592] ? idr_get_free+0xf70/0xf70 [ 751.172554] ? kasan_check_read+0x11/0x20 [ 751.176687] ? do_raw_spin_unlock+0xa7/0x330 [ 751.181080] oom_kill_process.cold.27+0x10/0x903 [ 751.185823] ? zap_class+0x640/0x640 [ 751.189515] ? _raw_spin_unlock+0x2c/0x50 [ 751.193645] ? oom_badness+0xe6/0xaa0 [ 751.197429] ? oom_evaluate_task+0x540/0x540 [ 751.201823] ? find_held_lock+0x36/0x1c0 [ 751.205871] ? out_of_memory+0x974/0x1430 [ 751.210012] ? lock_downgrade+0x900/0x900 [ 751.214145] ? check_preemption_disabled+0x48/0x280 [ 751.219156] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 751.224100] ? kasan_check_read+0x11/0x20 [ 751.228259] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 751.233543] ? rcu_softirq_qs+0x20/0x20 [ 751.237504] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 751.242499] ? oom_evaluate_task+0x302/0x540 [ 751.246889] out_of_memory+0xa84/0x1430 [ 751.250850] ? oom_killer_disable+0x3a0/0x3a0 [ 751.255326] ? __alloc_pages_slowpath+0xf5c/0x2de0 [ 751.260254] ? __ww_mutex_check_waiters+0x160/0x160 [ 751.265279] __alloc_pages_slowpath+0x232c/0x2de0 [ 751.270143] ? warn_alloc+0x120/0x120 [ 751.273926] ? mark_held_locks+0x130/0x130 [ 751.278141] ? reacquire_held_locks+0x137/0x510 [ 751.282792] ? alloc_set_pte+0x1447/0x1f40 [ 751.287008] ? find_held_lock+0x13f/0x1c0 [ 751.291144] ? filemap_map_pages+0xd6b/0x1a20 [ 751.295640] ? lock_downgrade+0x900/0x900 [ 751.299771] ? check_preemption_disabled+0x48/0x280 [ 751.304771] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 751.309680] ? kasan_check_read+0x11/0x20 [ 751.313810] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 751.319329] ? should_fail+0x22d/0xd01 [ 751.323203] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 751.328287] ? zap_class+0x640/0x640 [ 751.331992] ? __lock_is_held+0xb5/0x140 [ 751.336041] ? lock_release+0xa00/0xa00 [ 751.340010] ? perf_trace_sched_process_exec+0x860/0x860 [ 751.345445] ? lock_downgrade+0x900/0x900 [ 751.349584] ? __might_sleep+0x95/0x190 [ 751.353548] __alloc_pages_nodemask+0xad8/0xea0 [ 751.358200] ? __alloc_pages_slowpath+0x2de0/0x2de0 [ 751.363204] ? __lock_acquire+0x62f/0x4c20 [ 751.367424] ? __handle_mm_fault+0x4729/0x5be0 [ 751.371992] ? mark_held_locks+0x130/0x130 [ 751.376222] ? mark_held_locks+0x130/0x130 [ 751.380454] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 751.385973] alloc_pages_vma+0x13d/0x690 [ 751.390027] __handle_mm_fault+0x27f8/0x5be0 [ 751.394424] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 751.399249] ? find_held_lock+0x36/0x1c0 [ 751.403300] ? zap_class+0x640/0x640 [ 751.406992] ? zap_class+0x640/0x640 [ 751.410692] ? find_held_lock+0x36/0x1c0 [ 751.414739] ? handle_mm_fault+0x42a/0xc70 [ 751.418955] ? lock_downgrade+0x900/0x900 [ 751.423085] ? check_preemption_disabled+0x48/0x280 [ 751.428088] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 751.433003] ? kasan_check_read+0x11/0x20 [ 751.437132] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 751.442389] ? rcu_softirq_qs+0x20/0x20 [ 751.446344] ? trace_hardirqs_off_caller+0x310/0x310 [ 751.451429] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 751.456948] ? check_preemption_disabled+0x48/0x280 [ 751.461947] handle_mm_fault+0x54f/0xc70 [ 751.465993] ? __handle_mm_fault+0x5be0/0x5be0 [ 751.470558] ? find_vma+0x34/0x190 [ 751.474093] __do_page_fault+0x5e8/0xe60 [ 751.478141] ? trace_hardirqs_off+0xb8/0x310 [ 751.482538] do_page_fault+0xf2/0x7e0 [ 751.486320] ? vmalloc_sync_all+0x30/0x30 [ 751.490449] ? error_entry+0x70/0xd0 [ 751.494146] ? trace_hardirqs_off_caller+0xbb/0x310 [ 751.499145] ? trace_hardirqs_on_caller+0xc0/0x310 [ 751.504056] ? syscall_return_slowpath+0x5e0/0x5e0 [ 751.508965] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 751.513791] ? trace_hardirqs_on_caller+0x310/0x310 [ 751.518789] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 751.524222] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 751.529754] ? prepare_exit_to_usermode+0x291/0x3b0 [ 751.534756] ? page_fault+0x8/0x30 [ 751.538279] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 751.543109] ? page_fault+0x8/0x30 [ 751.546629] page_fault+0x1e/0x30 [ 751.550061] RIP: 0033:0x7ff92e12ec0e [ 751.553767] Code: Bad RIP value. [ 751.557111] RSP: 002b:00007ffe6519e750 EFLAGS: 00010246 [ 751.562454] RAX: 0000000000000000 RBX: 00007ff92d691f10 RCX: 0000000000000002 [ 751.569703] RDX: 000000000000ac20 RSI: 000000000000ac20 RDI: 00007ff92d692000 [ 751.576952] RBP: 00000000011b0eb0 R08: 0000000000000000 R09: 00000000011b1116 [ 751.584201] R10: 0000000000000001 R11: 0000000000000100 R12: 0000000000000001 [ 751.591454] R13: 0000000000000064 R14: 00000000011b1320 R15: 00000000011b10e6 [ 751.647680] Mem-Info: [ 751.650260] active_anon:1369109 inactive_anon:229 isolated_anon:0 [ 751.650260] active_file:49 inactive_file:44 isolated_file:21 [ 751.650260] unevictable:0 dirty:3 writeback:0 unstable:0 [ 751.650260] slab_reclaimable:14066 slab_unreclaimable:109180 [ 751.650260] mapped:49224 shmem:290 pagetables:9100 bounce:0 [ 751.650260] free:24292 free_pcp:70 free_cma:0 [ 751.685736] Node 0 active_anon:5476444kB inactive_anon:916kB active_file:56kB inactive_file:264kB unevictable:0kB isolated(anon):0kB isolated(file):104kB mapped:196912kB dirty:0kB writeback:0kB shmem:1160kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 409600kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 751.788451] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 751.816186] lowmem_reserve[]: 0 2818 6321 6321 [ 751.823860] Node 0 DMA32 free:43940kB min:30052kB low:37564kB high:45076kB active_anon:2798336kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888780kB mlocked:0kB kernel_stack:3840kB pagetables:8768kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 752.665752] lowmem_reserve[]: 0 0 3503 3503 [ 752.704975] Node 0 Normal free:36652kB min:37364kB low:46704kB high:56044kB active_anon:2678192kB inactive_anon:916kB active_file:60kB inactive_file:136kB unevictable:0kB writepending:0kB present:4718592kB managed:3587816kB mlocked:0kB kernel_stack:16992kB pagetables:27644kB bounce:0kB free_pcp:8kB local_pcp:4kB free_cma:0kB [ 752.746229] lowmem_reserve[]: 0 0 0 0 [ 752.751893] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 752.774120] Node 0 DMA32: 607*4kB (UME) 217*8kB (UME) 72*16kB (UME) 27*32kB (UM) 6*64kB (U) 0*128kB 2*256kB (ME) 0*512kB 2*1024kB (UE) 1*2048kB (E) 8*4096kB (M) = 43940kB [ 752.792132] Node 0 Normal: 901*4kB (UMEH) 1549*8kB (UMEH) 706*16kB (UMEH) 46*32kB (UME) 3*64kB (UME) 4*128kB (UM) 30*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 37148kB [ 752.825637] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 752.835060] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 752.843676] 338 total pagecache pages [ 752.847471] 0 pages in swap cache [ 752.855294] Swap cache stats: add 0, delete 0, find 0/0 [ 752.868461] Free swap = 0kB [ 752.875859] Total swap = 0kB [ 752.878885] 1965979 pages RAM [ 752.885281] 0 pages HighMem/MovableOnly [ 752.889260] 342853 pages reserved [ 752.896426] 0 pages cma reserved [ 752.899807] Out of memory: Kill process 9674 (syz-executor3) score 1005 or sacrifice child [ 752.910121] Killed process 9674 (syz-executor3) total-vm:70472kB, anon-rss:4264kB, file-rss:32768kB, shmem-rss:0kB [ 752.950907] oom_reaper: reaped process 9674 (syz-executor3), now anon-rss:0kB, file-rss:32768kB, shmem-rss:0kB [ 753.032342] blkid invoked oom-killer: gfp_mask=0x6280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=-1000 [ 753.071495] blkid cpuset=/ mems_allowed=0 [ 753.075889] CPU: 1 PID: 11165 Comm: blkid Not tainted 4.20.0-rc7+ #160 [ 753.082558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 753.091946] Call Trace: [ 753.094551] dump_stack+0x244/0x39d [ 753.098202] ? dump_stack_print_info.cold.1+0x20/0x20 [ 753.103417] ? mark_held_locks+0x130/0x130 [ 753.107673] ? mark_held_locks+0x130/0x130 [ 753.111923] dump_header+0x27b/0xf72 [ 753.115657] ? pagefault_out_of_memory+0x197/0x197 [ 753.120611] ? mark_held_locks+0x130/0x130 [ 753.124857] ? __lock_acquire+0x62f/0x4c20 [ 753.129109] ? percpu_ref_get_many+0x240/0x240 [ 753.133707] ? print_usage_bug+0xc0/0xc0 [ 753.137780] ? zap_class+0x640/0x640 [ 753.141507] ? print_usage_bug+0xc0/0xc0 [ 753.145572] ? print_usage_bug+0xc0/0xc0 [ 753.149648] ? zap_class+0x640/0x640 [ 753.153399] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 753.158948] ? find_held_lock+0x36/0x1c0 [ 753.163044] ? mark_held_locks+0xc7/0x130 [ 753.167201] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 753.172316] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 753.177426] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 753.182019] ? trace_hardirqs_on+0xbd/0x310 [ 753.186348] ? kasan_check_read+0x11/0x20 [ 753.190505] ? ___ratelimit+0x3b4/0x672 [ 753.194501] ? trace_hardirqs_off_caller+0x310/0x310 [ 753.199616] ? trace_hardirqs_on+0x310/0x310 [ 753.204036] ? lock_downgrade+0x900/0x900 [ 753.208194] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 753.213307] ? ___ratelimit+0x3b9/0x672 [ 753.217290] ? idr_get_free+0xf70/0xf70 [ 753.221271] ? kasan_check_read+0x11/0x20 [ 753.225423] ? do_raw_spin_unlock+0xa7/0x330 [ 753.229849] oom_kill_process.cold.27+0x10/0x903 [ 753.234621] ? zap_class+0x640/0x640 [ 753.238358] ? _raw_spin_unlock+0x2c/0x50 [ 753.242508] ? oom_badness+0xe6/0xaa0 [ 753.246317] ? oom_evaluate_task+0x540/0x540 [ 753.250737] ? find_held_lock+0x36/0x1c0 [ 753.254816] ? out_of_memory+0x974/0x1430 [ 753.258974] ? lock_downgrade+0x900/0x900 [ 753.263140] ? check_preemption_disabled+0x48/0x280 [ 753.268165] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 753.273110] ? kasan_check_read+0x11/0x20 [ 753.277267] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 753.282550] ? rcu_softirq_qs+0x20/0x20 [ 753.286533] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 753.291541] ? oom_evaluate_task+0x302/0x540 [ 753.295959] out_of_memory+0xa84/0x1430 [ 753.299918] ? oom_killer_disable+0x3a0/0x3a0 [ 753.304424] ? __alloc_pages_slowpath+0xf5c/0x2de0 [ 753.309360] ? __ww_mutex_check_waiters+0x160/0x160 [ 753.314386] __alloc_pages_slowpath+0x232c/0x2de0 [ 753.319242] ? warn_alloc+0x120/0x120 [ 753.323039] ? mark_held_locks+0x130/0x130 [ 753.327293] ? mark_held_locks+0x130/0x130 [ 753.331537] ? perf_iterate_sb+0x1b0/0xc60 [ 753.335780] ? update_load_avg+0x2470/0x2470 [ 753.340196] ? perf_log_itrace_start+0x530/0x530 [ 753.344958] ? perf_pmu_register+0xe70/0xe70 [ 753.349375] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 753.354936] ? __perf_event_task_sched_out+0x33a/0x1bf0 [ 753.360314] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 753.365879] ? should_fail+0x22d/0xd01 [ 753.369767] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 753.374870] ? zap_class+0x640/0x640 [ 753.378602] ? print_usage_bug+0xc0/0xc0 [ 753.382685] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 753.388224] ? __perf_event_task_sched_in+0x2a9/0xb60 [ 753.393435] ? lru_cache_add_file+0x20/0x20 [ 753.397787] ? __lock_is_held+0xb5/0x140 [ 753.401869] ? lock_release+0xa00/0xa00 [ 753.405852] ? perf_trace_sched_process_exec+0x860/0x860 [ 753.411333] ? __might_sleep+0x95/0x190 [ 753.415305] __alloc_pages_nodemask+0xad8/0xea0 [ 753.419957] ? _raw_spin_unlock_irq+0x60/0x80 [ 753.424483] ? __alloc_pages_slowpath+0x2de0/0x2de0 [ 753.429498] ? __switch_to_asm+0x34/0x70 [ 753.433545] ? __switch_to_asm+0x34/0x70 [ 753.437593] ? __switch_to_asm+0x40/0x70 [ 753.441658] ? __lock_acquire+0x62f/0x4c20 [ 753.445909] ? __schedule+0x8d7/0x21d0 [ 753.449811] ? mark_held_locks+0x130/0x130 [ 753.454053] ? mark_held_locks+0x130/0x130 [ 753.458286] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 753.463823] alloc_pages_vma+0x13d/0x690 [ 753.467901] __handle_mm_fault+0x27f8/0x5be0 [ 753.472355] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 753.477208] ? find_held_lock+0x36/0x1c0 [ 753.481307] ? zap_class+0x640/0x640 [ 753.485024] ? zap_class+0x640/0x640 [ 753.488755] ? find_held_lock+0x36/0x1c0 [ 753.492835] ? handle_mm_fault+0x42a/0xc70 [ 753.497077] ? lock_downgrade+0x900/0x900 [ 753.501269] ? check_preemption_disabled+0x48/0x280 [ 753.506291] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 753.511261] ? kasan_check_read+0x11/0x20 [ 753.515432] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 753.520717] ? rcu_softirq_qs+0x20/0x20 [ 753.524697] ? trace_hardirqs_off_caller+0x310/0x310 [ 753.529809] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 753.535356] ? check_preemption_disabled+0x48/0x280 [ 753.540389] handle_mm_fault+0x54f/0xc70 [ 753.544460] ? __handle_mm_fault+0x5be0/0x5be0 [ 753.549056] ? find_vma+0x34/0x190 [ 753.552621] __do_page_fault+0x5e8/0xe60 [ 753.556696] ? trace_hardirqs_off+0xb8/0x310 [ 753.561140] do_page_fault+0xf2/0x7e0 [ 753.564954] ? vmalloc_sync_all+0x30/0x30 [ 753.569122] ? error_entry+0x70/0xd0 [ 753.572851] ? trace_hardirqs_off_caller+0xbb/0x310 [ 753.577878] ? trace_hardirqs_on_caller+0xc0/0x310 [ 753.582814] ? syscall_return_slowpath+0x5e0/0x5e0 [ 753.587753] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 753.592613] ? trace_hardirqs_on_caller+0x310/0x310 [ 753.597636] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 753.603105] ? prepare_exit_to_usermode+0x291/0x3b0 [ 753.608130] ? page_fault+0x8/0x30 [ 753.611685] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 753.616635] ? page_fault+0x8/0x30 [ 753.620184] page_fault+0x1e/0x30 [ 753.623643] RIP: 0033:0x7f99d623cc0e [ 753.627370] Code: Bad RIP value. [ 753.630735] RSP: 002b:00007ffd110f07b0 EFLAGS: 00010246 [ 753.636105] RAX: 0000000000000000 RBX: 00007f99d517bf10 RCX: 0000000000000002 [ 753.643391] RDX: 0000000000014530 RSI: 0000000000014540 RDI: 00007f99d517c000 [ 753.650662] RBP: 0000000000927eb0 R08: 0000000000000000 R09: 0000000000928116 [ 753.657934] R10: 0000000000000001 R11: 0000000000000100 R12: 0000000000000001 [ 753.665222] R13: 0000000000000064 R14: 0000000000928320 R15: 00000000009280e6 [ 753.677240] Kernel panic - not syncing: corrupted stack end detected inside scheduler [ 753.685873] CPU: 0 PID: 9677 Comm: syz-executor3 Not tainted 4.20.0-rc7+ #160 [ 753.693151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 753.702520] Call Trace: [ 753.705116] dump_stack+0x244/0x39d [ 753.708764] ? dump_stack_print_info.cold.1+0x20/0x20 [ 753.710015] Mem-Info: [ 753.713970] panic+0x2ad/0x55c [ 753.716388] active_anon:1369048 inactive_anon:229 isolated_anon:0 [ 753.716388] active_file:43 inactive_file:29 isolated_file:36 [ 753.716388] unevictable:0 dirty:0 writeback:0 unstable:0 [ 753.716388] slab_reclaimable:14055 slab_unreclaimable:109172 [ 753.716388] mapped:49217 shmem:290 pagetables:9081 bounce:0 [ 753.716388] free:24306 free_pcp:116 free_cma:0 [ 753.719587] ? add_taint.cold.5+0x16/0x16 [ 753.756948] ? lock_downgrade+0x900/0x900 [ 753.761101] ? lock_downgrade+0x900/0x900 [ 753.765263] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 753.770806] ? check_preemption_disabled+0x48/0x280 [ 753.775833] ? check_preemption_disabled+0x3a/0x280 [ 753.777400] Node 0 active_anon:5476192kB inactive_anon:916kB active_file:60kB inactive_file:116kB unevictable:0kB isolated(anon):0kB isolated(file):144kB mapped:196668kB dirty:0kB writeback:0kB shmem:1160kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 405504kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 753.780862] __schedule+0x21c6/0x21d0 [ 753.780877] ? do_raw_spin_trylock+0x270/0x270 [ 753.780895] ? lock_pin_lock+0x350/0x350 [ 753.808756] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 753.812538] ? kthread_data+0x58/0xc0 [ 753.812559] ? __sched_text_start+0x8/0x8 [ 753.812584] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 753.817154] lowmem_reserve[]: 0 2818 6321 6321 [ 753.821208] ? try_to_wake_up+0x11c/0x1440 [ 753.821225] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 753.821255] ? lock_acquire+0x1ed/0x520 [ 753.847368] Node 0 DMA32 free:44020kB min:30052kB low:37564kB high:45076kB active_anon:2798336kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129332kB managed:2888780kB mlocked:0kB kernel_stack:3840kB pagetables:8688kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 753.851143] ? mem_cgroup_oom_control_write+0x100/0x100 [ 753.851160] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 753.851181] ? check_preemption_disabled+0x48/0x280 [ 753.855306] lowmem_reserve[]: 0 0 3503 3503 [ 753.860406] ? ___preempt_schedule_notrace+0x16/0x31 [ 753.860426] preempt_schedule_notrace+0x70/0x140 [ 753.860444] ___preempt_schedule_notrace+0x16/0x31 [ 753.865003] Node 0 Normal free:37296kB min:37364kB low:46704kB high:56044kB active_anon:2677656kB inactive_anon:916kB active_file:72kB inactive_file:108kB unevictable:0kB writepending:0kB present:4718592kB managed:3587816kB mlocked:0kB kernel_stack:16960kB pagetables:27636kB bounce:0kB free_pcp:664kB local_pcp:216kB free_cma:0kB [ 753.869232] rcu_is_watching+0x23/0x30 [ 753.874760] lowmem_reserve[]: 0 0 0 0 [ 753.878717] rcu_read_lock+0x43/0x70 [ 753.906909] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 753.912238] mem_cgroup_iter+0x208/0x1160 [ 753.912259] ? wake_up_process+0x10/0x20 [ 753.912290] ? mem_cgroup_nr_lru_pages+0x80/0x80 [ 753.917851] Node 0 DMA32: 609*4kB (UME) 222*8kB (UME) 74*16kB (UME) 27*32kB (UM) 6*64kB (U) 0*128kB 2*256kB (ME) 0*512kB 2*1024kB (UE) 1*2048kB (E) 8*4096kB (M) = 44020kB [ 753.922863] ? find_held_lock+0x36/0x1c0 [ 753.922886] ? __queue_work+0x671/0x1440 [ 753.922904] ? lock_downgrade+0x900/0x900 [ 753.927206] Node 0 Normal: 892*4kB (UEH) 1542*8kB (UMEH) 699*16kB (UEH) 45*32kB (UE) 3*64kB (UME) 3*128kB (U) 30*256kB (UM) 1*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 37296kB [ 753.932300] ? check_flush_dependency+0x410/0x410 [ 753.932322] ? kasan_check_read+0x11/0x20 [ 753.932338] ? do_raw_spin_unlock+0xa7/0x330 [ 753.937079] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 753.941987] ? do_raw_spin_trylock+0x270/0x270 [ 753.942006] ? ___preempt_schedule+0x16/0x18 [ 753.942026] ? _raw_spin_unlock+0x3f/0x50 [ 753.971436] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 753.975297] shrink_node+0x340/0x16b0 [ 753.979071] 359 total pagecache pages [ 753.982773] ? mem_cgroup_split_huge_fixup+0x1b0/0x1b0 [ 753.982811] ? shrink_node_memcg+0x18f0/0x18f0 [ 753.996337] 0 pages in swap cache [ 754.000441] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 754.000459] ? trace_hardirqs_on+0xbd/0x310 [ 754.000476] ? vmpressure+0x271/0x340 [ 754.004525] Swap cache stats: add 0, delete 0, find 0/0 [ 754.009273] ? do_raw_spin_trylock+0x270/0x270 [ 754.024624] Free swap = 0kB [ 754.028664] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 754.032733] Total swap = 0kB [ 754.036854] ? __cpuset_node_allowed+0x19b/0x660 [ 754.052388] 1965979 pages RAM [ 754.057205] ? cpuset_nodemask_valid_mems_allowed+0x90/0x90 [ 754.061350] 0 pages HighMem/MovableOnly [ 754.065733] ? vmpressure+0x1a2/0x340 [ 754.074570] 342853 pages reserved [ 754.079127] do_try_to_free_pages+0x3e7/0x1290 [ 754.083529] 0 pages cma reserved [ 754.087664] ? shrink_node+0x16b0/0x16b0 [ 754.096263] Out of memory: Kill process 9686 (syz-executor3) score 1005 or sacrifice child [ 754.100041] ? __lock_is_held+0xb5/0x140 [ 754.100069] try_to_free_pages+0x4d0/0xb90 [ 754.103938] Killed process 9686 (syz-executor3) total-vm:70340kB, anon-rss:4256kB, file-rss:32768kB, shmem-rss:0kB [ 754.109180] ? do_try_to_free_pages+0x1290/0x1290 [ 754.219844] ? kasan_check_read+0x11/0x20 [ 754.223975] ? psi_memstall_enter+0x24f/0x2c0 [ 754.228452] ? trace_hardirqs_off_caller+0x310/0x310 [ 754.233552] ? lock_pin_lock+0x350/0x350 [ 754.237635] ? _raw_spin_unlock_irq+0x60/0x80 [ 754.242113] ? psi_memstall_enter+0x24f/0x2c0 [ 754.246621] ? psi_memstall_tick+0x230/0x230 [ 754.251022] __alloc_pages_slowpath+0xa48/0x2de0 [ 754.255770] ? warn_alloc+0x120/0x120 [ 754.259556] ? zap_class+0x640/0x640 [ 754.263253] ? zap_class+0x640/0x640 [ 754.266950] ? print_usage_bug+0xc0/0xc0 [ 754.270990] ? zap_class+0x640/0x640 [ 754.274686] ? zap_class+0x640/0x640 [ 754.278381] ? check_preemption_disabled+0x48/0x280 [ 754.283377] ? check_preemption_disabled+0x48/0x280 [ 754.288379] ? __lock_is_held+0xb5/0x140 [ 754.292448] ? find_get_entry+0xa87/0x1120 [ 754.296664] ? lock_downgrade+0x900/0x900 [ 754.300793] ? check_preemption_disabled+0x48/0x280 [ 754.305793] ? __lock_is_held+0xb5/0x140 [ 754.309842] ? perf_trace_sched_process_exec+0x860/0x860 [ 754.315280] ? __might_sleep+0x95/0x190 [ 754.319239] __alloc_pages_nodemask+0xad8/0xea0 [ 754.323891] ? __alloc_pages_slowpath+0x2de0/0x2de0 [ 754.328894] ? find_held_lock+0x36/0x1c0 [ 754.332957] ? find_get_entry+0xa87/0x1120 [ 754.337171] ? lock_downgrade+0x900/0x900 [ 754.341303] ? check_preemption_disabled+0x48/0x280 [ 754.346301] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 754.351214] ? kasan_check_read+0x11/0x20 [ 754.355349] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 754.360873] alloc_pages_current+0x173/0x350 [ 754.365266] __page_cache_alloc+0x38c/0x5c0 [ 754.369567] ? find_get_entry+0xaae/0x1120 [ 754.373792] ? generic_perform_write+0x6a0/0x6a0 [ 754.378530] ? filemap_map_pages+0x1a20/0x1a20 [ 754.383093] pagecache_get_page+0x396/0xf00 [ 754.387398] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 754.392920] ? add_to_page_cache_lru+0xdb0/0xdb0 [ 754.397662] ? __lock_is_held+0xb5/0x140 [ 754.401705] ? zap_class+0x640/0x640 [ 754.405403] ? zap_class+0x640/0x640 [ 754.409103] ? __find_get_block+0x3be/0xf20 [ 754.413410] ? __lock_is_held+0xb5/0x140 [ 754.417455] ? __lock_is_held+0xb5/0x140 [ 754.421506] ? perf_trace_sched_process_exec+0x860/0x860 [ 754.426941] ? __might_sleep+0x95/0x190 [ 754.430897] ? __might_sleep+0x95/0x190 [ 754.434856] ext4_mb_load_buddy_gfp+0xddf/0x1e70 [ 754.439604] ? ext4_mb_good_group+0x730/0x730 [ 754.444085] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 754.449656] ? ext4_validate_block_bitmap+0x65b/0x10c0 [ 754.454924] ? lock_downgrade+0x900/0x900 [ 754.459055] ? ext4_has_free_clusters+0x670/0x670 [ 754.463881] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 754.469139] ? rcu_softirq_qs+0x20/0x20 [ 754.473101] ? zap_class+0x640/0x640 [ 754.476797] ? __lock_acquire+0x62f/0x4c20 [ 754.481017] ? workingset_activation+0x2cd/0x430 [ 754.485757] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 754.490756] ? ext4_get_group_desc+0x1c6/0x2c0 [ 754.495321] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 754.500841] ? ext4_read_block_bitmap_nowait+0x265/0x1f50 [ 754.506362] ? zap_class+0x640/0x640 [ 754.510092] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 754.515618] ? ext4_free_clusters_after_init+0xb20/0xb20 [ 754.521052] ? __lock_is_held+0xb5/0x140 [ 754.525097] ? zap_class+0x640/0x640 [ 754.528795] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 754.534318] ? check_preemption_disabled+0x48/0x280 [ 754.539320] ? __lock_is_held+0xb5/0x140 [ 754.543369] ext4_free_blocks+0xbce/0x34f0 [ 754.547603] ? ext4_mb_new_blocks+0x4840/0x4840 [ 754.552268] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 754.557191] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 754.562447] ? rcu_softirq_qs+0x20/0x20 [ 754.566400] ? rcu_softirq_qs+0x20/0x20 [ 754.570354] ? unwind_dump+0x190/0x190 [ 754.574229] ? is_bpf_text_address+0xd3/0x170 [ 754.578704] ? kernel_text_address+0x79/0xf0 [ 754.583095] ? __kernel_text_address+0xd/0x40 [ 754.587583] ? unwind_get_return_address+0x61/0xa0 [ 754.592502] ? __save_stack_trace+0x8d/0xf0 [ 754.596815] ? kasan_kmalloc+0xc7/0xe0 [ 754.600682] ? __kmalloc+0x15b/0x760 [ 754.604376] ? ext4_ext_remove_space+0x2715/0x5b50 [ 754.609285] ? ext4_ext_truncate+0x1cc/0x220 [ 754.613673] ? ext4_truncate+0xf5c/0x1650 [ 754.617798] ? ext4_evict_inode+0xa10/0x1ad0 [ 754.622184] ? evict+0x4b9/0x980 [ 754.625526] ? iput+0x679/0xa90 [ 754.628787] ? dentry_unlink_inode+0x461/0x5e0 [ 754.633353] ? __dentry_kill+0x44c/0x7a0 [ 754.637392] ? dentry_kill+0xc9/0x680 [ 754.641175] ? dput.part.25+0x660/0x860 [ 754.645128] ? dput+0x15/0x20 [ 754.648216] ? path_put+0x31/0x70 [ 754.651649] ? free_fs_struct+0x22/0x60 [ 754.655605] ? exit_fs+0xf3/0x130 [ 754.659052] ? do_exit+0xf52/0x26d0 [ 754.662658] ? do_group_exit+0x177/0x440 [ 754.666742] ? get_signal+0x8b0/0x1980 [ 754.670625] ? do_signal+0x9c/0x21c0 [ 754.674337] ? exit_to_usermode_loop+0x2e5/0x380 [ 754.679072] ? do_syscall_64+0x6be/0x820 [ 754.683146] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 754.688525] ? zap_class+0x640/0x640 [ 754.692229] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 754.697752] ? check_preemption_disabled+0x48/0x280 [ 754.702752] ? zap_class+0x640/0x640 [ 754.706449] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 754.711971] ? check_preemption_disabled+0x48/0x280 [ 754.716971] ? __lock_is_held+0xb5/0x140 [ 754.721023] ext4_ext_remove_space+0x2557/0x5b50 [ 754.725775] ? ext4_ext_index_trans_blocks+0x150/0x150 [ 754.731033] ? zap_class+0x640/0x640 [ 754.734728] ? perf_trace_sched_process_exec+0x860/0x860 [ 754.740178] ? ext4_journalled_invalidatepage+0x50/0x50 [ 754.745522] ? find_held_lock+0x36/0x1c0 [ 754.749589] ? ext4_es_remove_extent+0x14c/0x500 [ 754.754344] ? lock_downgrade+0x900/0x900 [ 754.758473] ? ext4_es_scan+0x960/0x960 [ 754.762434] ? kasan_check_read+0x11/0x20 [ 754.766613] ? do_raw_write_lock+0x14f/0x310 [ 754.771009] ? do_raw_write_trylock+0x270/0x270 [ 754.775662] ? _raw_write_unlock+0x2c/0x50 [ 754.779877] ? ext4_es_remove_extent+0x151/0x500 [ 754.784616] ? ext4_journal_check_start+0x18e/0x220 [ 754.789618] ? ext4_es_lookup_extent+0xde0/0xde0 [ 754.794360] ? down_write+0x8a/0x130 [ 754.798081] ? ext4_truncate+0xefc/0x1650 [ 754.802227] ext4_ext_truncate+0x1cc/0x220 [ 754.806471] ext4_truncate+0xf5c/0x1650 [ 754.810442] ? ext4_punch_hole+0x1220/0x1220 [ 754.814860] ? ext4_evict_inode+0x9b4/0x1ad0 [ 754.819288] ? ext4_expand_extra_isize+0x5b0/0x5b0 [ 754.824201] ? __might_sleep+0x95/0x190 [ 754.828342] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 754.833860] ? ext4_evict_inode+0x871/0x1ad0 [ 754.838248] ? ext4_journal_abort_handle.isra.5+0x260/0x260 [ 754.843946] ? rcu_read_lock_sched_held+0x14f/0x180 [ 754.848943] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 754.854464] ? __sb_start_write+0x1b2/0x370 [ 754.858767] ext4_evict_inode+0xa10/0x1ad0 [ 754.862986] ? ext4_da_write_begin+0x12c0/0x12c0 [ 754.867729] ? inode_wait_for_writeback+0x2f/0x40 [ 754.872554] ? lock_downgrade+0x900/0x900 [ 754.876689] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 754.882208] ? __inode_wait_for_writeback+0x2cf/0x380 [ 754.887384] ? kasan_check_read+0x11/0x20 [ 754.891528] ? do_raw_spin_unlock+0xa7/0x330 [ 754.895915] ? do_raw_spin_trylock+0x270/0x270 [ 754.900484] ? ext4_da_write_begin+0x12c0/0x12c0 [ 754.905220] evict+0x4b9/0x980 [ 754.908405] ? destroy_inode+0x200/0x200 [ 754.912447] ? iput+0x671/0xa90 [ 754.915709] ? lock_downgrade+0x900/0x900 [ 754.919842] ? kasan_check_read+0x11/0x20 [ 754.923974] ? do_raw_spin_trylock+0x270/0x270 [ 754.928589] iput+0x679/0xa90 [ 754.931693] ? inode_add_lru+0x2a0/0x2a0 [ 754.935741] ? fsnotify_destroy_marks+0x1d2/0x270 [ 754.940564] ? fsnotify_clear_marks_by_group+0x640/0x640 [ 754.946002] ? find_held_lock+0x36/0x1c0 [ 754.950052] dentry_unlink_inode+0x461/0x5e0 [ 754.954493] ? d_lru_del+0x130/0x130 [ 754.958203] ? kasan_check_read+0x11/0x20 [ 754.962330] ? do_raw_spin_trylock+0x270/0x270 [ 754.966892] ? lockref_get_not_dead+0x90/0x90 [ 754.971373] __dentry_kill+0x44c/0x7a0 [ 754.975242] ? d_drop+0x70/0x70 [ 754.978502] ? lock_downgrade+0x900/0x900 [ 754.982634] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 754.987549] dentry_kill+0xc9/0x680 [ 754.991162] dput.part.25+0x660/0x860 [ 754.994944] ? shrink_dcache_sb+0x350/0x350 [ 754.999244] ? kasan_check_read+0x11/0x20 [ 755.003371] ? do_raw_spin_unlock+0xa7/0x330 [ 755.007757] ? do_raw_spin_trylock+0x270/0x270 [ 755.012322] dput+0x15/0x20 [ 755.015246] path_put+0x31/0x70 [ 755.018522] free_fs_struct+0x22/0x60 [ 755.022320] exit_fs+0xf3/0x130 [ 755.025589] do_exit+0xf52/0x26d0 [ 755.029052] ? do_raw_spin_unlock+0x31/0x330 [ 755.033445] ? mm_update_next_owner+0x990/0x990 [ 755.038099] ? print_usage_bug+0xc0/0xc0 [ 755.042147] ? zap_class+0x640/0x640 [ 755.045846] ? find_held_lock+0x36/0x1c0 [ 755.049893] ? __lock_acquire+0x62f/0x4c20 [ 755.054109] ? lock_downgrade+0x900/0x900 [ 755.058245] ? mark_held_locks+0x130/0x130 [ 755.062463] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 755.067676] ? drop_futex_key_refs.isra.14+0x6d/0xe0 [ 755.072766] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 755.078281] ? futex_wait+0x5ec/0xa50 [ 755.082075] ? futex_wait_setup+0x3e0/0x3e0 [ 755.086379] ? drop_futex_key_refs.isra.14+0x6d/0xe0 [ 755.091469] ? futex_wake+0x304/0x760 [ 755.095254] ? zap_class+0x640/0x640 [ 755.098968] ? memset+0x31/0x40 [ 755.102233] ? find_held_lock+0x36/0x1c0 [ 755.106277] ? get_signal+0x95b/0x1980 [ 755.110144] ? _raw_spin_unlock_irq+0x27/0x80 [ 755.114630] ? _raw_spin_unlock_irq+0x27/0x80 [ 755.119112] do_group_exit+0x177/0x440 [ 755.122987] ? trace_hardirqs_off_caller+0x310/0x310 [ 755.128072] ? __ia32_sys_exit+0x50/0x50 [ 755.132136] get_signal+0x8b0/0x1980 [ 755.135839] ? ptrace_notify+0x130/0x130 [ 755.139886] ? find_held_lock+0x36/0x1c0 [ 755.143934] ? __might_fault+0x12b/0x1e0 [ 755.147980] do_signal+0x9c/0x21c0 [ 755.151499] ? perf_trace_sched_process_exec+0x860/0x860 [ 755.156925] ? posix_ktime_get_ts+0x15/0x20 [ 755.161245] ? trace_hardirqs_off_caller+0x310/0x310 [ 755.166348] ? preempt_notifier_register+0x200/0x200 [ 755.171433] ? __switch_to_asm+0x34/0x70 [ 755.175483] ? setup_sigcontext+0x7d0/0x7d0 [ 755.179788] ? exit_to_usermode_loop+0x8c/0x380 [ 755.184439] ? exit_to_usermode_loop+0x8c/0x380 [ 755.189118] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 755.193701] ? trace_hardirqs_on+0xbd/0x310 [ 755.198004] ? do_syscall_64+0x6be/0x820 [ 755.202049] ? __x64_sys_futex+0x47f/0x6a0 [ 755.206269] exit_to_usermode_loop+0x2e5/0x380 [ 755.210850] ? __bpf_trace_sys_exit+0x30/0x30 [ 755.215341] ? ret_from_fork+0x15/0x50 [ 755.219211] do_syscall_64+0x6be/0x820 [ 755.223078] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 755.228445] ? syscall_return_slowpath+0x5e0/0x5e0 [ 755.233377] ? trace_hardirqs_on_caller+0x310/0x310 [ 755.238390] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 755.243409] ? post_copy_siginfo_from_user.isra.25.part.26+0x250/0x250 [ 755.250073] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 755.254900] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 755.260071] RIP: 0033:0x457669 [ 755.263285] Code: Bad RIP value. [ 755.266632] RSP: 002b:00007f84a8eb0cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 755.274326] RAX: fffffffffffffe00 RBX: 000000000072bfa8 RCX: 0000000000457669 [ 755.281584] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bfa8 [ 755.288836] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 755.296086] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bfac [ 755.303339] R13: 00007ffc81c1c86f R14: 00007f84a8eb19c0 R15: 000000000072bfac [ 755.311829] Kernel Offset: disabled [ 755.315808] Rebooting in 86400 seconds..